Want to stay current on e–commerce law? Sign up for Email Newsletter.
Privacy Commissioner Finds After-the-fact Consent Ineffective
The Privacy Commissioner of Canada has determined that the failure of a bank to obtain authorization for credit checks was a violation of Principle 4.3 of the Personal Information Protection and Electronic Documents Act ("PIPEDA"). The violation occurred when the branch manager of the bank conducted credit checks on customers for the purposes of pre-approving the customers for overdraft protection. Once the credit checks were conducted, customers qualifying for pre-approval were notified and asked to sign an authorization for the previously conducted credit check if accepting the overdraft protection.
Principle 4.3, found in Schedule 1 of PIPEDA states, "The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate." The Commissioner found it was undisputed that the bank had collected and used personal information without the consent of the individual and had therefore violated Principle 4.3. The bank in question had taken immediate steps to correct the situation, acting even before being notified of the involvement of the Privacy Commission.
For additional information, visit: