AAB upheld the Privacy Commissioner's decision and ruled that the telecommunication company had taken reasonably practicable steps to ensure data accuracy of its customer; that there was no change of use in passing the data to a debt collector to pursue the debt owed by a customer and that the retention of ex-customer's personal data for 180 days after account termination was appropriate.
Complainant asked for termination of phone account - service provider continued to treat account as active - passed data to debt collection agent - retained his personal data - DPPs 2(1), 2(2) and 3 of the PD(P)O
The Complaint
In his complaint, the complainant claimed that despite his request to terminate his mobile phone account with the telecommunication company ("the company") through the service hotline and despite the fact that he had already cleared all charges, the company had failed to ensure that this was accurately reflected in its records. Accordingly, the company wrongly appointed a debt collector to go after him. In addition, the complainant alleged that the company continued to retain his records after his account had been terminated for 9 months. The above was alleged to involve contravention of DPP 2(1)(a) (regarding accuracy), DPP3 (regarding use) and DPP2(2) (regarding retention) of the PD(P)O.
Findings of the Privacy Commissioner
Upon investigation, there was no supporting evidence to show that the complainant had actually verbally requested the termination of the service at the date he claimed. Although the company subsequently waived the service fee for the period disputed by the complainant, the evidence indicated that there was an outstanding debt prior to the date the service was terminated. As such, the company was justified in passing the default data to a debt collection agency for action. Regarding the period of retention, the company explained that according to its policy, in order to enable the efficient re-connection of service, customer data were retained for 180 days after the suspension of service. The PCPD found that the period of retention in the case did not exceed the said period of 180 days from the date of actual termination of service. The Privacy Commissioner found no contravention of the requirements of the PD(P)O. Dissatisfied with the findings, the complainant lodged an appeal with the AAB.
The Appeal
The AAB addressed the issues relating to the provisions of the PD(P)O. On the question of the accuracy of complainant's personal data, the AAB accepted that DPP2(1)(a) does not oblige a data user to keep all data absolutely accurate at all times. All that is required is for reasonably practicable steps to be taken to ensure the accuracy of the data. The AAB was satisfied that, in the present case, the company had already established a sound system to accept instructions for termination of service, and to update its data according to such instructions received, even though this could not rule out entirely the possibility of commission of any mistakes. On the other hand, there was not sufficient evidence to show that the complainant did in fact give the verbal instructions for termination as he claimed. On the basis of the above, the AAB found no contravention of DPP2(1)(a).
On the question of the alleged change of use, the AAB found that the company had relied on its account records and acted according to instruct a debt collector to pursue the debt. Even if such records were mistaken (on which there was no concrete evidence), still there was no change of use in breach of DPP3.
On the question of the retention period, the AAB found that the company's policy of retention of ex-customers' data for 180 days was appropriate. Furthermore, even if in the present case the complainant had given the verbal instructions at the date he claimed (on which there was again no concrete evidence) hence the period of actual retention had exceeded 180 days, the AAB would still consider it to be acceptable in the circumstances.
AAB's decision
The appeal was dismissed.