Customer withdraws consent but continues to receive promotional materials

PIPEDA Case Summary #2003-248

[Principles 4.3.8 and 4.5]

Complaint

A credit card customer had previously written to her bank, on two occasions, to opt out of receiving promotional materials from the bank — requests which the bank acknowledged in writing both times. However, after she received a solicitation for a credit card with the same bank some seven months after her initial request, she complained to the Office.

Summary of Investigation

According to the bank, the error occurred because it had two files on the complainant in its computer system. One was under the complainant's first and last names, and the other was under her first name, her middle initial and her last name. The bank modified both files to reflect her wishes and is in the process of upgrading its computer system so that it would recognize all combinations of a name at a particular address.

Findings

Issued December 12, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3.8 provides that an individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Principle 4.5 establishes that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

The Assistant Commissioner deliberated as follows:

• The complainant initially provided the bank with her personal information for the purpose of obtaining a credit card.
• Subsequently, she withdrew her consent to the use of her personal information for marketing purposes. She clearly provided the bank with reasonable notice, and it formally acknowledged her wishes.
• Nonetheless, she received a solicitation from the bank, some seven months after she first withdrew her consent.
• While the error appeared to be systems-based, and the bank was in the process of improving its software to eliminate such errors, the fact remained that her request was not properly honoured, in contravention of Principle 4.3.8.
• Therefore, the Assistant Commissioner determined that the bank was using her personal information without her consent for purposes other than those for which it was collected. She thus found the bank in contravention of Principle 4.5.

The Assistant Commissioner concluded that the complaint was well-founded.