Consumer Reporting Act

R.R.O. 1990, REGULATION 177

GENERAL

Consolidation Period:  From August 1, 2025 to the e-Laws currency date.

Last amendment: 168/25.

Legislative History: 692/91, 517/97, 468/01, 24/05, 252/07, 187/16, 168/25.

This is the English version of a bilingual regulation.

Definition

0.1 In this Regulation,

“alert” means an alert described in subsection 12.1 (1) of the Act.  O. Reg. 252/07, s. 1; O. Reg. 187/16, s. 1.

Application

1. (1) An application for registration as a consumer reporting agency or a renewal thereof shall be in a form provided by the Minister.  R.R.O. 1990, Reg. 177, s. 1 (1).

(2) An application for registration as a personal information investigator or a renewal thereof shall be in a form provided by the Minister.  R.R.O. 1990, Reg. 177, s. 1 (2).

(3) A notice by a consumer reporting agency under clause 15 (a), (b) or (c) of the Act shall be in a form provided by the Minister.  R.R.O. 1990, Reg. 177, s. 1 (3).

Exemptions

2. A person licensed under the Private Security and Investigative Services Act, 2005 as a private investigator or as both a private investigator and a security guard is exempt from paying the prescribed fee upon registration. O. Reg. 187/16, s. 2.

3. A user shall withhold from the disclosure required by subsection 10 (7) of the Act any medical information obtained with the written consent of the consumer which the consumer’s own physician specifically requests in writing be withheld from the consumer in the consumer’s own best interest.  R.R.O. 1990, Reg. 177, s. 3.

4. A person providing counselling service in respect of consumer credit and who is receiving public money under the Ministry of Community and Social Services Act for that purpose is exempt from the Act.  R.R.O. 1990, Reg. 177, s. 4.

Fees

5. The following fees are payable to the Registrar:

1. $290, upon application for registration as a consumer reporting agency or renewal of the registration.

2. $290, for each branch office of a consumer reporting agency.

3. $190, upon application for registration as a personal information investigator or renewal of the registration.  O. Reg. 517/97, s. 1.

6. No person shall be registered as a consumer reporting agency or a personal information investigator unless the person,

(a) if an individual, is eighteen years of age or over; and

(b) if an applicant for registration as a consumer reporting agency, has had at least two years of actual or related experience in all phases of consumer reporting.  R.R.O. 1990, Reg. 177, s. 6.

Terms and Conditions of Registration

7. (1) Every registration expires on the date shown on the certificate of registration unless an application for renewal of registration in a form provided by the Minister, together with the appropriate fee prescribed in section 5, is filed with the Registrar prior to the date of expiry.  R.R.O. 1990, Reg. 177, s. 7 (1).

(2) A registered consumer reporting agency shall not carry on business in a name other than the name in which the agency is registered or invite the public to deal at a place other than that authorized by the registration.  R.R.O. 1990, Reg. 177, s. 7 (2).

(3) Every person registered as a consumer reporting agency shall operate from a permanent business premises in Ontario.  R.R.O. 1990, Reg. 177, s. 7 (3).

(4) Every applicant for registration shall state in the application an address for service in Ontario.  R.R.O. 1990, Reg. 177, s. 7 (4).

(5) A copy of a current financial statement for the applicant that is prepared by an individual licensed in accordance with the Public Accounting Act, 2004 or a professional corporation holding a certificate of authorization in accordance with that Act shall be attached to an application for registration. O. Reg. 187/16, s. 3.

(6) A consumer reporting agency shall not operate any branch office unless such branch office is authorized by the registration.  R.R.O. 1990, Reg. 177, s. 7 (6).

(7) Where the registration of a consumer reporting agency or personal information investigator is suspended, revoked or surrendered, the registrant shall immediately return the certificate of registration to the Registrar by registered mail.  R.R.O. 1990, Reg. 177, s. 7 (7).

(8) The Registrar may require further information or material to be submitted by any applicant or registered person within a specified time limit and may require verification by affidavit or otherwise of any information or material then or previously submitted.  R.R.O. 1990, Reg. 177, s. 7 (8).

8. Every personal information investigator shall, within five days after the event, notify the Registrar of,

(a) any change in the investigator’s address for service and such notice shall be in a form provided by the Minister; and

(b) any commencement or termination of the investigator’s employment and such notice shall be in a form provided by the Minister.  R.R.O. 1990, Reg. 177, s. 8.

9. Where a consumer reporting agency is a corporation it shall, within five days after the event, notify the Registrar in a form provided by the Minister where there is a change in a director of the corporation or where there is a change in its controlling interest.  R.R.O. 1990, Reg. 177, s. 9.

10. A voluntary cancellation of registration under subsection 6 (7) of the Act shall be in a form provided by the Minister.  R.R.O. 1990, Reg. 177, s. 10.

Note: On July 1, 2026, the Regulation is amended by adding the following sections: (See: O. Reg. 168/25, s. 1)

Disclosure

10.1 (1) The following consumer reporting agencies are prescribed for the purposes of clause 12 (4.1) (a) of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc. O. Reg. 168/25, s. 1.

(2) The maximum fee for a disclosure that a consumer reporting agency may charge under subsection 12 (14) or (15) of the Act is $5. O. Reg. 168/25, s. 1.

Consumer Scores

10.2 (1) The following is the prescribed information for the purposes of subsection 12.0.1 (4) of the Act:

1. An explanation of what a consumer score is.

2. An explanation of the primary factors used by the agency to generate a consumer score.

3. An explanation of which consumer behaviours and actions may affect a consumer score.

4. An explanation as to why a consumer may have multiple consumer scores.

5. A statement that consumer scores may differ between consumer reporting agencies.

6. A description of the types of information about a consumer, maintained by the consumer reporting agency, that do not affect a consumer score.

7. An explanation of the circumstances in which a consumer can obtain their consumer score at no cost and the circumstances in which a consumer is required to pay to obtain their consumer score. O. Reg. 168/25, s. 1.

(2) The information prescribed by subsection (1) must be published in a clearly visible place on the website maintained by the consumer reporting agency. O. Reg. 168/25, s. 1.

Alerts

11. Under subsection 12.1 (8) of the Act, an alert expires on the earlier of,

(a) six years after a consumer reporting agency includes it in a consumer’s file; and

(b) the time that a consumer reporting agency removes it from a consumer’s file at the request of the consumer.  O. Reg. 252/07, s. 1.

12. (1) If a consumer requires a consumer reporting agency to include an alert in the consumer’s file, the agency shall not require the consumer to pay a fee of more than $5 before the agency includes an alert in the consumer’s file.  O. Reg. 252/07, s. 1.

(2) If a consumer requires a consumer reporting agency to amend, remove or renew an alert included in the consumer’s file, the agency shall not require the consumer to pay any fee.  O. Reg. 252/07, s. 1.

13. (1) For the purposes of clause 12.3 (3) (a) of the Act,

“extension of credit or loaning of money” means any extension of credit or loaning of money, except as set out in subsection 12.3 (4) of the Act, and includes,

(a) any increase in a credit limit under a credit agreement for open credit,

(b) the issuance of additional credit cards under a credit agreement for open credit, or

(c) the lending of money on the security of a mortgage or charge of real property.  O. Reg. 252/07, s. 1.

(2) In subsection (1),

“credit agreement” and “open credit” have the same meaning as in subsection 12.3 (5) of the Act; (“convention de crédit”, “crédit en blanc”)

“credit card” means a credit card as defined in section 1 of the Consumer Protection Act, 2002. (“carte de credit”)  O. Reg. 252/07, s. 1.

(3) For the purposes of clause 12.3 (3) (b) of the Act, the following are prescribed as transactions involving a person purporting to be the consumer:

1. The purchase, assignment or collection of a debt of the person.

2. The entering into, amendment, assignment or renewal of a tenancy agreement involving the person.

3. The entering into, amendment, assignment or renewal of an agreement for the purchase, lease or rental of goods or services involving the person.

4. The entering into, amendment or renewal of employment of the person.

5. The underwriting of insurance involving the person.  O. Reg. 252/07, s. 1.

Note: On July 1, 2026, the Regulation is amended by adding the following section: (See: O. Reg. 168/25, s. 2 (1))

Security Freezes

14. (1) The following consumer reporting agencies are prescribed for the purposes of subsection 12.4 (1) of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc. O. Reg. 168/25, s. 2 (1).

(2) For the purposes of subsection 12.4 (1) of the Act, the prescribed deadline for placing a security freeze on the file of a consumer is as follows:

1. If the consumer requested the security freeze electronically, two business days after the later of the day on which the consumer requested the security freeze and the day on which the consumer complied with subsection 12.4 (9) of the Act.

2. If the consumer requested the security freeze by telephone or by other means of telecommunication, five business days after the later of the day on which the consumer requested the security freeze and the day on which the consumer complied with subsection 12.4 (9) of the Act.

3. If the consumer requested the security freeze by mail, 15 business days after the later of the day on which the consumer reporting agency received the consumer’s request and the day on which the consumer complied with subsection 12.4 (9) of the Act. O. Reg. 168/25, s. 2 (1).

(3) For the purposes of subsection 12.4 (3) of the Act, the prescribed deadline to suspend a security freeze on the file of a consumer is as follows:

1. If the consumer requested the suspension electronically, two business days after the later of the day on which the consumer requested the suspension and the day on which the consumer complied with subsection 12.4 (9) of the Act.

2. If the consumer requested the suspension by telephone or by other means of telecommunication, five business days after the later of the day on which the consumer requested the suspension and the day on which the consumer complied with subsection 12.4 (9) of the Act.

3. If the consumer requested the suspension by mail, 15 business days after the later of the day on which the consumer reporting agency received the consumer’s request and the day on which the consumer complied with subsection 12.4 (9) of the Act. O. Reg. 168/25, s. 2 (1).

(4) A consumer reporting agency prescribed by subsection (1) is exempt from the application of subsections 12.4 (3), (4), (5), (9) and (10) of the Act in respect of a request for the suspension of a security freeze made before July 1, 2027. O. Reg. 168/25, s. 2 (1).

Note: On July 1, 2027, subsection 14 (4) of the Regulation is revoked. (See: O. Reg. 168/25, s 2 (2))

Note: On July 1, 2026, the Regulation is amended by adding the following section: (See: O. Reg. 168/25, s. 2 (1))

Publication of Information Re Alerts and Freezes

15. (1) The following consumer reporting agencies are prescribed for the purposes of section 12.5 of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc. O. Reg. 168/25, s. 2 (1).

(2) The following is the prescribed information for the purposes of paragraph 6 of section 12.5 of the Act:

1. The length of time an alert remains on a consumer’s file.

2. Information respecting how a consumer may amend an alert.

3. The length of time a security freeze remains on a consumer’s file.

4. The purposes for which a consumer’s information will not be disclosed when a security freeze is in place.

5. The purposes for which a consumer’s information would continue to be disclosed when a security freeze is in place. O. Reg. 168/25, s. 2 (1).

Note: On July 1, 2027, subsection 15 (2) of the Regulation is amended by adding the following paragraph: (See: O. Reg. 168/25, s. 2 (3))

6. Information respecting how a consumer may suspend a security freeze.

(3) The information specified in section 12.5 of the Act must be published in a clearly visible place on the website maintained by the consumer reporting agency. O. Reg. 168/25, s. 2 (1).

Schedule Revoked:  O. Reg. 24/05, s. 2.