Federal Court Dismisses PIPEDA Breach Claim Against Lender

Date: 20260619 Docket: T-2683-25 Citation: 2026 FC 841 Ottawa, Ontario, June 19, 2026 PRESENT: The Honourable Mr. Justice Fothergill BETWEEN: [NAME] Applicant and [COMPANY]. Respondent

REASONS AND

JUDGMENT I. Overview [ 1 ] The Applicant [NAME] has brought an application pursuant to s 14 of the Personal Information Protection and Electronic Documents Act , SC 2000, c 5 [PIPEDA]. He alleges that the Respondent [COMPANY] [[NAME]] conducted credit inquiries without his consent and did not communicate the risks associated with those inquiries. He also says that [NAME] failed to retain relevant records contrary to the principles of the PIPEDA. He seeks various remedies, including an award of damages and declaratory relief. [ 2 ] For the reasons that follow, I agree with the conclusion of the Office of the Privacy Commissioner [OPC] that the credit inquiry by [NAME] on February 17, 2021 was made without [NAME]’s consent. [NAME] removed the record of inquiry in accordance with [NAME]’s request, and this aspect of [NAME]’s complaint is therefore “well-founded and resolved” . [ 3 ] I also agree with the OPC’s conclusion that, in all other respects, [NAME]’s complaint against [NAME] is “not well-founded” . The application is therefore dismissed.

II. Background [ 4 ] [NAME] is a Canadian non-prime lender that offers personal loans to people who may not be able to obtain credit from traditional banks. According to [NAME]’s website, they say “YES when the banks say no” . [ 5 ] Between November 2020 and June 2023, [NAME] submitted six loan applications to [NAME]: (a) On November 25, 2020, [NAME] submitted a loan application online. He was approved to borrow a portion of the funds he requested, but [NAME] withdrew the application. (b) On November 27, 2020, [NAME] submitted a loan application in-person at an [NAME] branch. He later withdrew the application. (c) On February 16, 2021, [NAME] submitted a loan application online. The application was approved, but [NAME] withdrew it. (d) On April 3, 2021, [NAME] submitted a loan application in-person at an [NAME] branch. The application was approved and resulted in a loan to [NAME]. (e) On February 22, 2022, [NAME] submitted a loan application online. He was approved to borrow a portion of the funds he requested, but [NAME] withdrew the application. (f) On June 14, 2023, [NAME] submitted a loan application online. The application was refused. [ 6 ] For every loan application, [NAME] was asked to consent to [NAME]’s standard terms and conditions, which included the following: [COMPANY]. (“[NAME]”) collects, uses and discloses personal information for purposes limited to those which are related to its businesses. […] For Applicant(s) and Co-Applicant(s) [NAME] collects this information to: (i) confirm your identity and qualify you for the services for which you have applied, including obtaining a credit information report about you or your related financial history; (ii) assess your current and ongoing creditworthiness; (iii) verify any other information you provided in connection with your application; (iv) locate you to collect outstanding debts; (v) evaluate and make a decision about your application; (vi) match credit reports about you to determine your initial and ongoing eligibility for, and providing the products and services you request; […] […] For Applicants and or Co-Applicants you accordingly permit us to obtain a copy of your credit report from [NAME] and to contact your employer to verify your employment, as applicable. You consent that [NAME] may use any credit reports that we obtain to assess your initial and ongoing creditworthiness. In addition, subject to applicable laws and the policies and procedures of the applicable credit reporting agency, you consent to [NAME] obtaining your [NAME] credit score from a credit reporting agency for a period of up to one year after (i) termination of any lending arrangement you have with [NAME]; or (ii) the date that, and in the event that, [NAME] declines or you withdraw your application. […] [ 7 ] [NAME] was also asked to read [NAME]’s privacy policy, which included the following: To assess your eligibility and suitability for our products and services: When you apply for credit, a lease, or other products and/or services we may ask about your credit and payment history, education, employment, annual income, assets, and liabilities. We use this information to assess your application, verify your identity, assess your current and ongoing creditworthiness, update our records, and to determine your eligibility for new offers, promotional offers and other products and services, to manage and assess our risks and to help us help you manage your loan responsibly. Your consent is effective for as long as you have the product or service with us. We obtain credit information and other information about you from [NAME] that may include the types and amounts of credit advanced to you, payment histories, collection actions, legal proceedings, previous bankruptcies and other information reported by your creditors. [ 8 ] The loan agreement between [NAME] and [NAME] addressed the possibility of credit inquiries: We collect, use and disclose your personal information for the purposes of obtaining a credit information report or related financial history including for the purposes of verifying your current and ongoing creditworthiness and other information you provided in connection with your application and locating you to collect outstanding debts; providing credit information to potential creditors, credit bureaus and [NAME]; […] We may also share this information with third-party collection agencies engaged to assist in the collection of bad debt or to agencies that acquire bad debt. Social Insurance Numbers, birth dates or other identifiers, if collected, may be used to verify your identity, including matching credit reports. […] You acknowledge that a consumer report/personal report containing credit or personal information will be referred to in connection with this Agreement. You consent to us obtaining such a report from credit bureaus/consumer reporting agencies and other third parties as described in our Privacy Policy. [ 9 ] According to [NAME]’s consumer report with [NAME], credit inquiries were made on November 25, 2020, February 16, 2021, and February 17, 2021. These were “hard” inquiries, which had the effect of temporarily and adversely affecting his consumer credit score. [NAME] also conducted “soft” inquiries on November 27, 2020, February 22, 2022, and June 14, 2023, following the loan applications that were submitted on those dates. Soft credit inquiries do not adversely affect one’s consumer credit score. [ 10 ] [NAME] acknowledges that the “hard” credit inquiry made on February 17, 2021 was duplicative and done without [NAME]’s consent. [NAME] says this resulted from a delay in processing the loan application of February 16, 2021. [NAME] sent a letter to [NAME] requesting that it remove the February 17, 2021 duplicative credit inquiry. [NAME] complied with this request. [ 11 ] [NAME] submitted a complaint to the OPC, which was accepted on April 24, 2024. The OPC found that [NAME] had obtained [NAME]’s consent for the collection and subsequent disclosure of his personal information and had advised him of the purpose of disclosing personal information to [NAME]. [NAME] also explained the potential risk to his creditworthiness. [ 12 ] The OPC confirmed that the credit inquiry on February 17, 2021 was made without consent. [NAME] subsequently removed the record of inquiry, the OPC considered this aspect of [NAME]’s complaint to be “well-founded and resolved” . [ 13 ] In all other respects, the OPC concluded that [NAME]’s complaint against [NAME] was “not well-founded” .

III. Issue [ 14 ] The sole issue raised by this application is whether [NAME] complied with the PIPEDA in its processing of [NAME]’s loan requests.

IV. Analysis [ 15 ] Applications under s 14 of the PIPEDA are determined de novo ( [NAME] v [COMPANY] , 2018 FC 1155 [ [NAME] ] at para 20). Before bringing an application in this Court pursuant to s 14 of the PIPEDA, an applicant must first make a complaint to the OPC. However, this application does not entail judicial review of the OPC’s report and findings. Instead, the Court must determine for itself whether [NAME] disclosed [NAME]’s personal information in a manner that contravened the PIPEDA ( [NAME] v [NAME] , 2010 FC 681 [ [NAME] ] at para 34). [ 16 ] The applicant bears the burden of adducing evidence of a breach of the PIPEDA ( [NAME] v Canada (Privacy Commissioner) , 2013 FC 31 at para 28). The evidence must be clear, convincing, and cogent ( [NAME] v [COMPANY] , 2025 FC 1679 [ [NAME] ] at para 59, citing [NAME] v [NAME].com.ca, Inc , 2023 FC 166 at para 4). [ 17 ] [NAME] alleges the following breaches of the PIPEDA: (a) [NAME] failed to retain application records for accounts, contrary to s 4.5.2 of Schedule I of the PIPEDA; (b) [NAME] lost or misplaced eight application records and proof of consent, contrary to s 4.7.1 of the same Schedule; (c) [NAME]’s poor record keeping demonstrates the inadequacy of its safeguards to protect against loss or misplacement of personal information, contrary to s 4.7.1 of the same Schedule; (d) [NAME] failed to communicate the risks, harms, and consequences associated with the collection, use, and disclosure of personal information for consumer reporting, contrary to s 4.3 of the same Schedule; (e) [NAME] conducted an unauthorized credit inquiry on February 17, 2021, contrary to s 4.3 of the same Schedule; and (f) [NAME] has not taken any corrective action with respect to the remaining loan applications. [ 18 ] In this application, [NAME] advances a new theory of why [NAME] did not properly obtain his consent before conducting the “hard” enquiries that temporarily and adversely affected his consumer credit score. In oral submissions, he cited decisions of the OPC in other cases that made reference to the Ontario Consumer Reporting Act , RSO 1990, c C.33 [Consumer Reporting Act]. None of these authorities were included in [NAME]’s Memorandum of Fact and Law, and the Court therefore granted [NAME]’s request to file supplementary written submissions to address the new authorities. [NAME]’s supplementary written submissions were received on June 15, 2026. [ 19 ] Schedule I of the PIPEDA provides in s 4.5.2 that organizations should develop guidelines and implement procedures to retain personal information and safeguard it against loss or theft. As the OPC found, while [NAME] did not have audio recordings of the verbal consent given by [NAME] for the loans and credit inquiries, it did retain a copy of the personal information he provided when he applied for the loans, as well as one signed loan agreement. [NAME] has not adduced any evidence to establish that [NAME] failed to safeguard his personal information against loss or theft. [ 20 ] Schedule I of the PIPEDA provides in s 4.3.2 that “[organizations] shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used”. According to [NAME]’s standard terms and conditions, it was authorized to use [NAME]’s personal information to obtain credit reports to assess his creditworthiness. This was also addressed in [NAME]’s privacy policy. [ 21 ] The OPC decisions referred to by [NAME] in his oral submissions do not establish that this Court has any jurisdiction to determine an organization’s compliance with the Consumer Reporting Act. Nor does the Consumer Reporting Act affect the application of the PIPEDA in this case. [ 22 ] [NAME] relies on the following OPC decisions that refer to the Consumer Reporting Act: (a) A [NAME] in Ontario should have obtained consent for credit check on spouse, PIPEDA Report of Findings #2011-004; (b) [NAME] from Individual’s Credit Report without his Knowledge, 2011 CanLII 93965 (PCC) [ [NAME] ] ; and (c) [COMPANY] used credit information to assess risk; calculate premiums, 2012 CanLII 81343 (PCC) [ Insurance Risk Assessment ] . [ 23 ] [NAME] demonstrates that an organization can be subject to both the PIPEDA and the Consumer Reporting Act, and each statute creates independent obligations (at paras 32-33). Depending on the circumstances, compliance with one statute “may” lead to compliance with the other. However, this does not mean that the PIPEDA incorporates the requirements of the provincial Consumer Reporting Act into the federal statutory scheme. [NAME] recognizes that provincial agencies are responsible for ensuring compliance with, and adjudicating complaints under, the Consumer Reporting Act ( [NAME] at para 12). [ 24 ] In the remaining two authorities cited by [NAME], the OPC did not refer to the Consumer Reporting Act in its analysis of a company’s obligations under the PIPEDA. In Insurance Risk Assessment , the OPC accepted that the Consumer Reporting Act could assist in determining what a reasonable person might understand as falling within the scope of consent (at paras 24-29). However, it is unclear how the breaches of the Consumer Reporting Act alleged by [NAME] could inform the content of [NAME]’s obligations under the PIPEDA in this case. [ 25 ] [NAME] also cited a number OPC decisions where organizations were found not to have obtained consent before conducting credit enquiries. These cases may be distinguished on the ground that, with one exception discussed below, [NAME] did obtain [NAME]’s consent. [ 26 ] [NAME] has not demonstrated that [NAME] failed to properly inform him of the risks, harms, and consequences associated with the use, collection, and disclosure of his personal information. Pursuant to [NAME]’s standard terms and conditions, as well as its privacy policy, [NAME] should reasonably have expected that [NAME] would disclose his personal information to [NAME] to obtain a credit report, including through “hard” inquires. In addition, [NAME] should reasonably have understood the nature, purpose, and consequences of the collection, use, or disclosure of his personal information, consistent with s 6.1 of the PIPEDA. [ 27 ] [NAME] concedes that it conducted one “hard” credit inquiry on February 17, 2021 without [NAME]’s consent. It then took appropriate steps to correct the error. Nevertheless, “just because an organization has taken steps to correct a breach [of PIPEDA] does not mean that the breach did not occur” ( [NAME] v [COMPANY] , 2010 FC 1284 [ [NAME] ] at para 31). [NAME]’s efforts to correct its breach of PIPEDA should instead be considered when determining the appropriate remedy, if any ( [NAME] at para 31).

V. Remedies [ 28 ] Damages under s 16 of the PIPEDA may be awarded only when they result from a breach of the PIPEDA ( [NAME] v [COMPANY] , 2018 FC 525 at para 22, citing [NAME] v [COMPANY] , 2012 FC 1095 at para 38). Awards of damages are discretionary and should not be made lightly. They are warranted “only in the most egregious situations” , where there has been a serious breach of the PIPEDA ( [NAME] at para 105, citing [NAME] at para 55; [NAME] at para 60). [ 29 ] [NAME] seeks $210,000 in damages, $2,997 in lost billable hours, $25,000 in humiliation and reputational harm, and $25,000 in exemplary damages. He cites [NAME] v [NAME] , 2013 FC 1103 [ [NAME] ], where a credit check was made without consent. Justice Michael Phelan awarded the applicant $10,000 in damages and another $10,000 in exemplary damages. [NAME] also relies on [NAME] , where a credit reporting agency’s error caused incorrect information to be provided to a [COMPANY] during the processing of a loan application. Justice Russel Zinn considered the case to be egregious and awarded $5,000 in damages together with declaratory relief. [ 30 ] Unlike the respondent in [NAME] voluntarily corrected its mistake and asked [NAME] to remove the one credit inquiry that was done without [NAME]’s consent. In [NAME] , the applicant testified to the humiliation he experienced when his loan was refused and he was obliged to inform his business partner. There was also evidence that the mistake contributed to the [COMPANY]’s refusal of the loan, and that the respondent had “profited from the disclosure and acted in bad faith in failing to take responsibility for its error” . [ 31 ] In oral submissions, [NAME] drew the Court’s attention to a number of additional authorities that were not included in his Memorandum of Fact and Law. All of these may be distinguished on the grounds that they concerned much more serious breaches of privacy law or arose in a different legal context, e.g ., defamation; intentional infliction of emotional distress. [ 32 ] [NAME] has not adduced clear, convincing, and cogent evidence to demonstrate that he has suffered any of the losses he claims. Nor has he established a causal link between any losses and the one credit inquiry that was made without his consent. There is no evidence of any impact on his reputation, nor of any humiliation, resulting from [NAME]’s error. There is no evidence of any adverse effect on [NAME]’s circumstances, financial or otherwise. It would therefore be inappropriate for the Court to award damages for the one credit inquiry that [NAME] conducted without his consent, and which has since been corrected. [ 33 ] Considering the outcome of this application, and [NAME]’s acknowledgment that it contravened the PIPEDA by making one “hard” credit inquiry without [NAME]’s consent, there is no longer a “real dispute” between the parties. Declaratory relief would also be inappropriate ( SA v [NAME] , 2019 SCC 4 at para 60).

VI. Costs [ 34 ] [NAME] seeks costs in the all-inclusive amount of $2,500. I agree with [NAME] that [NAME]’s application was largely without merit. His reliance on undisclosed authorities needlessly complicated the proceedings. [ 35 ] According to [NAME], $2,500 is less than half of the costs it actually incurred to respond to this application. Taking into account all of the circumstances, including the need to deter similarly unmeritorious applications in the future, this quantum of costs is reasonable.

VII. Conclusion [ 36 ] The application is dismissed with costs in the all-inclusive amount of $2,500.

JUDGMENT THIS COURT’S

JUDGMENT is that : The application is dismissed. Costs are payable by the Applicant [NAME] to the Respondent [COMPANY] in the all-inclusive amount of $2,500. “Simon Fothergill” Judge FEDERAL COURT SOLICITORS OF RECORD DOCKET: T-2683-25 STYLE OF CAUSE: [NAME] v [COMPANY]. PLACE OF HEARING: by videoconference DATE OF HEARING: June 1, 2026

REASONS AND

JUDGMENT: FOTHERGILL J. DATED: June 19, 2026 APPEARANCES : [NAME] (on his own behalf) For The Applicant [NAME] For The Respondent SOLICITORS OF RECORD : [COMPANY] and Solicitors Toronto, Ontario For The Respondent