BILL 28 – 2025
BUSINESS PRACTICES AND CONSUMER
PROTECTION AMENDMENT ACT (No. 2), 2025

HIS MAJESTY, by and with the advice and consent of the Legislative Assembly of the Province of British Columbia, enacts as follows:

1 Section 4 of the Business Practices and Consumer Protection Act, S.B.C. 2004, c. 2, is amended

(a) in subsection (1) by adding the following definitions:

"credit repair services" has the same meaning as in section 112.34 [definitions];

"credit repair services provider" has the same meaning as in section 112.34;

"credit score" has the same meaning as in section 112.34;

"report" has the same meaning as in section 106 (1) [definitions];

"reporting agency" has the same meaning as in section 106 (1); , and

(b) in subsection (3) by adding the following paragraph:

(c.1) a representation by a credit repair services provider that

(i) it holds a licence to provide credit repair services, when no such licence exists,

(ii) it has the authority to compel a reporting agency to remove or amend information in a report, when no such authority exists, or

(iii) it can improve a credit score or information in a report, unless the representation is made to a specific consumer after

(A) examination of a report respecting that consumer, and

(B) reaching the conclusion, acting reasonably, that information in the report is inaccurate or incomplete; .

2 Section 18.3, as enacted by section 5 of the Business Practices and Consumer Protection Amendment Act, 2025, S.B.C. 2025, c. 3, is amended

(a) by adding the following subsection:

(0.1) In this section, "applicable contract" means the following:

(a) a credit monitoring services contract, as defined in section 106 (1) [definitions];

(b) a credit repair services contract, as defined in section 112.34 [definitions];

(c) a contract other than a contract referred to in paragraph (a) or (b), if

(i) this Division applies to the contract, and

(ii) the total price under the contract is more than the prescribed amount. ,

(b) in subsection (1) by striking out "into a contract" and substituting "into an applicable contract" and by striking out ", if the total price under the contract is more than the prescribed amount,",

(c) in subsection (3) (a) by striking out "entire contract" and substituting "applicable contract in its entirety", and

(d) in subsection (3) (b) by adding "applicable" before "contract".

3 The heading to Part 6 is repealed and the following substituted:

Part 6 – Credit Reporting and Credit Monitoring .

4 Section 106 is amended

(a) by renumbering the section as section 106 (1),

(b) in subsection (1) by adding the following definitions:

"credit agreement" has the same meaning as in section 57 (1) [definitions for Part 5];

"credit monitoring services" means services provided under the terms of a credit monitoring services contract that are intended to help protect a consumer from risks that could adversely affect a reporting agency's assessment of the consumer's creditworthiness, including

(a) the risk of identity theft, and

(b) fraudulent use of the consumer's identity;

"credit monitoring services contract" means a contract between a consumer and a reporting agency for the provision of credit monitoring services;

"credit monitoring services provider" means a reporting agency that offers credit monitoring services to consumers;

"security alert information" means the information described in section 112.001 (5) (a) to (c) [requests respecting security alert information]. , and

(c) by adding the following subsection:

(2) In this Part, a credit agreement includes a lease as defined in section 57 (1).

5 The following section is added:

Confirmation of identity if report contains security alert information

107.1 A person who receives a report that contains security alert information must do the following before entering into a credit agreement or a prescribed transaction with the individual to whom the report applies:

(a) if the individual is not present in person,

(i) make reasonable efforts to contact the individual using the contact information specified in the security alert information, and

(ii) make a record respecting the efforts undertaken to contact the individual;

(b) if the individual is present in person,

(i) verify the identity of the individual, and

(ii) make a record respecting the manner in which that verification was carried out.

6 The following sections are added to Part 6:

Requests respecting security alert information

112.001 (1) In this section, "security alert request" means a request made by an individual under subsection (2).

(2) An individual may, by giving notice to a reporting agency in writing or in a prescribed manner, request that any report prepared by the reporting agency include security alert information.

(3) A security alert request must include the prescribed contact information for the individual.

(4) A reporting agency that receives a security alert request must, if the request complies with subsection (3), verify the identity of the individual who made the request as soon as is practicable.

(5) If the identity of the individual is verified, and if the security alert request is not terminated by request of the individual under subsection (6) (b), the reporting agency that received the request must include the following information in any report respecting the individual:

(a) a statement that security alert information has been included in the report at the individual's request;

(b) a statement that section 107.1 [confirmation of identity if report contains security alert information] may apply to the person who receives the report, and a summary of that section;

(c) the contact information provided to the reporting agency under subsection (3) or (6) (a), as applicable.

(6) An individual who has made a security alert request may, by giving notice to the applicable reporting agency in writing or in a prescribed manner,

(a) ask the reporting agency to update the individual's contact information, or

(b) ask the reporting agency to terminate the security alert request.

(7) A reporting agency that receives a notice from an individual under subsection (6) must, before updating the individual's contact information or terminating the security alert request, as applicable, verify the identity of the individual as soon as is practicable.

(8) If, in respect of a security alert request, a reporting agency's obligations under subsection (5) end after a prescribed period of time, the reporting agency must do the following:

(a) no later than 30 days after the date on which the security alert request is made, notify the individual who made the security alert request, in writing or in a prescribed manner, of the date on which those obligations will end;

(b) no later than 30 days before the date on which the obligations will end, notify the individual who made the security alert request, in writing or in a prescribed manner,

(i) of the date on which those obligations will end, and

(ii) that a new security alert request may be made at any time.

(9) A reporting agency must, on a publicly accessible website maintained by or on behalf of the reporting agency, publish information describing the rights afforded to individuals under this section.

(10) A reporting agency must not charge a fee for anything done under this section.

Consumer may request freeze on disclosure of credit reports

112.002 (1) In this section, "credit freeze request" means a request made by an individual under subsection (2).

(2) An individual may, by giving notice to a reporting agency in writing or in a prescribed manner, request that the reporting agency refrain from giving a report respecting the individual to any person who requests one for the purpose of entering into a credit agreement.

(3) A reporting agency that receives a credit freeze request must verify the identity of the individual who made the credit freeze request as soon as is practicable.

(4) If the identity of the individual referred to in subsection (3) is verified, and if the applicable credit freeze request is not terminated or suspended by request of the individual under subsection (5), the reporting agency that received the credit freeze request

(a) must not provide a report to any person who requests a report respecting the individual for the purpose of entering into a credit agreement, and

(b) must inform that person of the reason that no report is to be provided.

(5) An individual who has made a credit freeze request may, by giving notice to the applicable reporting agency in writing or in a prescribed manner,

(a) ask the reporting agency to terminate the credit freeze request, or

(b) subject to the regulations, ask the reporting agency to temporarily suspend the credit freeze request for a specified period of time.

(6) A reporting agency that receives a notice from an individual under subsection (5) must, before terminating or suspending the credit freeze request, as applicable, verify the identity of the individual as soon as is practicable.

(7) If, in respect of a credit freeze request, a reporting agency's obligations under subsection (4) end after a prescribed period of time, the reporting agency must do the following:

(a) no later than 30 days after the date on which the credit freeze request is made, notify the individual who made the credit freeze request, in writing or in a prescribed manner, of the date on which those obligations will end;

(b) no later than 30 days before the date on which the obligations will end, notify the individual who made the credit freeze request, in writing or in a prescribed manner,

(i) of the date on which those obligations will end, and

(ii) that a new credit freeze request may be made at any time.

(8) A reporting agency must, on a publicly accessible website maintained by or on behalf of the reporting agency, publish information describing the rights afforded to individuals under this section.

(9) Section 9 (6) [withdrawal of consent] of the Personal Information Protection Act does not apply to an individual if

(a) a credit freeze request made by that individual is in effect, and

(b) the credit freeze request has not been suspended or terminated by the individual.

(10) A reporting agency must not charge a fee for anything done under this section.

Credit monitoring services – disclosure to consumer

112.003 A credit monitoring services provider must disclose the following information to a consumer before entering into a credit monitoring services contract with the consumer:

(a) that the consumer has the right under section 23 [access to personal information] of the Personal Information Protection Act to request disclosure of personal information about the consumer, including, in the case of a request made to a reporting agency, the consumer's credit score;

(b) that the consumer has the right to make a request described in paragraph (a) of this section at no cost to the consumer, unless the consumer makes such a request more frequently than once in 30 consecutive days;

(c) any prescribed information.

Credit monitoring services contract – contract cancellation and refund to consumer

112.004 (1) Without limiting any applicable right of cancellation under sections 18.4 (1) [contract cancellation], 23 (5) [future performance contract] and 49 (1) [cancellation of distance sales contract], a consumer who enters into a credit monitoring services contract may, if the credit monitoring services provider fails to comply with section 112.003, cancel the contract by giving notice of cancellation to the credit monitoring services provider not later than one year after the date that the contract was entered into.

(2) If a consumer cancels a contract under subsection (1), the credit monitoring services provider must refund to the consumer, without deduction, all money received in respect of the contract and in respect of any related consumer transaction, whether received from the consumer or any other person, not later than 15 days after the date that the notice of cancellation is given to the credit monitoring services provider.

(3) Sections 54 [how to give notice of cancellation], 55 [recovery of refund] and 56 [cancellation of preauthorized payments] apply to the cancellation of a credit monitoring services contract under this section.

7 The following Part is added:

Part 6.4 – Credit Repair Services

Definitions

112.34 In this Part:

"credit repair services" means services offered by a credit repair services provider that are intended to cause a reporting agency to correct an error or omission in a report respecting a consumer;

"credit repair services contract" means a contract between a consumer and a credit repair services provider for the provision of credit repair services;

"credit repair services provider" means a supplier of credit repair services;

"credit score" means a numerical or other score that a reporting agency attributes to an individual for the purpose of representing the reporting agency's assessment of the creditworthiness of the individual;

"report" has the same meaning as in section 106 (1) [definitions];

"reporting agency" has the same meaning as in section 106 (1).

No payment until specified outcome achieved

112.35 (1) In this section and in section 112.36, "specified outcome" means any of the following:

(a) the correction of an error or omission in a report respecting a consumer;

(b) an improvement in a consumer's credit score;

(c) a prescribed outcome.

(2) A credit repair services provider must not require or accept payment, or any security for a payment, from a consumer in respect of credit repair services unless and until the credit repair services provider achieves a specified outcome for the consumer through steps taken by the credit repair services provider.

Disclosure and review before credit repair services contract entered into

112.36 (1) A credit repair services provider must, before entering into a credit repair services contract with a consumer, disclose to and review with the consumer the following information:

(a) that the consumer has the right to cancel the contract for any reason by giving notice of cancellation to the credit repair services provider not later than 10 days after the date that the consumer receives a copy of the contract;

(b) that the consumer has the right under section 23 [access to personal information] of the Personal Information Protection Act to request disclosure of personal information about the consumer, including, in the case of a request made to a reporting agency, the consumer's credit score;

(c) that the consumer has the right to make a request described in paragraph (b) of this section at no cost to the consumer, unless the consumer makes such a request more frequently than once in 30 consecutive days;

(d) that the consumer has the right under section 24.1 [right to request correction of personal information – credit reporting agency] of the Personal Information Protection Act to request that errors or omissions in respect of personal information about the consumer be corrected;

(e) that a credit repair services provider may not require or accept payment, or any security for a payment, from a consumer in respect of credit repair services unless and until the credit repair services provider achieves a specified outcome for the consumer;

(f) that a credit repair services provider cannot compel a reporting agency to remove or amend information in a report;

(g) any prescribed information.

(2) A credit repair services provider must not enter into a credit repair services contract unless the consumer acknowledges each term in the contract by inserting the consumer's initial.

Cancellation rights and refund to consumer

112.37 (1) Without limiting any applicable right of cancellation under sections 18.4 (1) [contract cancellation], 23 (5) [future performance contract] and 49 (1) [cancellation of distance sales contract], a consumer who enters into a credit repair services contract may cancel the contract

(a) for any reason by giving notice of cancellation to the credit repair services provider not later than 10 days after the date that the consumer receives a copy of the contract, or

(b) by giving notice of cancellation to the credit repair services provider not later than one year after the date that the contract was entered into, if the credit repair services provider fails to comply with section 112.36 (1) or (2).

(2) If a consumer cancels a contract under subsection (1) (a) or (b), the credit repair services provider must refund to the consumer, without deduction, all money received in respect of the contract and in respect of any related consumer transaction, whether received from the consumer or any other person, not later than 15 days after the date that the notice of cancellation is given to the credit repair services provider.

(3) Sections 54 [how to give notice of cancellation], 55 [recovery of refund] and 56 [cancellation of preauthorized payments] apply to the cancellation of a credit repair services contract under this section.

8 Section 143 is amended

(a) by renumbering the section as section 143 (1), and

(b) by adding the following subsection:

(2) For the purposes of subsection (1), a person engages in a designated activity if the person holds themselves out as

(a) licensed to engage in the designated activity, or

(b) exempted from the requirement to be licenced to engage in the designated activity.

9 Section 146 (2) (d) is amended by striking out "a pattern of".

10 Sections 171 (1) (b) and 183 (2) (b) are amended by striking out "section 106" and substituting "section 106 (1)".

11 Section 189 (4) is amended by adding the following paragraphs:

(a.1) section 107.1 [confirmation of identity if report contains security alert information];

(f.01) section 112.001 (4), (5), (7), (8) (a) or (b), (9) or (10) [requests respecting security alert information];

(f.02) section 112.002 (3), (4), (6), (7) (a) or (b), (8) or (10) [consumer may request freeze on disclosure of credit reports];

(f.03) section 112.003 [credit monitoring services – disclosure to consumer];

(f.04) section 112.004 (2) [credit monitoring services contract – contract cancellation and refund to consumer];

(f.05) section 112.35 (2) [no payment until specified outcome achieved];

(f.06) section 112.36 (1) or (2) [disclosure and review before credit repair services contract entered into];

(f.07) section 112.37 (2) [cancellation rights and refund to consumer]; .

12 Section 189 (4) (u) is repealed and the following substituted:

(u) section 143 (1) [licence required].

13 Section 197 is amended

(a) in subsection (1) by striking out "section 106" and substituting "section 106 (1)", and

(b) in subsection (2) by adding the following paragraphs:

(c) prescribing transactions for the purposes of section 107.1 [confirmation of identity if report contains security alert information];

(d) respecting the manner in which notice must be provided under section 112.001 (2), (6) or (8) (a) or (b) or 112.002 (2), (5) or (7) (a) or (b) [consumer may request freeze on disclosure of credit reports];

(e) respecting contact information that must be provided under section 112.001 (3) [requests respecting security alert information];

(f) prescribing periods of time for the purposes of section 112.001 (8) or 112.002 (7);

(g) respecting the temporary suspension of credit freeze requests, including

(i) minimum and maximum periods of time applicable to temporary suspensions, and

(ii) the effect of temporary suspensions on any period of time prescribed under paragraph (f) of this subsection;

(h) respecting information that must be disclosed under section 112.003 (c) [credit monitoring services – disclosure to consumer].

14 The following section is added:

Credit repair services

197.3 The Lieutenant Governor in Council may make regulations as follows:

(a) prescribing outcomes for the purposes of section 112.35 (1) (c) [no payment until specified outcome achieved];

(b) respecting information that must be disclosed and reviewed under section 112.36 (1) (g) [disclosure and review before credit repair services contract entered into].

Consequential and Related Amendments

Motor Dealer Act

15 Section 8.1 of the Motor Dealer Act, R.S.B.C. 1996, c. 316, is amended

(a) in subsection (2) by striking out "Parts 4 and 5" and substituting "Parts 4 to 6",

(b) in subsections (3) (b), (4) (b) and (c) and (5) by striking out "Part 2, 4 or 5" and substituting "Part 2, 4, 5 or 6", and

(c) in subsection (4) (a) by striking out "Parts 2, 4 and 5" and substituting "Parts 2 and 4 to 6".

Personal Information Protection Act

16 Section 1 of the Personal Information Protection Act, S.B.C. 2003, c. 63, is amended

(a) in the definitions of "credit report" and "credit reporting agency" by striking out "section 106" and substituting "section 106 (1)", and

(b) by adding the following definition:

"credit score" has the same meaning as in section 112.34 of the Business Practices and Consumer Protection Act; .

17 Section 9 (6) is amended by adding ", unless, under section 112.002 (9) of the Business Practices and Consumer Protection Act, this section does not apply to that individual" after "15 (1) (g)".

18 Section 23 (2) is repealed and the following substituted:

(2) If an organization that is a credit reporting agency receives a request under subsection (1), the organization must also provide the individual with

(a) the names of the sources from which it received the personal information, unless it is reasonable to assume that the individual can ascertain those sources, and

(b) the individual's credit score, in substantially the same form as the credit score that would be provided to a person who requests a credit score respecting the individual.

19 Section 24 is amended by adding the following subsection:

(0.1) This section applies to an organization other than a credit reporting agency.

20 The following section is added:

Right to request correction of personal information – credit reporting agency

24.1 (1) An individual may request a credit reporting agency to correct an error or omission in the personal information that is

(a) about the individual, and

(b) under the control of the credit reporting agency.

(2) If an individual makes a request to a credit reporting agency under subsection (1), the credit reporting agency must, within the prescribed period of time, comply with subsection (3) or (4).

(3) If the credit reporting agency is satisfied on reasonable grounds that a request made under subsection (1) should be implemented, the credit reporting agency must

(a) correct the personal information, and

(b) as soon as reasonably possible after correcting the personal information, send the corrected personal information to each organization to which the personal information was disclosed by the credit reporting agency during the year before the date the correction was made.

(4) If the credit reporting agency is not satisfied on reasonable grounds that a request made under subsection (1) should be implemented, the credit reporting agency must annotate the personal information under its control with the correction that was requested but not made.

(5) When an organization is notified under subsection (3) (b) of a correction of personal information, the organization must correct the personal information under its control.

21 Section 26 is amended by striking out "sections 23 or 24" and substituting "section 23, 24 or 24.1".

22 Section 32 is amended

(a) in subsection (2) by striking out "An organization" and substituting "Subject to subsection (2.1), an organization", and

(b) by adding the following subsection:

(2.1) An organization that is a credit reporting agency must not charge a fee to an individual who makes a request under section 23 for access to the individual's personal information that is not employee personal information, unless fewer than 30 days have passed since the date of the individual's most recent request for access to that information.

23 Section 36 (2) (d) is amended by adding "or 24.1" after "section 24".

24 Section 37 is amended by striking out "section 23 or 24" and substituting "section 23, 24 or 24.1".

25 Section 56 is amended

(a) by adding the following subsection:

(1.1) Subject to subsection (2), an organization that is a credit reporting agency commits an offence if the organization contravenes section 23 (2) or 32 (2.1). , and

(b) in subsection (2) by adding "or (1.1)" after "subsection (1)".

26 Section 58 is amended

(a) in subsection (2) by adding the following paragraph:

(g.1) prescribing periods of time for the purposes of section 24.1 (2); , and

(b) by adding the following subsection:

(3.1) A regulation under subsection (2) (g.1) may specify different periods of time for different circumstances.

Commencement

27 The provisions of this Act referred to in column 1 of the following table come into force as set out in column 2 of the table:

Explanatory Notes

CLAUSE 1: [Business Practices and Consumer Protection Act, section 4]

• adds definitions;
• adds representations that constitute deceptive acts or practices if made by credit repair services providers.

CLAUSE 2: [Business Practices and Consumer Protection Act, section 18.3]

• adds a definition of "applicable contract";
• modifies the circumstances in which specified information must be disclosed by suppliers to consumers.

CLAUSE 3: [Business Practices and Consumer Protection Act, Part 6] amends the heading to Part 6 of the Act.

CLAUSE 4: [Business Practices and Consumer Protection Act, section 106] adds definitions for the purposes of Part 6.

CLAUSE 5: [Business Practices and Consumer Protection Act, section 107.1] specifies the steps that must be taken by persons who receive a report that contains security alert information.

CLAUSE 6: [Business Practices and Consumer Protection Act, sections 112.001 to 112.004] adds provisions respecting

• the right to cause reporting agencies to include security alert information in credit reports,
• the right to cause reporting agencies to refrain from giving credit reports to persons who request such reports, and
• disclosure requirements and cancellation rights that apply in respect of credit monitoring services contracts.

CLAUSE 7: [Business Practices and Consumer Protection Act, Part 6.4] adds provisions respecting credit repair services.

CLAUSE 8: [Business Practices and Consumer Protection Act, section 143] clarifies that holding oneself out to be licensed to engage in a designated activity or to be exempt from the requirement to be licensed for a designated activity constitutes engaging in that designated activity.

CLAUSE 9: [Business Practices and Consumer Protection Act, section 146] simplifies a provision.

CLAUSE 10: [Business Practices and Consumer Protection Act, sections 171 and 183] is consequential to amendments made by this Bill to the Act.

CLAUSE 11: [Business Practices and Consumer Protection Act, section 189] specifies provisions of the Act the contravention of which constitutes an offence.

CLAUSE 12: [Business Practices and Consumer Protection Act, section 189] is consequential to amendments made by this Bill to the Act.

CLAUSE 13: [Business Practices and Consumer Protection Act, section 197] specifies matters in respect of which the Lieutenant Governor in Council may make regulations.

CLAUSE 14: [Business Practices and Consumer Protection Act, section 197.3] specifies matters in respect of which the Lieutenant Governor in Council may make regulations.

CLAUSE 15: [Motor Dealer Act, section 8.1] is consequential to amendments made by this Bill to the Business Practices and Consumer Protection Act.

CLAUSE 16: [Personal Information Protection Act, section 1] adds a definition of "credit score".

CLAUSE 17: [Personal Information Protection Act, section 9] specifies a circumstance in which individuals who have given consent to a credit reporting agency to disclose information may withdraw that consent.

CLAUSE 18: [Personal Information Protection Act, section 23] specifies information that must be disclosed by a credit reporting agency to individuals who make a request for information about themselves.

CLAUSE 19: [Personal Information Protection Act, section 24] is consequential to amendments made by this Bill to the Act.

CLAUSE 20: [Personal Information Protection Act, section 24.1] adds provisions respecting

• the right of individuals to ask a credit reporting agency to correct personal information, and
• a credit reporting agency's obligations when it receives such a request.

CLAUSE 21: [Personal Information Protection Act, section 26] is consequential to amendments made by this Bill to the Act.

CLAUSE 22: [Personal Information Protection Act, section 32] prohibits credit reporting agencies from charging a fee to individuals who request access to information about themselves, subject to a specified limitation.

CLAUSE 23: [Personal Information Protection Act, section 36] is consequential to amendments made by this Bill to the Act.

CLAUSE 24: [Personal Information Protection Act, section 37] is consequential to amendments made by this Bill to the Act.

CLAUSE 25: [Personal Information Protection Act, section 56] specifies a provision of the Act the contravention of which constitutes an offence.

CLAUSE 26: [Personal Information Protection Act, section 58] specifies a matter in respect of which the Lieutenant Governor in Council may make regulations.