Bank acted in accordance with section 7(3)(c)

PIPEDA Case Summary #2003-174

[Principles 4.3, 4.5; section 7(3)(c)]

Complaint

An individual alleged that her bank disclosed her personal information without her consent to a third party.

Summary of Investigation

The complainant alleged that money was taken from her account, without her authorization, and that her personal information was communicated to a lawyer to whom she owed money. A judgment had previously been rendered, however, in which the complainant was ordered to pay a certain sum of money to the lawyer. The bank was subsequently summoned to declare under oath the sums of money, assets, or movables belonging to the complainant. As per the judgment, the contents of the complainant's account were then withdrawn from her account.

Commissioner's Findings

Issued April 28, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.5 establishes that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Section 7(3)(c) states that an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records.

As the bank had acted in response to a writ of seizure issued by a court, the Commissioner was satisfied that the bank's disclosure of the complainant's personal information was consistent with the exception to the requirement for consent provided under section 7(3)(c).

Therefore, the Commissioner concluded that the complaint was not well-founded.