Bank accused of collecting and disclosing personal information without consent
PIPEDA Case Summary #2003-208
[Principle 4.3]
Complaint
An individual complained that: (1) a bank collected his personal information, namely, his credit report, without his consent; and (2) disclosed this information to his former wife.
Summary of Investigation
The complainant obtained a copy of his credit report and noticed that a bank, with which he had never had any dealings, had made an inquiry about him in October 2000. Based on a conversation he had had with his ex-wife, he believed that her friend, who is an employee of the bank, conducted this inquiry on her behalf and divulged the information contained in it to her. He complained to the bank, which conducted an investigation into the matter.
The bank did not dispute that one of its employees had conducted a credit check on the complainant without his consent. In October 2000, the former wife filled out an application form for credit and, as she was still living with the complainant at the time, included his name on the form. She did not, however, obtain his signature. When the bank received the application, it conducted a credit bureau search on both of their names despite the fact that the complainant had not signed the form. The bank sent the complainant a letter of apology and indicated that the employee had been reprimanded.
The bank, however, denied using his information for any purpose and disclosing it to his former wife or any other third party. The ex-wife also confirmed that she did not receive any credit information about the complainant from the bank. The original credit application form and the corresponding credit reports were both destroyed after the application was processed. The ex-wife had the only copy of the application form.
Commissioner's Findings
Issued September, 2003
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.
Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
The Commissioner could not make a finding on the collection complaint as it had occurred prior to the Act coming into force. He noted, however, that had it occurred post-Act, it would be considered a contravention of Principle 4.3. He was nevertheless pleased that both the employee and the bank recognized that its action was inappropriate and that the complainant had received an apology.
Regarding the disclosure complaint, the Commissioner determined that there was insufficient evidence to conclude that the bank employee had disclosed the complainant's personal information to his former wife. Given this, he found that there was no contravention of Principle 4.3.
The Commissioner concluded that the disclosure complaint was not well-founded.
- Date modified: