Ontario Regulation 168/25, made under the Consumer Reporting Act, introduces significant updates to the framework governing consumer reporting agencies in Ontario. It amends Regulation 177 of the Revised Regulations of Ontario, 1990, by setting new rules for disclosure, consumer scores, security freezes, and the publication of consumer-related information. The regulation is primarily directed at the two major credit reporting agencies in Canada, Equifax Canada Co. and TransUnion of Canada, Inc., which are specifically named throughout as the prescribed organizations required to comply with the changes.

One of the key amendments relates to consumer disclosure. The regulation prescribes Equifax and TransUnion as the designated agencies under the Act for disclosure purposes and establishes a maximum fee of $5 that they can charge consumers for disclosure requests. This limit applies to requests made under the relevant subsections of the Act, ensuring that consumers will not face excessive costs when accessing their credit information. By capping fees, the regulation prioritizes affordability and accessibility for consumers seeking to review their personal credit histories.

The regulation also adds clarity and transparency with respect to consumer scores, which are widely used in financial decision-making. It mandates that consumer reporting agencies provide detailed explanations regarding the nature and role of consumer scores. This includes an explanation of what a consumer score is, the key factors used in generating it, the consumer behaviors and actions that can influence it, and the reasons why individuals may hold multiple consumer scores. Furthermore, the agencies must explain why scores may differ between organizations and describe which pieces of information in a consumer’s file do not affect the score. Another required element is a clear outline of when consumers can obtain their scores for free and when a fee applies. Importantly, all of this prescribed information must be published prominently on the agencies’ websites to ensure public accessibility.

A major development in this regulation is the inclusion of detailed rules surrounding security freezes. These freezes allow consumers to restrict access to their credit files, which is an important protection against identity theft and fraud. Both Equifax and TransUnion are prescribed as responsible agencies under this section. The regulation specifies deadlines for agencies to process requests for security freezes, depending on how consumers make their requests. If requested electronically, the freeze must be in place within two business days; if by telephone or other telecommunication methods, within five business days; and if by mail, within 15 business days.

The regulation also enhances consumer awareness by requiring agencies to publish information regarding both alerts and freezes. This includes the length of time alerts remain on a consumer’s file, how they may be amended, how long security freezes last, and which purposes consumer information will not be disclosed for when a freeze is in place. Agencies must also state the purposes for which information will still be disclosed despite a freeze.

Ontario (168/2025) August 13, 2025
Disclaimer: Insights are for informational purposes only and do not reflect RRI’s official position or constitute legal opinion.