Want to stay current on e–commerce law? Sign up for Email Newsletter.
Leaving Messages May Create Privacy Law Liability
A recent decision (#270) by the Canadian Assistant Privacy Commissioner dealt with an individual who alleged that her bank had improperly disclosed her personal information in breach of the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) when the bank left an automated message on her answering machine stating she was behind on making credit card payments thereby allowing the complainant's husband to listen to the message.
As part of the ruling, it was held that even though the bank did not identify the intended recipient of the message, the content of the message was still defined to be "personal information", since the complainant could be identified from the context (being the only family member with a credit card from the bank
The second finding rejected the bank's argument that the PIPEDA section 7(3)(b) exemption allowed it to disclose personal information without the complainant's consent "for the purpose of collecting a debt owed by the individual to the organization." The Assistant Privacy Commissioner held that because the bank did not intend to disclose the information to the complainant's husband, his hearing the recorded message was inadvertent and not done by the bank for its own purposes as contemplated by the exemption, which therefore did not apply. This has the curious effect that if the bank had intended to disclose the overdue debt to the complainant's husband for the purpose of having him remind the complainant, then it could be argued that the section 7(3)(b) exemption would apply, (although such an argument may be in conflict with section 5(3) of PIPEDA which states that an organization may disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances).
The facts indicate that the bank did not advise its customers when they applied for a credit card that they would be contacted by an automated system, which would leave a message on the customers' voicemail. This suggests the solution that the bank change its privacy policy and procedure to advise in advance all credit card applicants that it would be leaving messages using an automated system on their voicemail for reminder purposes and that the applicants must agree to such a method of communication even if other members in their household are able to access the voicemail.
For a copy of the decision, visit: