Equifax and Privacy Commissioner settle spat over audit

In August 2006, the Privacy Commissioner of Canada initiated an audit of Equifax under PIPEDA, which requires reasonable grounds to believe the audited company is in breach of the law. Equifax sought judicial review of that decision, arguing that the Commissioner did not have the grounds to initiate an audit. The parties have now settled the judicial review proceeding and it appears the audit is close to being concluded.

CNW Telbec

Privacy Commissioner works with Equifax to conclude audit

OTTAWA, March 16 /CNW Telbec/ - The Office of the Privacy Commissioner of
Canada announced today that it has successfully negotiated a resolution with
regard to litigation involving its audit of the credit reporting agency,
Equifax.

The Commissioner's Office launched an audit of Equifax in August 2006
under the Personal Information Protection and Electronic Documents Act
(PIPEDA), Canada's private sector privacy law. The intention was to audit the
personal information management practices of Equifax and, more specifically,
its online identification and authentication system. The Office has since
published guidelines for businesses on identification and authentication,
which are available on its web site.

Under section 18(1) of PIPEDA, the Commissioner may audit the personal
information management practices of an organization if she has reasonable
grounds to believe that the organization is contravening a provision of the
Act.

Equifax had launched an application for judicial review, challenging
whether the Privacy Commissioner's Office had reasonable grounds to conduct
the audit in the first place. The two parties recently negotiated a
resolution, the details of which are in the court documents. A notice of
discontinuance and minutes of settlement were filed with the Federal Court on
March 14, 2007.

"I am pleased that Equifax agreed to discontinue their court challenge
because it is important for us to make use of all the tools at our disposal,
including exercising our powers to audit personal information management
practices in the private sector," said Jennifer Stoddart, Privacy Commissioner
of Canada. "Ultimately, what we determine in our work can only be of benefit
to the organizations involved and their customers."

Throughout the course of the litigation, the Office's audit of Equifax
remained ongoing and a report will be provided to the credit reporting agency.

---

The Office of the Privacy Commissioner of Canada is mandated by
Parliament to act as an ombudsman, advocate and guardian of the privacy and
protection of personal information rights of Canadians.