Bank accused of non-consensual recording and disclosure of telephone conversation

PIPEDA Case Summary #2002-51

[Principles 4.3, 4.3.2 and 4.9, Schedule 1; and sections 5(3), 8(3) and 8(5)]

Complaint

A customer complained that his bank

1. had not obtained his consent for tape-recording a telephone conversation with him and subsequently disclosing the recording in court proceedings; and
2. had not given him access to all the personal information he had requested.

Summary of Investigation

The complainant had launched an action against the bank in small claims court, over liability for certain withdrawals made on his banking card. He filed his first complaint after the bank introduced into evidence a tape-recording of a telephone conversation between him and the bank's director of customer services. Against the complainant's allegation that the recording and the disclosure had been non-consensual, the bank took the position that it had obtained due consent on the basis of a signed form and related documents issued to the complainant.

The form in question stated the cardholder's consent to be bound by an agreement, which the complainant had received on opening his account. This agreement included acknowledgements of the bank's practice of tape-recording telephone calls and of the admissibility of bank records in legal proceedings. The complainant had also received a privacy brochure, outlining the bank's practices and purposes regarding personal information. This brochure specified that protection of the bank's interests and detection and prevention of fraud were among the purposes for collection, use, or disclosure. The complainant had not read any of the documents issued to him, but insisted that the bank should have somehow signaled to him the importance of the information in them.

Another tape-recording revealed that, a few days before the complainant's telephone conversation with the customer service director, another bank representative had mentioned to him the bank's practice of recording conversations. The complainant contended that he had not taken the term "recording" to mean electronic recording, suggesting that it could just as easily apply to note-taking.

In preparation for a second court hearing, the complainant made a formal request for access to all his personal information holdings with the bank. The bank responded with copies of three cassette tapes and several notes to file. The complainant filed his second complaint after he became aware, during the second hearing, of the existence of another tape-recording that the bank had not included in its response. On realizing its oversight, the bank retrieved a copy of the missing tape from its customer services centre and sent it to the complainant with an apology.

Commissioner's Findings

Issued May 16, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.3, Schedule 1, states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2 states that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Principle 4.9 states that, upon request, an individual must be informed of the existence, use, and disclosure of his or her personal information and be given access to that information. Section 8(3) states that an organization must respond to a request no later than 30 days after receipt. Section 8(5) states that an organization having failed to respond within the time limit is deemed to have refused the request.

In the matter of the first complaint, the Commissioner determined as follows:

• On opening his bank account, the complainant had signed a form whereby he had consented to be bound by the terms of a certain agreement, a copy of which he had received.
• This agreement clearly detailed the bank's practices in respect of tape-recording telephone banking transactions.
• The complainant had also received a privacy brochure identifying the bank's purposes for the collection, use, and disclosure of personal information.
• Prior to the complainant's telephone conversation with the director, another bank representative had personally informed him of the bank's practice of recording telephone conversations in terms that a reasonable person would normally have taken to mean electronic recording.

The Commissioner was satisfied that the bank had made reasonable efforts to inform the complainant of its practice of tape-recording telephone conversations and of the purpose for the practice. He was also satisfied that, by virtue of the agreement the complainant had signed, the bank had obtained his express consent for tape-recording telephone conversations with him and for disclosing such recordings in proceedings involving the bank's interests. The Commissioner found therefore that the bank was in compliance with Principles 4.3, 4.3.2, and section 5(3).

He concluded that the first complaint was not well-founded.

In the matter of the second complaint, the Commissioner noted that the bank did not dispute its initial omission of a tape-recorded conversation from its response to the complainant's access request. He determined that the bank had eventually given access to the tape in question 65 days beyond the prescribed time limit. He found therefore that the bank had not complied with section 8(3) and was thus deemed under section 8(5) to have refused the request in contravention of Principle 4.9.

Nevertheless, he was satisfied that the bank's initial omission of the tape-recording had been inadvertent and that the complainant did eventually receive from the bank all the information he had requested.

The Commissioner concluded that the second complaint was well-founded and resolved.

Further Considerations

The Commissioner was pleased to note that the first complaint had been instrumental in improving the bank's practices regarding collection of personal information by telephone. He noted in particular the bank's recent introduction of a recorded message to inform all callers that their conversations would be tape-recorded.