Couple alleges bank withheld loan information

PIPEDA Case Summary #2001-26

[Sections 8(3) and 8(5)]

Two Complaints

A husband and wife complained in two separate complaints that a bank had denied them access to their personal information in that it had not responded to their request for information related to a loan application.

Summary of Investigation

The complainants had written, jointly signed, and submitted two letters requesting personal information about two different credit products from their local branch of the bank in question. The letters were identical, except for their subject lines, one of which referred to a numbered loan application and the other to a numbered mortgage, both relating to the complainants. Within the month, the bank sent them the information they had requested about their mortgage, but no information about their loan application. The complainants wrote the bank another letter, outlining in greater detail the information they were seeking about the loan application. Approximately one month after this second submission, a lawyer for the bank responded, informing the complainants only that they would be required to pay photocopying charges of 25 cents per page. The complainants then submitted another letter in which they enclosed a cheque to cover reproduction costs and confirmed that they still wanted the information in question. When they received no further response after three weeks, they filed their complaints with the Office of the Privacy Commissioner.

The bank at first denied the allegation, insisting that the complainants' second submission had been the first to make reference to the loan application. However, on being presented with a copy of the letter containing the prior reference, the bank checked its records and acknowledged receipt of that earlier letter. The bank explained that its failure to respond had been unintentional, in that the employee who had received the first submission had not noticed the different subject headings on the two similar-looking letters, had assumed they were identical, and had therefore forwarded only one of them (the one referring to the mortgage) on for response.

Commissioner's Findings

Issued November 26, 2001

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to federal works, undertakings, or businesses. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses, as defined in the Act.

Application: Section 8(3) of the Act states that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

The Commissioner found that the bank had failed to respond within the time limit and was thus in contravention of section 8. However, he was satisfied that this failure had been unintentional, and he noted that the bank had subsequently provided to the complainants all the information they had sought.

He concluded therefore that the complaints were well-founded and resolved.