Bank accused of improperly disclosing unlisted phone number to another financial institution

PIPEDA Case Summary #2003-230

[Section 2; Principle 4.3, Schedule 1]

Complaint

A customer complained that her bank had disclosed her unlisted telephone number to another financial institution without her consent.

Summary of Investigation

The complainant and her husband, joint owners of a commercial enterprise, were longtime customers of a bank. When the complainant opened their business account, she provided the bank with a primary and a secondary contact telephone number for its records. The secondary number she provided was her personal home telephone number, which was unlisted. The individual did not indicate to the bank that the number was unlisted, nor did she give the bank any instructions on how and when it could use the telephone number.

Using her bank business client card, the individual made a purchase at another financial institution. She did not have an account at the institution and her name did not appear on her client card. The next day, she received two voice mail messages from a representative of the other financial institution, one message at her primary number and the second at her secondary (unlisted) number. She returned the calls and was advised that she had been under-charged for her purchase. When she inquired how the representative had obtained her phone numbers, she was told that her bank had provided them after the representative had traced the transaction through the bank machine.

The bank had no reference in its files to indicate that any of the phone numbers associated with the individual's personal or business accounts was unlisted. Its documents showed that the (unlisted) number in question pertained to her business account and did not appear on her personal account profile. The documents also indicated that the complainant's name did not appear on her business account profile.

The bank questioned the applicability of the Act in this case, since the information at issue pertained to a business account. It also maintained that, in any case, through a signed business account agreement, the complainant had given the bank consent to release the telephone number in question, since it was listed as a contact number on her business account file.

Commissioner's Findings

Issued September 16, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Section 2 defines personal information as follows:

"[P]ersonal information" means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

Prior to any consideration of the complainant's allegation of improper disclosure, the Commissioner was required to determine whether the unlisted telephone number in this instance was personal information for purposes of the Act. He deliberated as follows:

• By the first part of the above definition, it is clear that, under normal circumstances, an unlisted home telephone number is information about an identifiable individual and would be deemed personal information for purposes of the Act.
• However, in this particular case, the second part of the definition, relating to business information, is relevant. That clause is intended to exclude from the purview of the Act basic business information such as might appear on a business card.
• Even though the complainant's number was personal and unlisted, she herself chose to give it to the bank in the context of business information.
• The complainant represented the number as a secondary contact number on her business account, with no stated restrictions or qualifications, and it was only reasonable for the bank to assume that she would not object to its use pursuant to a business transaction that she had initiated.
• Had she not wished to have it considered a business number, it was incumbent on the complainant to have informed the bank that the number was both personal and unlisted, or, indeed, not to have provided it at all.
• In these particular circumstances, the bank had no way of knowing that the telephone number it provided to the other financial institution was not basic business information about the complainant's company.
• Given this, there was no basis for a determination that the complainant's personal information was improperly disclosed contrary to the Act.

The Commissioner concluded that the complaint was not well-founded.