Bank retrieves overpayment of wages from employee's account

PIPEDA Case Summary #2006-327

(Principle 4.3 of Schedule 1)

Complaint

A bank employee was concerned when her employer removed money that it had overpaid her from her account.  The Privacy Commissioner found that the employee had not consented to such a use of her personal information and recommended that the bank change its practices.  The bank agreed to obtain employee consent beforehand.  The following is a detailed account of the investigation and findings.

Summary of Investigation

The complainant had been receiving income replacement benefits from the bank under its disability protection plan.  The bank had paid the complainant several weeks of benefits when it was determined that the complainant was no longer eligible for further benefits.  The bank stated that it was therefore necessary to halt the next payment.  However, since the documentation was not submitted on time to stop the payroll deposit to the complainant’s account, the bank withdrew the funds on the following pay date, two weeks later.

The bank stated that, to ensure that the complainant did not withdraw funds from her account, it placed a 14-day hold of payroll funds on the account (the pay cycle is 14 days).  When the complainant attempted to access the account at the end of the 14-day period, the bank had withdrawn the payment but the hold was still in effect.  The hold was removed three days later, after the complainant had brought the matter to the bank’s attention. 

During this period, the complainant was in the midst of settling a termination package with the bank.  The complainant brought her concerns to the attention of the bank’s ombudsman, and was told that the hold was placed in order to allow the bank to recover an overpayment of wages.  The bank also cited paragraph 254.1(2)(d) of the Canada Labour Code, to support its actions.  The paragraph in question states:

No employer shall make deductions from wages or other amounts due to an employee, except as permitted by or under this section.  The permitted deductions are …overpayment of wages by the employer.

The bank indicated that it had informed the complainant’s legal counsel by voice mail that it would be taking steps to reverse the pay that the complainant was not entitled to.  We reviewed a note of the voice mail message.  It indicated that the bank told the counsel that it would be holding the complainant’s pay in its entirety.  The bank later wrote to the complainant, apologizing for placing a hold on her account after the two-week period had ended as the bank had already recovered the money owed to it.

According to the bank’s disability plans policy, a unit manager is responsible for stopping the employee’s pay and for the recovery of payments already made against a claim declared ineligible.  The manager is also advised to consult with human resources personnel regarding the cessation of pay and recovery of any benefits that have already been paid, if the absence proves to be unsubstantiated. 

Bank employees are required to open a deposit account when they are hired by the bank.  Accounts with employee plan privileges are for personal use only.  The bank’s employee banking plan policy does not inform employees that the bank may recover an overpayment of wages made to employee from a staff account.

Findings

Issued February 2, 2006

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

In making her determinations, the Privacy Commissioner deliberated as follows:

• The investigation established that the complainant’s benefits were declined.  Since the documentation was not submitted on time to stop the payroll deposit, the complainant owed her employer a certain amount in paid wages.  While the bank informed her legal counsel that her pay (for one pay period) would be held in its entirety, it did not indicate that it would retrieve her paid wages from her account.
• Subsection 254.1(2) of the Canada Labour Code authorizes an employer to deduct, from wages or other amounts due to an employee, overpayments of wages by the employer.  The bank, as her employer, was entitled to deduct the overpayment from an amount that was due to her, pursuant to subsection 254.1(2). 
• The Commissioner noted that, at the time, there were ongoing negotiations between the bank and the complainant with respect to a termination package, and a deduction could have been made by the employer from any amount due the complainant. 
• However, the employer was not entitled, pursuant to subsection 254.1(2), to take advantage of its role as the complainant’s bank to unilaterally retrieve a sum of money from her account.  In our view, the bank, as employer, could only make a deduction from an amount due. 
• In this case, the Commissioner was of the view that the bank had misused the complainant’s personal information when it took advantage of its dual role as her employer and bank and retrieved money from her account, without her knowledge or consent, thereby breaching Principle 4.3.
• Concerned about this practice, the Commissioner recommended that, in instances where monies are owed by a bank employee to the bank, the bank not access an employee’s account to retrieve monies due.
• The bank responded by acknowledging that an employee’s personal information should not be collected, used, or disclosed without the employee’s consent.  It noted, however, that employees often find the direct removal of funds from the employee’s personal account to be the most convenient way for the bank to recover an overpayment of wages.  The bank stated that to disallow such a process in all cases would place an unnecessary burden on the employee to repay funds to the bank through other, less convenient means.
• Nevertheless, in recognition of its obligation to obtain consent, the bank committed to changing its procedure for the recovery of monies due so that retrieval of funds from an employee’s account will be contingent on the employee’s consent. 

Satisfied that this change of procedure met the requirements of Principle 4.3, the Commissioner concluded that the complaint was well-founded and resolved.