Individual accuses bank of wrongfully disclosing financial records to government agency
PIPEDA Case Summary #2003-173
[Section 7(3)(c.1)(ii); Principle 4.3]
Complaint
An individual complained that her bank disclosed her personal information, specifically records about the accounts she held jointly with her spouse, to the Canada Customs and Revenue Agency (CCRA) without her consent.
Summary of Investigation
The CCRA was investigating the complainant's spouse for income tax evasion. Citing its authority under section 231 of the Income Tax Act, the CCRA requested that the bank provide several years' worth of information about the spouse's bank accounts. Two of the accounts were in the name of both the complainant and her spouse.
Under section 238 of the Income Tax Act, the bank was obligated to comply with the CCRA's request for information, or face a fine. Accordingly, the bank disclosed the requested information to the CCRA. The complainant found out that her personal information had been disclosed without her knowledge or consent when the CCRA presented the information in Court as evidence against her spouse.
Commissioner's Findings
Issued April 28, 2003
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.
Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection and use of personal information, except where inappropriate. An exception to this is listed in section 7(3)(c.1)(ii) which states that an organization may disclose personal information without the knowledge or consent of the individual if the disclosure is made to a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of enforcing a law of Canada.
The Commissioner was satisfied that the CCRA had lawful authority to collect the information from the bank, and determined that the bank's disclosure was consistent with the exception to the requirement for consent.
The Commissioner therefore concluded that the complaint was not well-founded.
- Date modified: