Commissioner's Findings - September 4, 2003 - Privacy Commissioner of Canada: PIPED Act Case Summary #211: Bank accused of improperly disclosing overdraft information to another bank

Among other complaints to the OPC, a couple complained that they were not allowed to withdraw their consent for future information disclosure to other lenders, credit bureaus or credit-reporting agencies. The couple's account had become delinquent and was referred to the bank's collections division. The couple got a loan from another bank and wanted to refuse to allow the original bank to communicate their credit information to other parties.

The first bank's position was that it had the couple's consent to the disclosure of their personal information by virtue of the personal loan service authorization they had signed a few years earlier when their personal credit reserve was arranged. This document stated that the couple authorized the bank to disclose to other lenders, credit bureaus or other credit-reporting agencies personal and credit information about them. The bank further stated that the couple could not withdraw their consent for future disclosure because the sharing of such personal information is required to maintain the integrity of the Canadian credit-granting system.

Commissioner's Findings ...

It has been confirmed in other cases considered by the Office that the credit system in Canada depends upon the fulfillment of myriad contractual and legal obligations.

If individuals could withdraw their consent to disclosure of their credit history with a particular lender, the credit system would not work.

On this basis, the Commissioner determined that the bank was justified, on legal and contractual grounds, in refusing to honour the couple's request for withdrawal of consent to the sharing of their personal financial information with other lenders, credit bureaus or credit-reporting agencies. He found, therefore, that the bank was not in contravention of Principle 4.3.8.

This finding appears to answer (albeit not definitively) a relatively common query among credit grantors when informed that PIPEDA contains the following provision:

4.3.8 An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization shall inform the individual of the implications of such withdrawal.

It appears that as long as the credit agreement contains a consent to the exchange of credit information with the usual parties, the debtor is not able to unilaterally withdraw that consent. Prudence would suggest that credit grantors would want to include language that explicitly informed individuals that they are not able to withdraw consent.

Labels: information breaches, pipeda findings