Assistant Commissioner considers the retention of a record

PIPEDA Case Summary #2003-252

[Section 2; Principles 4.5, 4.5.2, and 4.5.3]

Complaint

An individual complained that a bank was not properly retaining mortgage renewal acknowledgement letters for its clients.

Summary of Investigation

The bank stated that it did not keep a copy of the acknowledgement letters it sends to customers as they contain information that is available in other documents, namely, the mortgage renewal agreement, annual statement, original statement of disclosure, and the revised tax notice. The Office compared the information contained in the acknowledgement letter to that in the mortgage renewal agreement and found that the information on both documents was identical, except for the prepayment privileges and the first payment date. These items could be found on either the annual statement or the original statement of disclosure.

As for retention periods, the bank destroys the annual mortgage statement, mortgage renewal agreement and original statement of disclosure two years after discharge (if discharge is registered) and six years after discharge (if the discharge is not registered).

The bank also indicated that it could manually reproduce mortgage renewal acknowledgement letters, using its on-line mortgage system.

Findings

Issued December 15, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.5 states that personal information shall be retained only as long as necessary for the fulfilment of (the purposes for which it was collected). Principle 4.5.2 indicates that organizations should develop guidelines and implement procedures with respect to the retention of personal information. These guidelines should include minimum and maximum retention periods. Personal information that has been used to make a decision about an individual shall be retained long enough to allow the individual access to the information after the decision has been made. Principle 4.5.3 states that personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information.

Section 2 defines "personal information" as information about an identifiable individual and "record" as any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microform, sound recording, videotape, machine-readable record and any other documentary material, regardless of physical form or characteristics, and any copy of any of those things.

The Assistant Commissioner deliberated as follows:

• She noted that the term "record" as defined in section 2 is used in connection with the Commissioner's powers to investigate complaints and carry out audits, where she has the power to compel the production of records. The Act, however, provides the individual with the right of access to information, not necessarily files or records.
• While the complainant argued that the bank should retain a "record" of the mortgage renewal acknowledgement letters, the Act stipulates that it is the information that must be retained. In this instance, the information contained in the acknowledgement letter exists in other documents, namely, the mortgage renewal agreement, the annual statement, and the original statement of disclosure, which are subject to set retention periods.
• Furthermore, the Assistant Commissioner noted that the bank could reproduce a letter that would contain all the elements that appeared in the original letter by accessing its on-line mortgage system.
• If the letter contained information that could not be found elsewhere in its files, the Assistant Commissioner stated that a copy of the letter would have to be kept. However, since this is not the case, she was satisfied that the bank had met the retention requirements stipulated in Principles 4.5, 4.5.2, and 4.5.3.

Accordingly, she concluded that the complaint was not well-founded.