PIPEDA Case Summary #2009-015

Individual’s creditor leaves legal debt-recovery document at his workplace

[Principles 4.3, subsection 5.3, paragraphs 7(3)(b) and 7(3)(h.1)]

An individual owed a credit card debt and the creditor (a federal work) was attempting to serve him with a statement of claim (SOC) to recover the amount. The document clearly indicated who was being sued, by whom and for how much. After unsuccessful attempts to serve him at his residence, the creditor left the open document at the reception desk of a consulting company where a tracing service indicated he was working. When the individual complained that his personal information had thus been disclosed to the individuals in that office without his consent, the creditor claimed that consent was not required since the Act provides exceptions for debt collection purposes and for publicly available information. The Assistant Commissioner determined that the particular circumstances of the disclosure were not in keeping with the conditions necessary for the two exceptions to be applied. Thus, the complainant’s consent should have been obtained before the disclosure.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant worked in Calgary in information technology as a sub-contractor by a firm under contract to a consulting firm.  (As such, he could not be considered an employee of the consulting firm.) At about the same time, the respondent, who was his creditor, instructed its legal recoveries agency to collect a past-due credit card debt incurred by the complainant. It gave the agency instructions to sue and a statement of claim (SOC) document was issued. 

An “employment locate” from a third-party tracing service indicated, inaccurately, that the complainant’s “employer” was at the consulting firm office. The respondent claimed that six months before, its legal recoveries agency had sent a demand letter to the complainant’s permanent residence in Calgary and received no response.

A process server first attempted to deliver the SOC to the complainant’s residence, but was told that he was working in Winnipeg until the summer. After leaving notes and messages to reach the complainant, the process server eventually left a copy of the SOC at the reception desk of the consulting firm. The document was open to view, thereby allowing the firm’s staff to see that the complainant was being sued by the respondent, as well as all the financial details. 

When he found out about the SOC delivery, the complainant advised the respondent and its legal recoveries agency that he was not an employee of the consulting firm and complained about the delivery of the open SOC to that firm. 

The complainant’s position was that, as a consultant, he is hired based on his reputation. Consequently, he was concerned that this incident had tarnished his reputation, given the small size of Calgary’s information technology community.

For its part, the respondent asserted that in Alberta, an SOC is a document open to public scrutiny and that notice of an SOC can be brought to the attention of a debtor by that province’s courts through various means, including publication in a newspaper. It believed that the copy SOC left with the complainant’s employer’s office was arguably a less intrusive method of disclosure of the complainant’s personal information than would have been its publication in a newspaper. Thus, the respondent did not believe it had violated the Act.

In actual fact, this Office established that, according to the Alberta Rules of Court, an SOC must be served on an individual personally, unless a court grants an order for substitutional service. There was no such order granted for the substitutional serving of the SOC in this case.

As for the respondent’s claim that court records are open to public scrutiny, a court retains discretion over the issue of access to its records and has a supervisory and protective role over its own records. Access can be denied if it is sought for an improper purpose or otherwise prohibited by statute. As such, the “open courts” principle can allow a member of the public to access court documents, but it does not give a plaintiff the unfettered right to distribute the contents of a court file or pleadings to third parties outside the litigation.

Findings

Issued March 16, 2009

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Subsection 5(3) states that organizations are allowed to disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. This preliminary requirement applies regardless of whether the individual has consented to the disclosure, as required by Principle 4.3, or whether an exemption under subsection 7(3) applies. Paragraph 7(3)(b) states that an organization may disclose personal information, without the knowledge or consent of the individual, only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization. Paragraph 7(3)(h.1) states that an organization may disclose personal information, without the knowledge or consent of the individual, only if the disclosure is of information that is publicly available and is specified by the regulations.

In making her determinations, the Assistant Commissioner deliberated as follows:

• Our investigation established that, after identifying what in all likelihood it thought to be the complainant’s employer, the respondent arranged for an unsealed copy of the SOC containing the complainant’s sensitive personal information to be left at this establishment (i.e. in the consulting firm’s reception area). In this case, a legitimate debt owed by the complainant to the respondent needed to be collected.
• However, as noted in earlier findings made by this Office, the exception to consent for disclosure provided under 7(3)(b) does not give carte blanche to an organization to disclose however much information it wishes in pursuit of a debt. 
• Such a disclosure could be deemed appropriate where a court had ruled on an individual’s wage assignment and the individual’s employer was contacted by a collection agency in respect of the resulting payments (to be made to either the collection agency itself or a creditor who is a client of the collection agency). In such circumstances where wages are to be garnisheed, legal documentation would need to be sent to the relevant contact at the employer (e.g. a human resources advisor). Under these circumstances, the exception provisions of paragraph 7(3)(b) to subsection 5(3) would be applicable.
• These were not the circumstances of the current complaint. For example, our investigation was able to establish that the complainant in the current case had a client/consultant relationship with the consulting firm, not an employee-employer type relationship. Moreover, notwithstanding the type of relationship between the two parties, the respondent was not permitted under the Alberta Rules of Court to have left the SOC at the consulting firm’s premises since the document was to be served personally to the complainant.
• Even if the consulting firm had been the complainant’s employer and the respondent had (a) obtained a court order seeking to garnish wages, or (b) obtained a court order granting service of an SOC against the complainant at the employer’s premises, this Office would have expected the legal documentation to be served in a sealed envelope and addressed to the appropriate individual, a human resources advisor and the complainant respectively.
• Thus, the Assistant Commissioner determined that the Act’s debt-collection-exception provision of paragraph 7(3)(b) did not apply.
• However, an organization may disclose information regarding an individual where the information is publicly available, pursuant to paragraph 7(3)(h.1). Such disclosures must be considered in the context of the regulations specified and made under the Act.  The Regulations Specifying Publicly Available Information, SOR/2001-7 (the “Regulations”), set out what is considered “publicly available” for the purposes of this exemption. The relevant provisions of subsection 1(d) of the Regulations read as follows:
  1. The following information and classes of information are specified for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Personal Information Protection and Electronic Documents Act:

     d) personal information that appears in a record or document of a judicial or quasi-judicial body, that is readily available to the public, where the collection, use and disclosure of the personal information relate directly to the purpose for which the information appears in the record or document;

  Accordingly, where the disclosure of an individual’s personal information relates directly to the purpose of advancing a claim in a court of law, that individual’s consent will not be required.

• In this case, the Assistant Commissioner determined that the action of disclosing the complainant’s personal information to a stranger in the litigation process (i.e. individuals at the consulting firm’s office) was not directly related to the core purpose of recovering the debt through the pursuit of legal action against the complainant.
• Since this condition from the Regulations was not met, the respondent could not validly claim an exemption to consent under paragraph 7(3)(h.1).
• In the Assistant Commissioner’s view, Principle 4.3 was contravened since the two relevant provisions to exempting consent that were claimed by the respondent were not applicable in this case.
• Finally, the Assistant Commissioner considered the disclosure under subsection 5(3) of the Act. She determined that, despite the fact that the complainant was a debtor of the respondent and had been named as the defendant in a legal suit for debt recovery, disclosing his personal information contained in an SOC to an individual or organization that is a stranger to the legal proceedings—without a legal obligation to do so—is not a disclosure that a reasonable person would deem appropriate in the circumstances.
• The Assistant Commissioner made the recommendation to the respondent that it review its procedures on the appropriate delivery and confidentiality of SOCs served in debt-recovery proceedings. The respondent thus amended its procedures by 1) using envelopes in all cases of service when an SOC is not being handed directly to the party in question, and 2) only serving SOCs to addresses allowed on the claim document itself. It also confirmed that it had provided privacy legislation training to its staff.
• The Assistant Commissioner was satisfied with these actions to reduce the likelihood of any recurrences.

Conclusion

The Assistant Commissioner concluded that the complaint was well-founded and resolved.

See also

PIPEDA Case Summary #2005-317: Fax from debt collector contained debtor’s personal information