ontario regulation 168/25

made under the

Consumer Reporting Act

Made: July 31, 2025
Filed: August 1, 2025
Published on e-Laws: August 5, 2025
Published in The Ontario Gazette: August 16, 2025

Amending Reg. 177 of R.R.O. 1990

(GENERAL)

1. Regulation 177 of the Revised Regulations of Ontario, 1990 is amended by adding the following sections:

Disclosure

10.1 (1) The following consumer reporting agencies are prescribed for the purposes of clause 12 (4.1) (a) of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc.

(2) The maximum fee for a disclosure that a consumer reporting agency may charge under subsection 12 (14) or (15) of the Act is $5.

Consumer Scores

10.2 (1) The following is the prescribed information for the purposes of subsection 12.0.1 (4) of the Act:

1. An explanation of what a consumer score is.

2. An explanation of the primary factors used by the agency to generate a consumer score.

3. An explanation of which consumer behaviours and actions may affect a consumer score.

4. An explanation as to why a consumer may have multiple consumer scores.

5. A statement that consumer scores may differ between consumer reporting agencies.

6. A description of the types of information about a consumer, maintained by the consumer reporting agency, that do not affect a consumer score.

7. An explanation of the circumstances in which a consumer can obtain their consumer score at no cost and the circumstances in which a consumer is required to pay to obtain their consumer score.

(2) The information prescribed by subsection (1) must be published in a clearly visible place on the website maintained by the consumer reporting agency.

2. (1) The Regulation is amended by adding the following sections:

Security Freezes

14. (1) The following consumer reporting agencies are prescribed for the purposes of subsection 12.4 (1) of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc.

(2) For the purposes of subsection 12.4 (1) of the Act, the prescribed deadline for placing a security freeze on the file of a consumer is as follows:

1. If the consumer requested the security freeze electronically, two business days after the later of the day on which the consumer requested the security freeze and the day on which the consumer complied with subsection 12.4 (9) of the Act.

2. If the consumer requested the security freeze by telephone or by other means of telecommunication, five business days after the later of the day on which the consumer requested the security freeze and the day on which the consumer complied with subsection 12.4 (9) of the Act.

3. If the consumer requested the security freeze by mail, 15 business days after the later of the day on which the consumer reporting agency received the consumer’s request and the day on which the consumer complied with subsection 12.4 (9) of the Act.

(3) For the purposes of subsection 12.4 (3) of the Act, the prescribed deadline to suspend a security freeze on the file of a consumer is as follows:

1. If the consumer requested the suspension electronically, two business days after the later of the day on which the consumer requested the suspension and the day on which the consumer complied with subsection 12.4 (9) of the Act.

2. If the consumer requested the suspension by telephone or by other means of telecommunication, five business days after the later of the day on which the consumer requested the suspension and the day on which the consumer complied with subsection 12.4 (9) of the Act.

3. If the consumer requested the suspension by mail, 15 business days after the later of the day on which the consumer reporting agency received the consumer’s request and the day on which the consumer complied with subsection 12.4 (9) of the Act.

(4) A consumer reporting agency prescribed by subsection (1) is exempt from the application of subsections 12.4 (3), (4), (5), (9) and (10) of the Act in respect of a request for the suspension of a security freeze made before July 1, 2027.

Publication of Information Re Alerts and Freezes

15. (1) The following consumer reporting agencies are prescribed for the purposes of section 12.5 of the Act:

1. Equifax Canada Co.

2. Trans Union of Canada, Inc.

(2) The following is the prescribed information for the purposes of paragraph 6 of section 12.5 of the Act:

1. The length of time an alert remains on a consumer’s file.

2. Information respecting how a consumer may amend an alert.

3. The length of time a security freeze remains on a consumer’s file.

4. The purposes for which a consumer’s information will not be disclosed when a security freeze is in place.

5. The purposes for which a consumer’s information would continue to be disclosed when a security freeze is in place.

(3) The information specified in section 12.5 of the Act must be published in a clearly visible place on the website maintained by the consumer reporting agency.

(2) Subsection 14 (4) of the Regulation, as made by subsection (1), is revoked.

(3) Subsection 15 (2) of the Regulation, as made by subsection (1), is amended by adding the following paragraph:

6. Information respecting how a consumer may suspend a security freeze.

Commencement

3. (1) Except as otherwise provided in this section, this Regulation comes into force on the later of July 1, 2026 and the day this Regulation is filed.

(2) Subsections 2 (2) and (3) come into force on July 1, 2027.