Bank Disclosed Personal Information without Consent

PIPEDA Case Summary #2009-024:

[Principles 4.3, 4.3.2 and 4.3.5]

A married couple who held separate bank accounts met with a mortgage specialist from their bank to discuss applying for a mortgage.  The husband alleged that the specialist disclosed his account information to his wife without his consent.  The bank maintained that, while information was disclosed, the specialist had the husband’s implicit consent to do so, given that the purpose of the meeting was to talk about a joint mortgage.

The Assistant Commissioner found that the bank did not make a reasonable effort to ensure the couple was aware of the purposes for which their financial information would be disclosed to one another when applying for a joint mortgage.  Thus, as consent was not meaningful, the bank did not have the husband’s implicit or explicit consent to disclose his information.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation and Findings

Issued December 21, 2009

A married couple who held separate bank accounts and kept their financial information separate decided to apply for a joint mortgage and asked a mortgage specialist from their bank to come to their home to help them complete an application.

According to the complainant and his wife, while the mortgage specialist was setting up, the complainant left the room for a few minutes. He believed the meeting would not proceed until he returned.

During his absence, the mortgage specialist accessed credit report information, which she mistakenly believed to be that of the complainant, and disclosed it to his wife. The report revealed a high level of debt.

The complainant stated that, when he returned to the room, his wife was distraught because she thought he had a large amount of debt, of which she was previously unaware.

Later, it became evident that the information was that of the husband’s father, who had the same name. Once it was established that the credit report was not his, the mortgage specialist tried to reassure the wife by showing her that the husband’s actual debt load was insignificant. The complainant claimed that the specialist displayed his line-of-credit information and credit card balance on her laptop.

The mortgage specialist did not recall disclosing information to the wife about the complainant’s line of credit or credit card account. She maintained that she would not have done so because the balances were too insignificant to mention.

The bank acknowledged that its employee improperly disclosed the complainant’s father’s credit report by mistake. With respect to the complainant’s personal information, the bank argued there was implied consent on the complainant’s part for the employee to discuss his credit information with his wife.

According to the bank, the usual practice of its mortgage specialists is to have an initial discussion with joint applicants to inform them, among other things, that a discussion of their assets and liabilities would be necessary. In the event one of the parties raises a concern, the mortgage specialist presents options such as talking about debts and assets with each party separately, or considering a single-applicant mortgage. If neither party raises an objection, the bank considers it reasonable to proceed on the basis of implied consent to disclosure.

In this case, the bank said it believed there was implied consent to discuss the financial status of each mortgagor in the presence of the other.

However, we found that the bank did not make a reasonable effort to ensure the couple was aware of the purposes for which their financial information would be disclosed to one another when applying for a joint mortgage. In this case, the bank’s mortgage specialist did not follow the bank’s usual practice of informing joint mortgage applicants about the need to discuss their assets and liabilities.

As well, even if the mortgage specialist had believed at first that she could rely on implied consent to disclose the applicants’ financial information, the fact that the wife was clearly unaware of her husband’s accounts should have indicated that the presumption of implied consent was no longer reasonable or appropriate. At the very least, the bank employee should have clarified the situation before making any further disclosures. Following an investigation, our Office was inclined to believe that the bank mortgage specialist did disclose the complainant’s personal information to his wife.

In past findings, our Office has repeatedly upheld the principle that personal information must not be disclosed to spouses without consent and has set a high standard of notification in that regard.

In sum, the bank did not establish a reasonable knowledge basis for inferring the complainant’s consent and therefore did not have meaningful consent to the disclosure of his personal financial information to his wife.

However, the incident in question occurred as the result of an employee’s one-time error, the bank responded appropriately, and had adopted reasonable practices with respect to protecting the personal financial information of joint mortgage applicants.

Conclusion

As a result, the Assistant Commissioner concluded that the complaint was well founded and resolved.