Disclosure of personal information in the collection of a debt

PIPEDA Case Summary #2003-130

[Principle 4.3 of Schedule 1; section 7(3)(b)]

Complaint

An individual complained that his bank, through a collection agency working on its behalf, disclosed his personal information without his knowledge and consent to his family members and a lawyer.

Summary of Investigation

The complainant had a loan with a bank that went into default. The collection agent handling his file contacted the complainant's former wife, her lawyer, and the complainant's daughter in an attempt to locate the complainant. Some of these calls were initiated by the agent; others, by these individuals. All calls coming into and going out of the agency, as well as summary notes of the calls, were logged into the agency's electronic tracking system. [The information contained in this system can only be altered within two hours after it was originally logged.]

There was no evidence obtained during the investigation to indicate that the agent had disclosed to these individuals specific information regarding the debt or the complainant's financial situation, or made any threats about seizing the complainant's property, as alleged.

The bank conducts audits on the agency to ensure that its practices, including its privacy practices, are in keeping with those of the bank. The agent in question, a long-time employee of the company, signed a variety of confidentiality and ethics statements with the agency.

Commissioner's Findings

Issued March 4, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. This principle is modified by section 7(3)(b), which states that for the purpose of clause 4.3, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

The Commissioner noted that, although the Act provides an exception to the requirement for consent to disclose, it does not confer a carte blanche upon an organization to disclose however much information it wishes in pursuing a debt.

The information provided to the ex-wife was limited to a reference to an outstanding debt. The lawyer declined to provide written confirmation of what the agent disclosed to her. The daughter and the agent contradicted each other's testimony, and there was no documentary evidence showing that there had been any excessive disclosure of the complainant's personal information.

Given this, the Commissioner determined that the agent's actions were consistent with the exception provided for in section 7(3)(b), and that the bank had not contravened Principle 4.3 of Schedule 1.

The Commissioner concluded that the complaint was not well-founded.