Bank accused of improper disclosure of customer's information to collection agency

PIPEDA Case Summary #2002-34

[Section 7(3)(b)]

Complaint

An individual complained that:

(1) a bank had improperly disclosed his personal information to a private collection agency; and

(2) disclosures of information between the bank and a credit card function were improper because the two were separate corporate entities.

Summary of Investigation

The complainant had both a chequing account and a credit card account with the bank in question. After applying for the credit card, he had received a cardholder agreement, in which it was stipulated that, on termination of the agreement, the bank could debit any account he held with the bank and apply the funds against his remaining indebtedness and interest owed on his credit card. The complainant ran up a considerable debt on the card, against which he failed to make payments that the bank deemed sufficient. Eventually in July 2000, the bank turned the complainant's debt file over to the private collection agency in question. This file included the complainant's account number, social insurance number, status of account, balance of debt owing, name, address, home and business phone numbers, and employment information.

After attempting unsuccessfully over several months to collect payment for the credit card debt, the collection agency became aware that the complainant had monies in his chequing account with the bank in question. In April 2001, in accordance with the cardholder agreement, an amount was removed from the complainant's chequing account and credited to his credit card account as partial payment.

The credit card function is in fact simply the marketing brand for the bank's card product division and as such is included in the bank's corporate entity.

Commissioner's Findings

Issued January 10, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to federal works, undertakings, or businesses. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses, as defined in the Act.

Application: Section 7(3)(b) of the Act stipulates that an organization may disclose personal information without the individual's knowledge and consent for the purpose of collecting a debt owed by the individual to the organization.

On the first count of the complaint, the Commissioner determined that the disclosure in question had occurred before the Act had applied to the bank. He found therefore that the bank had not contravened the Act. For the complainant's information, the Commissioner noted that, even had the Act applied, he would not have found the bank to have been in contravention. He pointed out that under section 7(3)(b) the disclosure in question would have been acceptable.

On the second count of the complaint, the Commissioner was satisfied that the bank and the credit card function were a single corporate entity. He found that there was no question of improper disclosure between them in this case. On the contrary, the information transfer involved in debiting the complainant's chequing account and crediting his credit card account was a consistent use to which the complainant had consented through the cardholder agreement.

The Commissioner concluded that the complaint was not well-founded.