Fax from debt collector contained debtor’s personal information

PIPEDA Case Summary #2005-317

(Principles 4.3 and 4.7; paragraph 7(3)(b))

Complaint

An individual complained that a collection agency inappropriately disclosed her personal information when an agency employee sent the complainant’s employer a facsimile that included the complainant’s social insurance number (SIN), as well as information about the debt, on the cover page.

Summary of Investigation

The two-paged facsimile in question contained the cover sheet and a wage assignment, and was sent to the payroll department of the complainant’s employer. It was intercepted by an employee, who in turn gave it to the human resources advisor. The advisor contacted the complainant to discuss the fax and the fact that the collection agency should not have sent it with her SIN on it. A second fax was sent to the complainant’s employer by the same debt collector, prior to the collection agency being informed that the Office had received a complaint about the matter.

The collection agency stated that the complainant’s employer had requested the SIN as a means of identifying the correct individual; otherwise, the company would not have disclosed such information. The company indicated that it does not routinely send faxes with SINs on them. It also noted that there is a written disclaimer on the bottom of the fax stating that the information is intended for the recipient only.

The human resources advisor denied that she requested the complainant’s SIN, and stated that she had never spoken to the collection agency employee who sent the facsimile. There was no other individual with the same name as the complainant working for the complainant’s employer, thus, there would have been no reason to ask for the SIN.

The human resources advisor stated that when an outside company tries to collect money from an employee’s wages, she contacts the employee in question to encourage him or her to deal directly with the collection agency to resolve the matter.

The events at issue took place in Ontario, where the activities of collection agencies are subject to the Collection Agencies Act, R.S.O. 1990, Chapter C. 14. Section 21 of regulation 74 specifies the limited circumstances under which a collector can contact a debtor’s employer. It states:

Except for the purpose of obtaining the debtor’s address or telephone number, no collection agency or collector shall contact a debtor’s employer…unless

a) the person contacted has guaranteed to pay the debt and is being contacted in respect of such guarantee;

b) the person contacted is the employer of the debtor and the collection agency or collector is contacting the employer in respect of payments pursuant to a wage assignment or an order or judgment made by a court in favour of the collection agency or of a creditor who is a client of the collection agency; or

c) the person contacted is the employer of the debtor and the collection agency or collector is contacting the employer for purposes of verifying the employment of the debtor.

Upon review of the documentation sent to the employer, it was noted that this was not a true wage assignment, but rather a sample copy. A wage assignment is an authorization by an employee for the employer to pay all or part of his her wages to another person. With a wage assignment, the small short-term lender could approach the borrower’s employer for repayment. In Ontario, only credit unions may use wage assignments. They are otherwise prohibited.

The employer indicated that it would never have responded to the documents the collection agency sent. It indicated that it would only respond when companies provide court orders. When wages are garnisheed, the employer’s human resources advisor makes the payments to the Ontario Ministry of Finance, which then disburses the funds to the creditor.

Findings

Issued October 24, 2005

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. An exception to this can be found in paragraph 7(3)(b), which permits a disclosure of personal information without knowledge or consent if the disclosure is for the purpose of collecting a debt owed by the individual to the organization. We also applied Principle 4.7, which states that personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• As in all complaints of improper disclosure by a collection agency, the Assistant Commissioner noted that while the Personal Information Protection and Electronic Documents Act does provide for the disclosure of personal information without knowledge or consent to collect a debt, the Office has always cautioned organizations about the scope and content of any such disclosure. Specifically, we have stated that paragraph 7(3)(b) does not confer a carte blanche upon the organization to disclose however much it wishes in pursuit of monies owed.
• The documentary evidence showed that a collector sent a facsimile to the complainant’s employer, which included on the cover sheet, the complainant’s name, SIN, and information about the money she owed. There was no intended recipient noted on the sheet. While the cover sheet may contain a note that the facsimile is intended for the use of the person to whom it is addressed, the Assistant Commissioner noted that this was a moot point when there was no addressee – and when the cover sheet contains personal information.
• She therefore determined that the company did not meet the requirements of Principle 4.7 to properly safeguard personal information.
• The Assistant Commissioner was also of the view that this was an excessive disclosure of personal information. She noted that it was not appropriate for a collection agency to reveal specific details about one’s financial situation to third parties, such as employers. If wages are to be garnisheed, then legal documentation must be sent to the employer. The Assistant Commissioner thus found the collection agency in contravention of Principle 4.3.
• The company indicated to the Office that it has since taken steps to improve its procedures. It stated that the SIN will no longer be included on faxes, that human resources advisors will be contacted directly, and that personal information will be sent in a more secure fashion, such as in a sealed envelope addressed to the appropriate contact.

The Assistant Commissioner therefore concluded that this complaint was resolved.