Excessive disclosures in the pursuit of a debt

PIPEDA Case Summary #2004-282

(Principle 4.3; paragraph 7(3)(b))

Complaint

An individual claimed that a bank disclosed a significant amount of his personal information to two of his employees without his consent. The complainant alleged that these disclosures were extremely damaging to his reputation and contributed to his decision to resign as the head of a company.

Summary of Investigation

The complainant provided two sworn affidavits from the employees, as well as a taped recording of a message left on one of the employee's voicemail, in support of his allegations. Both employees stated in their affidavits that the bank collectors who had contacted them had revealed details about the complainant's debts. Specifically, the collectors had told them that the complainant's account was severely delinquent, his credit card was suspended from further use, his payment history was sketchy, the bank was intending to enforce its claim against the complainant, and as part of that enforcement, was going to garnish his wages, which would be embarrassing for both the company and the complainant. The collectors also revealed the amount of the debt. The bank's collectors had indicated to the employees that the purpose of their calls was to obtain details regarding the complainant's employment with the company so that the bank could garnish his wages. Both employees told the bank collectors that they thought their actions were inappropriate. Both employees indicated to the complainant at the time of the calls that at least one other employee, namely, the receptionist, knew about the bank's collection efforts. Our Office confirmed with the employees that the contents of their affidavits were accurate.

Our Office reviewed the recorded message. The collector states at one point that "he doesn't know what kind of company (the complainant and his employees) are running, but given the (complainant's) history of not paying his bills, I can't really say that I'm surprised by your lack of professionalism... you can ignore my calls all you want but it won't make (the complainant's) liability to (the bank) go away... :"

The bank stated that it had commenced legal action to recover monies owed by the complainant on his credit card account, and that collection activities were handled internally by its employees and not by a collection agency. The two employees who worked on this account were no longer employed by the bank.

The credit card agreement contained a provision regarding consent to use personal information to assist the bank in collecting on the account. The bank stated that what happened to the complainant was not a common occurrence and provided the Office with information regarding the training it gives to employees regarding the protection of customers' personal information. While the training material notes that personal information can be disclosed without customer consent as a last resort to collect a debt that the customer owes, staff are directed not to reveal or discuss the purpose of a call to anyone other than the card member and to maintain confidentiality regarding the card member's accounts and other personal information.

Findings

Issued October 21, 2004

Application : Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Paragraph 7(3)(b) provides an exception to the requirement for consent. It states that an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• While acknowledging that an organization may disclose an individual's personal information without consent for the purpose of collecting a debt, this exception did not confer, as noted in an earlier finding made by this Office, a carte blanche upon an organization to disclose however much information it wished in pursuing a debt.
• In this instance, there was clear documentary evidence, from the tape recording as well as from the sworn affidavits, that an excessive amount of information was divulged during the bank's debt collection activities.
• The bank had stated that it was calling the complainant's employees to verify his employment and that it was planning to garnish his wages. While the Assistant Commissioner acknowledged that an organization must disclose some information to an employer when seeking to garnish the debtor's wages, in her opinion, the bank went too far in its attempt to recover the debt.
• There was no need to reveal the debtor's payment history, the amount of money owed, or that the debtor's credit card was suspended from further use, to name but a few examples of information that the Assistant Commissioner considered excessive.
• She thus found the bank in contravention of Principle 4.3.

The Assistant Commissioner concluded that the complaint was well-founded.

Further Considerations

The Assistant Commissioner recommended that the bank ensure that its collection staff is trained with regard to what information can be disclosed to third parties during collection activities.