Bank customers required to declare citizenship

PIPEDA Case Summary #2004-286

(Principles 4.2, and 4.4 of Schedule 1; subsection 5(3))

Complaint

A number of account holders of a bank complained when the bank sent them a form letter asking them to indicate whether they were U.S. citizens. They believed that the bank was requiring them to consent to the collection and use of more personal information than necessary for the purpose of providing account services.

Summary of Investigation

In 2001, the ownership structure of the bank in question changed and the bank became an indirect subsidiary of a U.S.-based holding company. Since the bank is now classified as a "controlled foreign corporation" for the purposes of U.S. income tax law, it is required to comply with applicable U.S. Internal Revenue Service (IRS) regulations with respect to information reporting and tax withholding. It must therefore report the interest income earned on personal deposit accounts to the IRS for account holders who are known to be U.S. citizens, or presumed to be U.S. citizens because they have not declared themselves to be non-U.S. citizens.

The bank mailed all of its personal deposit account holders an explanatory letter and account declaration form. The letter indicated that if a holder did not declare that he or she was not a U.S. citizen, the holder's name and address, and amount of interest income earned, would be disclosed to the IRS. The letter also outlined the purpose for collecting such information and how it would be used.

Our Office confirmed that the bank was required to comply with the IRS regulations and that it had interpreted them properly.

Findings

Issued December 21, 2004

Application: Principle 4.2 states that the purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected; and Principle 4.4 establishes that the collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Finally, subsection 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

In making her findings, the Assistant Privacy Commissioner deliberated as follows:

• Although she noted that one of the main concerns raised during the investigation was that a "Canadian" bank was putting the requirements of foreign legislation ahead of the privacy interests of its Canadian customers, the Assistant Commissioner was of the view that in terms of the collection and use of personal information, the bank was not.
• As a controlled foreign corporation, the bank is required to comply with applicable IRS regulations, which stipulate that it report the interest income earned for U.S. citizens but which allow it to not report the same for account holders who are non-U.S. citizens.
• To ensure that accurate information was being provided to the IRS and to protect the personal information of non-U.S. citizens, the bank sent the account declaration form to its account holders asking them to state whether they were U.S. or non-U.S. citizens.
• In the Assistant Commissioner's opinion, the bank was making a reasonable request, for purposes that a reasonable person would consider appropriate, as per subsection 5(3).
• As the purposes were identified and the collection of personal information limited to the purposes, she found the bank in compliance with Principles 4.2 and 4.4.

The Assistant Commissioner concluded that these complaints were not well-founded.