Bell wrongly required ex-spouse’s consent for access to cellphone logs, privacy watchdog finds

Bell Canada breached federal privacy law when it refused to give a former shared-plan user his own cellphone logs without his ex-spouse’s consent, the Office of the Privacy Commissioner of Canada found.

The findings, dated January 9, 2026 and published June 4, distinguish control of a billing account from an individual’s right to access personal information about their own phone use. Bell supplied redacted records during the investigation and committed to changes in its procedures, employee training and public explanations of shared accounts.

Account control did not settle access rights

The complainant had been an authorized user on a Virgin Mobile Plus account held by his ex-spouse. After their relationship ended, he agreed to his removal from the account and moved his line to another carrier. Two years later, he requested call and text-message logs covering the period when he had used the shared plan.

Bell’s position was that information in the account belonged only to the account holder. It pointed out that the complainant was no longer listed on the account and said it needed the account holder’s written consent to release the logs. The holder was financially responsible for all lines, including any unpaid charges affecting her credit.

The commissioner’s office rejected the idea that those billing arrangements made the logs exclusively the holder’s personal information. Bell had not asked the complainant for evidence connecting him to the line. Investigators obtained evidence of his contracts and longstanding use of the number and accepted that he was its owner and user during the relevant period.

The report explains that an organization can seek additional information to verify whose personal information is being requested. Bell’s records did not always identify the user of each line on a shared account, but that gap did not justify simply refusing access because the requester was not the account holder.

Redaction and a fact-specific privacy balance

The logs contained two kinds of information. General account details, including the holder’s identifying and billing information, belonged to her and could be removed. Information about the complainant’s line included numbers contacted, dates, call lengths, city locations, communication formats and data use. The records did not contain the contents of calls or text messages, which Bell said it did not retain.

The office also considered Bell’s argument that details of the complainant’s phone use could be the holder’s personal information because they affected her bills. It said overlapping privacy interests required a fact-specific assessment of both individuals’ interests and the public interest in disclosure or non-disclosure.

The account holder could have a privacy expectation, particularly because the complainant had left the account and had not previously accessed its logs without her consent. But the records revealed much more about his personal activities than about her billing obligations. His privacy interest in the use of his own line was stronger in these circumstances.

The office also identified a public interest in protecting access rights on shared plans. Requiring permission from the sole account holder could leave other users with little recourse, particularly where a relationship involved an imbalance of power. Bell should have released the complainant’s line information while redacting information belonging solely to the holder, the report concluded.

The investigation separately found that Bell missed PIPEDA’s 30-day response deadline without giving an extension notice. Bell acknowledged the request promptly but answered about two months later. It attributed the delay to administrative confusion over a similar request sent from another email address and acknowledged that this did not excuse the delay.

Bell commits to procedural and transparency changes

Investigators identified a further problem with Bell’s explanations to shared-plan users. Its public communications did not make clear how much detail an account holder could see about another person’s phone activity. General awareness that usage would be shared did not necessarily tell users that this included numbers called, timing, duration and communication format.

Bell complied with the recommendation to give the complainant his logs with the account holder’s information redacted. The report nevertheless found its broader access procedures inadequate and recommended changes and employee training. Those recommendations included considering the recording of users’ names and clearly recording when their connection to a line or account began and ended, seeking supporting information where needed, and providing access without the holder’s consent when satisfied that the logs were the requester’s personal information.

Bell also committed to updating its privacy policy and frequently asked questions to explain both the user’s access rights and the detailed usage information available to the account holder. The report says Bell accepted all the recommendations; it does not set out a financial penalty or compensation award.

The final disposition found the late-response complaint well-founded and resolved after access was provided. The inadequate-access complaint was well-founded and conditionally resolved on the strength of the promised procedural and training changes. The additional openness issue was also conditionally resolved. Those commitments were not a finding that all the systemic changes had already been completed.

Source: PIPEDA Findings #2026-003 — Investigation into Bell’s response to an access request.