Company’s disclosure of information about a debt owed is not covered under exemption to consent

PIPEDA findings #2016-013

December 29, 2016

Description

An individual complained that an organization disclosed his personal information, specifically information about a debt, to another organization on two occasions without his consent. Information about a debt owed by an identifiable individual constitutes personal information and is sensitive. It may only be disclosed by an organization without consent in very limited circumstances, which are outlined in subsection 7(3) of the Act, including 7(3)(b), for purposes of collecting a debt owed by the individual to the organization. In this case, the disclosure was not for purposes of collecting the debt. Therefore, consent was required. The fact that the information may have been disclosed in response to a direct question with the expectation that the discussion would remain private did not exempt the disclosure from the requirement to obtain consent. Our investigation found that the disclosures did not fall within the scope of the circumstances described in subsection 7(3). Further, our Office is of the view that the company’s claim that there was an “expectation of privacy” when the disclosures took place is not a substitute for obtaining the necessary consent from the individual whose personal information is disclosed, nor is simply being asked by another party to divulge someone’s personal information.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act” or “PIPEDA”)

Summary of Investigation

1. The complainant was a member of a sports facilities company (the “company”). In 2014, his membership was suspended because he owed the company money arising from unpaid dues and outstanding amounts for goods and services purchased. The complainant was in negotiation with the company regarding the debt owed.
2. The complainant was also a board member of a related sports association (the “association”) that was organizing a tournament to be held on the company’s premises.
3. Prior to the tournament, a telephone call took place between a senior representative of the company and the office manager of the association. The object of the call was for the company to express its opposition to two particular individuals (including the complainant) scheduled to participate in the upcoming tournament on the company’s premises. During the call, the company asked that both individuals be removed from the tournament roster because they had been suspended from the company because of an outstanding debt with the company.
4. The next day, a meeting was held to discuss the company’s decision to ban the complainant from its premises for the upcoming tournament. The meeting was attended by the complainant himself and a board member of the association, as well as by the company’s president and the same senior company representative who had divulged the complainant’s debt information on the telephone the day before. During the meeting, the company again disclosed that the complainant owed it a debt.
5. For its part, the company has claimed to our office that information about the complainant’s debt was given on these occasions because the company was specifically prompted by the association to provide reasons why the complainant was not in good standing with the company. Moreover, the company has claimed that there was an expectation of privacy during these two discussions.
6. Following these events, the complainant sent a settlement offer to the company, wherein he accused the company of contravening PIPEDA. He also detailed specific conditions to be met, including an amount to be disbursed for damages, in order to preclude any future litigation against the company. He has since informed our Office that he has revised these conditions and that he also seeks letters of apology from the two representatives of the company.
7. The complainant also filed the current complaint with our office. In his complaint, he alleges that the company disclosed his personal information without his consent. Specifically, he alleges that during a telephone call and again in a meeting, representatives of the company informed members of the association that he had failed to pay an outstanding balance owed to the company, without his consent.
8. Our office examined the company’s privacy policy, a confidentiality policy for board members and a code of ethics for board members, the latter being signed annually by board members. As well, the company advised us that all new members are required to attend an orientation session that includes a detailed review of the privacy policy.
9. The privacy policy clearly indicates that “consent is required for the collection of personal information and the subsequent use or disclosure of this personal information” and contains a section on limiting collection, use and disclosure of personal information. Our office also reviewed the company’s confidentiality policy for board members since the two individuals who disclosed the complainant’s personal information were part of the company’s Board of Directors. This policy contains clear statements requiring board members to maintain the confidentiality of client records in accordance with the company’s privacy policy.
10. It was confirmed to our office that both company board members involved in the alleged disclosure had attended the initial board member’s training session and had reviewed the confidentiality policy for board members.
11. During the investigation, the company decided to again review its privacy policy with board members and planned to have “privacy and confidentiality” as a standing item on its meeting agenda in order to mitigate the recurrence of privacy complaints.
12. Lastly, our Office was advised that the complainant was ultimately permitted to play in the tournament held on the company’s premises.

Application

13. In making our determinations, we applied Principle 4.3 of Schedule 1 and paragraph 7(3)(b) of Part 1 of PIPEDA.
14. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
15. Paragraph 7(3)(b) states that an organization may disclose personal information without the knowledge or consent of an individual only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

Findings

16. At issue is whether there was knowledge and consent for the disclosure of the complainant’s personal information, specifically, his outstanding debt owed to the company to the association.
17. Debt information about an identifiable individual constitutes their personal information. Further, this type of personal information is also generally considered sensitive personal information.
18. Our investigation established that the company disclosed the complainant’s personal debt information to the association on two occasions. Further, it is clear that the company did not have the complainant’s consent to do so, as is required by Principle 4.3. The company’s claim that there was an “expectation of privacy” when the disclosures took place is not a substitute for obtaining the necessary consent from the individual whose personal information is disclosed, nor is simply being asked by another party to divulge someone’s personal information.
19. Therefore, in our view, Principle 4.3 was contravened.
20. PIPEDA contains certain exemptions from the requirement to obtain consent for the disclosure of personal information.
21. Under paragraph 7(3)(b), PIPEDA provides an exemption to obtaining consent when the purpose of the disclosure is to collect a debt owed by the individual to the organization. However, in the present case, it is clear that the company’s purpose for disclosing the complainant’s debt information was not to collect the debt, but rather to prevent the complainant from participating in the tournament being held at the company’s premises. Therefore, the company cannot rely on paragraph 7(3)(b) to exempt itself from obtaining the complainant’s consent to disclose the complainant’s personal information.
22. We were disappointed that, despite the company have a confidentiality policy in place, it was the president and another senior representative who were involved in the disclosure. In our view, two high ranking members of the company’s Board of Directors should strive to set an example for the rest of the company to follow. Having said that, the two individuals involved in this disclosure are no longer part of the Board of Directors at the company.

Conclusion

23. Accordingly, we conclude that the matter is well-founded.