Bank accused of providing police with surveillance photos of the wrong person

PIPEDA Case Summary #2002-53

[Principles 4.6 and 4.6.1, Schedule 1]

Complaint

A woman complained that a bank had disclosed inaccurate personal information about her. Specifically, she alleged that the bank had released to police two photographs of her made from a surveillance videotape, with the result that the photographs were later featured in a newspaper article mistakenly identifying her as a crime suspect.

Summary of Investigation

While paying a bill at a bank where she did not have an account, the complainant was captured on videotape by a surveillance camera. On the same day, at the same teller's station of the bank, two allegedly stolen cheques were cashed. To assist municipal police in the ensuing investigation, bank security staff examined the videotape in question and produced two photographs of the complainant standing in front of the teller's station. Representing these photographs as depictions of the likely perpetrator of the crime, the bank gave them to the police, who in turn gave copies to the Crime Stoppers organization. The photographs subsequently accompanied a "Crime of the Week" article in the local daily newspaper. This article described the crime and referred to the depicted person as a suspect in it.

A bank's journal roll is a computerized central record of all transactions, including times, at any given teller's station. On the day in question, the clock for the surveillance camera had been correct, but the clock for the bank's journal roll had been 12 minutes slow. The complainant's transaction at the bank had preceded the cashing of the stolen cheques by approximately 12 minutes. Hence, when security staff later forwarded the videotape to the time the journal roll indicated for the cheque-cashing, it was the complainant's image, not the alleged criminal's, that appeared. Thus the error was the result of a failure on the bank's part to have detected the lack of synchronization between the two clocks.

A week after the original article, Crime Stoppers corrected the error by running a retraction in the same newspaper. The newspaper also ran a front-page article clarifying that the complainant had been a victim of mistaken identity. However, in the meantime, many people had recognized the complainant's image from the first article. Several friends and family members had called to inquire about her trouble with police, and she also became aware that other acquaintances had begun to entertain suspicions about her character. Believing her good name to be integral to her ability to secure work in clients' homes and workplaces, the complainant was very worried that the incident might adversely affect her reputation and her business and was most upset that suspicions about her had been allowed to gather for a full week. She was also anxious to know whether her photographs had appeared in any other Crime Stoppers notice.

The Commissioner's Office was able to reassure her that the photographs had appeared only in the one newspaper article. The complainant received formal apologies from the bank, the municipal police, and Crime Stoppers. Both the police and Crime Stoppers admitted that they had failed to follow normal verification procedures in the case, and both have since collaborated in instituting measures to prevent similar occurrences. The bank, too, has instituted procedural changes to verify times on surveillance tapes and journal rolls.

Commissioner's Findings

Issued June 28, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.6, Schedule 1, states that personal information must be as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used. Principle 4.6.1 states that the extent to which personal information must be accurate, complete, and up-to-date will depend upon the use of the information, taking into account the interests of the individual; and that information must be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.

The Commissioner noted that there was no dispute that the complainant's image had been captured by the bank's video surveillance camera, that an error had been made in matching the video image with the transaction timing on the journal roll, and that as a consequence the complainant had been publicly and erroneously identified as a criminal suspect. Though satisfied that the bank had been obligated to assist police in a criminal investigation by disclosing personal information in the form of photographs made from surveillance tapes, he determined that the information so disclosed in this case was extremely inaccurate as a consequence of the bank's failure to verify its accuracy.

Regarding Principle 4.6, the Commissioner had to consider how accurate the information should have been and how diligent the bank should have been about verifying accuracy. He determined as follows:

• The purpose of the information disclosure was the solving of a crime - a purpose which plainly cannot be fulfilled with wholly inaccurate information.
• Accuracy being crucial to the fulfilment of the purpose, the bank should have made sure that the information it disclosed was as accurate as possible.

Considering its failure to have done so, the Commissioner found that the bank had been clearly in contravention of Principle 4.6.

Regarding Principle 4.6.1, the Commissioner noted that an organization must take due account of the potential consequences of inaccurate information for the individual. He determined as follows:

• The personal information inaccurately disclosed by the bank was used to make a decision about the complainant - specifically, an erroneous decision to the effect that she was to be sought as a prime suspect in a crime.
• The decision caused the complainant embarrassment and worry about her reputation and her livelihood.
• Being well aware that the police would likely use the complainant's personal information to make a decision about her status as a suspect, the bank should have taken due care to ensure that the information was accurate so as to minimize the possibility of a wrong decision with adverse consequences.
• Due care was by no means taken.

The Commissioner found that the bank had also been in contravention of Principle 4.6.1.

He concluded that the complaint was well-founded.

Further Considerations

In closing his letters of findings, the Commissioner noted that he was satisfied that the bank had meanwhile taken appropriate action to bring itself into compliance with the relevant principles and prevent similar occurrences. He also noted that the complainant was satisfied with the corrective measures taken by the bank and the other organizations involved and had found it reassuring to know of the extent and manner of the use of her photographic images.