Man objects on principle to bank's identification program

PIPEDA Case Summary #2001-27

[Principle 4.1, 4.2, 4.3, 4.4, and 4.7, Schedule 1; and section 5(3)]

Complaint

An individual complained that a bank was contravening several provisions of PIPEDA by requiring established customers to produce two pieces of identification before making withdrawals from their accounts at a certain branch.

Summary of Investigation

Certain branches of the bank in question had been experiencing a rash of personation fraud. In consultation with the RCMP, the bank had implemented a fraud prevention program, whereby customers intending to transact business in person at these branches were instructed to have two pieces of valid identification ready. At the branch cited in the complaint, a notice to this effect was posted at each teller's wicket.

Although the complainant himself was not an established customer at the branch, he objected on principle to the practice as posted. He made it clear, however, that his complaint referred to established customers, not to off-the-street visitors to the branch. He contended that the practice of demanding two pieces of identification was an arbitrary and unnecessary invasion of established customers' privacy, especially given that these customers would already have produced identification at the time of opening their accounts. His central objection was that, if an established customer failed for any reason to comply with a teller's demand for identification, the teller could then refuse to allow the customer to withdraw cash from his or her own account. The complainant also expressed concerns about the security of personal information handled by the banks' junior officers.

The bank's position was that it has the legal right to authenticate to its own satisfaction the individuals with whom it transacts business, especially in situations where extra precautions are warranted. The bank pointed out that, in carrying out the identification program, its staff are governed by clearly defined standard procedures whereby it is highly unlikely that any established customers would ever be denied withdrawal rights. A teller asks for identification only in cases where the customer is unknown to branch staff. In cases where an unknown individual does not have two pieces of identification, staff are trained to pursue alternative methods of identification. The bank maintained that many customers had expressed appreciation and support for the identification program.

Commissioner's Findings

Issued December 4, 2001

Jurisdiction: As of January 1, 2001, PIPEDA applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because banks are federal works, undertaking, or businesses as defined in the Act.

Application: The complainant himself cited five provisions of the Act: Principles 4.1 (Accountability), 4.2.1 and 4.2.2 (Identifying Purposes), 4.3.3 (Consent), and 4.7 (Safeguards) of Schedule 1. The Commissioner also consider the complaint under Principle 4.4 (Limiting Collection) of Schedule 1 and section 5(3) (appropriate purposes).

Regarding Principles 4.2.1 and 4.2.2 , the Commissioner was satisfied that, at the time the fraud prevention program was implemented, the bank had adequately identified and documented the purpose of the information collection and that the purpose was clearly indicated at each teller's wicket. He found no further need for documentation at each particular instance of collection. He also pointed out that the Act does not limit the bank to identifying an individual only at the time an account is opened or to using only information in its own records for secondary identification purposes.

Regarding Principle 4.3.3, the Commissioner accepted the bank's assurance that no established customer lacking identifying documents was likely to be refused withdrawal. He was satisfied that the production of documents in this case did not constitute a condition for withdrawal in respect of established customers. He was also satisfied that the purpose for collection was explicitly specified and legitimate.

Regarding Principle 4.1, the Commissioner observed that the principle's purpose is not to limit accountability to a small number, but rather to make an organization responsible and accountable as a whole. The principle further acknowledges (4.1.1) that individuals other than those designated as accountable for an organization's compliance may be responsible for the day-to-day collection and processing of personal information.

Regarding Principle 4.7, the Commissioner determined that any safeguard implemented by a bank to protect the personal information of customers applies not only to senior officers, but also to junior officers, who are no less obliged to respect the Act's provisions. He also considered it unreasonable to expect that every person unknown to tellers be directed to senior officers for identification.

Regarding Principle 4.4.1 and section 5(3), the Commissioner determined that asking unfamiliar customers to show identification before completing a financial transaction could in no way be considered an indiscriminate collection. He observed that that the bank had appropriate procedures and guidelines regarding acceptable forms of identification, and he accepted the bank's representation that customers supported the identification program. He was satisfied that a reasonable person, particularly one whose assets were in the bank's custody, would consider the collection at issue to be appropriate.

The Commissioner thus found the bank to be in compliance with all relevant provisions of the Act.

He concluded therefore that the complaint was not well-founded.