Daughter required to produce power of attorney document

PIPEDA Case Summary #2004-278

(Principle 4.4; subsection 5(3))

Complaint

An individual complained when a bank that had issued a credit card to her father, over whose affairs she has power of attorney, refused to cancel the account at her request unless she produced a copy of her power of attorney.

Summary of Investigation

The bank contacted the complainant's father by telephone and issued two cards, one in his name and another in the complainant's. Shortly afterward, the bank sent her father a personal identification number to allow them to obtain cash advances, and cheques that could be written against the credit account. This information was addressed to both the complainant and her father at his address, an assisted care facility. The complainant became aware of what had happened when she visited her father and found the cards and information in his room, in plain view. Given her father's health and the ease of access by other patients and staff to his room, the complainant became concerned and contacted the bank. The complainant assumed that with the power of attorney she would be able to cancel the account. The bank, however, demanded that she provide a copy of the power of attorney, which the complainant was unwilling to do since the document contained third-party information, and other information about some of the assets under her control. She contacted her lawyer, who wrote to the bank and confirmed that she did indeed have enduring power of attorney.

The bank's position was that the complainant did not establish her legal right to act on her father's behalf, and that by insisting that she produce a valid power of attorney it was protecting her father's privacy rights. The bank indicated to the Office that it would have been willing to destroy the document upon review, once it was satisfied that she had the authority to act on her father's behalf. After several conversations with the complainant's lawyer, however, the bank cancelled the credit account in question.

Findings

Issued June 17, 2004

Application : subsection 5(3), which states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances; and Principle 4.4, which stipulates that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.

The Assistant Privacy Commissioner deliberated as follows:

• The bank's purpose, namely to determine the legitimacy of the daughter's claim that she could act on her father's behalf, was one a reasonable person would likely find appropriate, as per subsection 5(3);
• As for whether it was necessary to have the entire document, the bank contended, and the Assistant Commissioner agreed, that it could not accept a document where some portions were blacked out since the blacked-out information could conceivably have set limits on the power of attorney that would have had material effect on the complainant's ability to act in the particular situation at hand;
• Although the complainant offered to have her lawyer affirm that she indeed had power of attorney, and notwithstanding the fact that the bank eventually accepted this affirmation and cancelled the account, the Assistant Commissioner remained of the view that such affirmation was not sufficient to satisfy the bank's legitimate purpose;
• Thus, the Assistant Commissioner found that by requiring the complainant to produce the entire document, the bank was not attempting to collect more information than necessary and was in compliance with Principle 4.4.

The Assistant Commissioner therefore concluded that the complaint was not well-founded.