Bank accused of using personal information for purposes other than those for which it was initially collected

PIPEDA Case Summary #2003-218

[Section 5(3) and section 7(3)(a)]

Complaint

And individual who was employed by a bank complained that the institution had used her personal information for purposes other than those for which it had initially been collected. When the individual filed a complaint with an administrative tribunal, the individual's former supervisor allegedly accessed her client file without her consent. In addition, the individual complained that her supervisor had disclosed the information obtained from her file to the bank's lawyers, who used it to defend the bank before the tribunal.

Summary of Investigation

The investigation uncovered that after the individual resigned, she approached the bank's ombudsman in an effort to obtain payment of commissions that she said were owing to her. The bank then checked into the mortgage loans that had been negotiated to ascertain the reasons why certain commissions had not been received and, if necessary, to determine whether any money was owing. The investigation found that the individual's client file had in fact been accessed, and that in doing the check the bank had found that overpayment of commissions had been claimed and received, in particular a commission for negotiating the refinancing of her own personal mortgage loan. Negotiations with the ombudsman went ahead, but the parties were unable to reach any satisfactory agreement. Moreover, when the individual filed a complaint with an administrative tribunal, information concerning her file was provided to the lawyer acting as the bank's representative in the case.

Commissioner's Findings

Issued September 5, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to federal works, undertakings, or businesses. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses as defined in the Act.

Application: Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.. Section 7(3)(a) of the Act provides that an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is made to, in the Province of Quebec, an advocate or notary who is representing the organization.

After investigating, the Commissioner found it to be reasonable for the bank to use client mortgage loan files to determine whether commissions are owing, in accordance with section 5(3) of the Act. Moreover, the bank was entitled to disclose the information collected to the bank's lawyer, under section 7(3)(a) of the Act, in view of the fact that the lawyer was acting as the bank's representative before the administrative tribunal.

The Commissioner concluded that the complaint was not well-founded.