Commissioner considers jurisdiction over third-party disclosure by bank subsidiary

PIPEDA Case Summary #2001-3

[Section 30]

Complaint

A customer complained that an investment company, a subsidiary of a chartered bank, had improperly disclosed to a third party, namely a regulatory body that oversees the company's activities, his personal information related to financial transactions.

Summary of Investigation

The investigation in this case was limited to the Commissioner's determination of whether or not he had jurisdiction in the matter.

Commissioner's Findings

Issued July 19, 2001

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies strictly to federal works, undertakings, or businesses and to transborder disclosures of personal information for consideration. Banks are federal works, undertakings, or businesses as defined in the Act. In this case, however, the investment company, though a subsidiary of a bank, operates as a separate and distinct legal entity, does not disclose information across borders for consideration, and is provincially regulated. The company in question is not currently subject to the Act.

The Commissioner concluded that he lacked jurisdiction.