The Privacy Commissioner of Canada (the "Federal Commissioner"), the Information and Privacy Commissioner for British Columbia (the "B.C. Commissioner") and the Information and Privacy Commissioner of Alberta (the "Alberta Commissioner") recently announced a joint investigation into the privacy compliance of Certn, a Canadian company that offers tenant screening services across Canada.1 In particular, the commissioners stated that they will investigate whether Certn ensures that the information it collects, uses, and discloses for the purposes of tenant screening is sufficiently accurate, complete, and up to date, and whether the purposes for which it collects that information are appropriate. This announcement follows the B.C. Commissioner's 2018 investigation report on tenant screening and algorithms.2
The announcement signals to landlords and property managers across Canada that privacy regulators are looking closely at privacy compliance in the real estate industry. The Federal Commissioner cautions that "[l]andlords, and the services that they employ, must comply with Canadian privacy laws." Accordingly, landlords and property managers should take steps to ensure that their tenant screening practices comply with all applicable privacy laws. In this blog post, we describe some of the main privacy laws that may apply to different types of tenant screening, including social media checks and criminal background checks.
- Privacy Law
Privacy laws vary across Canada. In British Columbia and Alberta, the province's respective Personal Information Protection Act ("PIPA") generally applies to the collection, use, and disclosure of personal information by private sector organizations.3 In many other Canadian provinces, including Ontario, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") generally applies to private sector organizations.4
Key principles reflected in PIPEDA and the PIPAs include:
- Consent: Organizations must obtain informed consent before collecting, using, or disclosing someone's personal information or rely on one of the narrow exceptions to the consent requirement.5 Depending on the circumstances, consent may be express or implied.
- Limits: Organizations may generally collect, use, and disclose personal information only to the extent necessary for the relevant purposes, and only if a reasonable person would consider the collection, use, or disclosure appropriate in the circumstances.
- Accuracy: Organizations should generally ensure that the personal information they collect, use, and disclose is accurate, complete, and up to date as necessary, taking into account the relevant purposes and the interests of the individual.
With these principles in mind, we describe below common types of tenant screening checks and some of the privacy considerations they may raise.
- Social Media Checks
The B.C. Commissioner has cautioned that internet searches for information about prospective tenants are almost never authorized under B.C. privacy law.6 Similarly, the Alberta Commissioner "generally discourage[s]" such searches given the privacy issues that may arise through an inadvertent collection of personal information.7
In B.C., it is a common misconception that landlords and property managers may review a prospective tenant's social media accounts without consent. Searching an applicant on the internet, including on social media, is generally considered a collection of personal information under B.C. privacy law. Although there are a few express allowances for collecting information on publicly available sources without consent, including professional business directories, newspapers, and magazines, these narrow exceptions do not include social media.8
The B.C. Commissioner has warned that even if an organization obtains consent, collecting this information remains risky because: (i) there is a tendency to collect more information than a reasonable person would consider appropriate in the circumstances; (ii) it is often difficult to confirm the accuracy of information that is viewed and collected online; and (iii) social media searches may inadvertently disclose information about third parties who did not consent to the search.9 Accordingly, even with consent, viewing personal information about a prospective tenant on search engines and social media platforms may not meet PIPA's reasonableness requirement.
PIPA's accuracy requirements also present challenges for this form of background check.10 Organizations must make a reasonable effort to ensure that the personal information it collects is accurate and complete if that information is likely to be used to make a decision that affects the individual, or if it is likely to be disclosed to another organization. Determining and verifying the accuracy of information collected via social media can be challenging if not impossible.
A further level of complexity is that organizations would need to take screenshots of every page viewed. Where an organization in B.C. uses personal information about an individual to make a decision about them, the organization must retain the information for at least one year and provide a copy to the individual on request (subject to some narrow exceptions).11
- Criminal Record Checks
The B.C. Commissioner has stated that in most situations, running a criminal record check on a prospective tenant will be neither necessary nor reasonable.12
Former B.C. Commissioner Elizabeth Denham pointed out in her 2014 report on the Use of Police Information Checks in British Columbia that little research has been conducted on the usefulness of criminal record checks.13 Also, these checks can reveal sensitive personal information about a person's past activities, including mental health information, prior convictions, penalties and outstanding charges, and details about contact with police. This information may be untested, unproven and stigmatizing.
Landlords and property managers in British Columbia cannot require a prospective tenant to consent to a criminal record check as a condition of providing a rental unit, unless the information is necessary. In some situations, landlords and property managers may be able to justify running these checks, such as if there is a daycare in the rental building.14 In all cases, landlords and property managers should have clear reasons for why they need the information.
- Checks involving information protected under human rights laws
In British Columbia, landlords and property managers cannot refuse to rent to someone based on their race, colour, ancestry, place of origin, religion, marital status, family status, physical or mental disability, sex, gender identity or expression, age, sexual orientation, or lawful source of income.15 There are limited exceptions to this rule, including that landlords and property managers can refuse to rent a residence to individuals under 55 if the unit is a residential complex where every unit is reserved for someone over 55.16
The B.C. Commissioner has noted that using information protected under the Human Rights Code is generally not a purpose that would be appropriate, so landlords and property managers are generally not authorized to collect this information.17
- Public Records Checks
In British Columbia, landlords and property managers can collect information from a narrow set of prescribed publicly available sources without consent. These sources include: (i) registries that the public has a right to access, such as court registries and records of residential tenancy disputes; and (ii) printed or electronic publications, such as magazines, books, and newspapers.18 Although landlords and property managers do not require consent to collect information from these sources, they must notify a prospective tenant beforehand if they intend to use the tenant's name to collect information from these sources.19
- Employment/Income Verification
It may be reasonable for landlords and property managers to conduct searches to collect information about a prospective tenant's proof of income or employment if they cannot verify the tenant's employment through references.20 As with other types of searches, landlords and property managers should obtain tenants' consent before running these searches.
- Credit Reports and Histories
Credit reports contain personal, financial, and credit history information that can be used to make decisions about tenancies, employment, and other applications that consider financial responsibility as a factor. In most provinces, individuals must consent for a business or individual to use their credit report. In Nova Scotia, Prince Edward Island, and Saskatchewan, individuals need only be informed that their credit report is being checked. In his 2018 report, the B.C. Commissioner recommended that:
- "Landlords should only require a prospective tenant to consent to a credit check, and provide information to allow the landlord to perform a credit check, when the prospective tenant cannot provide sufficient references about previous tenancies or satisfactory employment and income verification"; and
- "Landlords should explicitly state whether the credit report they collect could lower the prospective tenant's credit score. They must also state on the form which credit reporting agencies are providing the information."
In British Columbia, the Business Practices and Consumer Protection Act requires organizations to have evidence that the individual consented to such a report. This is usually done by including a consent in an application for credit, insurance, employment, or tenancy.21
Tenant Screening Services
Landlords and property managers have an interest in selecting tenants that are reliable and responsible. But before accessing a screening service that involves the collection, use, or disclosure of personal information about prospective tenants, landlords and property managers should consider their obligations under all applicable privacy laws. They cannot rely on third parties to collect and use personal information on their behalf that they themselves would not be authorized to collect or use.22 Accordingly, they should be aware of their obligations under applicable privacy laws and assess service providers' compliance when considering outsourcing tenant screening.
The investigation into Certn will likely provide additional insights on the application and interpretation of privacy laws in the context of tenant screening. If you have any questions about tenant screening or privacy law more generally, please contact our Cyber/Data team.
Footnotes
1 The Federal and British Columbia Commissioners announced the launch of the investigation on June 4, 2024. The Alberta Commissioner announced their participation in the investigation on July 11, 2024.
2 Acting Information and Privacy Commissioner for British Columbia, Investigation Report P18-01: Always, sometimes, or never? Personal information & tenant screening, March 22, 2018 [2018 Report].
3 Both British Columbia and Alberta call their private sector privacy laws the Personal Information Protection Act ("PIPA.") For the British Columbia PIPA see here, and for the Alberta PIPA see here.
4 For more information about provincial privacy laws that may apply instead of PIPEDA, see here.
5 Office of the Privacy Commissioner of Canada, Guidelines for Obtaining Meaningful Consent (revised August 13, 2021).
6 2018 Report.
7 Office of the Information and Privacy Commissioner of Alberta, Landlords and Tenants: Guidance on PIPA, December 2023.
8 Personal Information Protection Act Regulations (British Columbia), section 6(1).
9 Office of the Information and Privacy Commissioner of British Columbia, Conducting Social Media Background Checks (updated May 2017).
10 British Columbia PIPA, section 33; Alberta PIPA, section 33.
11 British Columbia PIPA, section 35.
12 Office of the Information and Privacy Commissioner of British Columbia, Guidance Document: Private Sector Landlord and Tenants, September, 2019 [2019 Guidance Document.]
13 Information Privacy Commissioner for British Columbia, Investigation Report F14-01: Use of Police Information Checks in British Columbia, April 15, 2014.
14 2019 Guidance Document.
15 Human Rights Code (British Columbia), section 10(1).
16 Human Rights Code (British Columbia), section 10(2).
17 2019 Guidance Document.
18 British Columbia PIPA, section 12(1)(e); Personal Information Protection Act Regulations (British Columbia), section 6(1).
19 2018 Report.
20 2019 Guidance Document.
21 Business Practices and Consumer Protection Act (British Columbia), section 107.
22 2019 Guidance Document.
To view the original article click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.