Disclosure of personal information to estranged spouse

Settled case summary #14

Complaint

An individual alleged that a bank employee improperly disclosed the individual's bank account balance to her estranged husband.

Outcome

According to the complainant, her estranged spouse told her that when he attended a branch of the bank to deposit a monthly support payment into the complainant's account, the teller revealed the balance in the account. As a result, the husband withheld the next month's support payment since the complainant, in his opinion, had sufficient funds in her account. This placed the complainant in a difficult financial position because the money in her account had already been earmarked for other bill payments. At the time of the incident, there was no support payment order in effect through the courts. During the investigation, the complainant sought compensation from the bank in the amount of the balance that was disclosed to her estranged husband.

The bank apologized to the complainant. It informed the Office that the employee in question had no recollection of the events. The employee had indicated that it was not her practice to provide account balances verbally to any customers because of the risk of an inappropriate disclosure. The bank confirmed that the employee had undergone privacy training and had signed a confidentiality agreement when she was hired.

Although the employee could not recall the situation, the bank was of the view that there was no evidence to suggest that the allegations were false. Principle 4.3 of the Personal Information Protection and Electronic Documents Act states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. The bank did not dispute that its employee contravened Principle 4.3 when she disclosed the complainant's personal information without her knowledge and consent.

In the course of investigating the complaint, the bank and the complainant privately agreed to settle the matter of compensation between them. Moreover, given that the investigation did not reveal evidence of a systemic problem — the bank had adequate privacy policies and procedures in place, and the employee had received appropriate training on the importance of safeguarding customer personal information — the Assistant Privacy Commissioner and the complainant agreed that the matter should be considered settled.