Customer calls toll-free number to withdraw consent but is unable to reach the call centre

PIPEDA Case Summary #2003-249

[Principles 4.3.8 and 4.5 of Schedule 1]

Complaint

A customer of a bank received a notice informing her that it was amending the language of its consent clause in its credit card account agreement. Not wanting her personal information shared, she called the toll-free number several times but was unable to get through. When her call was finally connected, she was still not able to talk to a representative. Instead, she received another recorded message suggesting that she write to the bank if she did not want her information shared.

Summary of Investigation

The bank maintained an electronic call log and provided the Office with a record showing that the complainant had called the bank on at least two occasions. It confirmed that she likely received a message that the bank was experiencing delays due to a high volume of calls, and a follow-up message indicating that the caller could put his or her request in writing. The bank stated that her call would have been answered in sequence, had she chosen to stay on the line.

The bank had projected a modest increase in the volume of calls that it would receive in response to the amendment notification and had put staff in place accordingly. However, the call volume increased by 83% more than forecast, and the bank had to supplement its call centre staff with other bank employees.

Findings

Issued December 12, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3.8 provides that an individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Principle 4.5 establishes that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

The Assistant Commissioner deliberated as follows:

  • The complainant initially provided the bank with her personal information for the purpose of obtaining a credit card.
  • She then attempted, unsuccessfully, to withdraw her consent to the use of her personal information for marketing purposes on at least two occasions, by calling the toll-free number provided by the bank.
  • Although the bank had informed its customers of their right to withdraw consent, it was not prepared to deal with the high volume of calls it received.
  • As a consequence, the complainant's desire to opt out was not properly honoured, in contravention of Principle 4.3.8, and therefore the bank was using her personal information without her consent for purposes other than those for which it was collected, contrary to Principle 4.5.

The Assistant Commissioner thus concluded that the complaint was well-founded.

Date modified: