Condita Research
← Back to catalogue/Federal (Canada)PIPEDA findings #2017-012
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded & resolved

PIPEDA findings #2017-012: Financial institution discloses too much information in response to production order

Organization: A financial institutionComplainant: Anonymous applicant
BookmarkView Governing Law
Plain-language brief

A complainant alleged that his financial institution improperly disclosed his personal information, specifically RESP account details from 1999, to a municipal police service. The financial institution claimed the disclosure was made under a production order or, alternatively, with the complainant's consent via its privacy policy. The OPC found that the disclosed 1999 RESP information fell outside the scope of the production order, which specified a different date range and nature of information. The OPC also rejected the financial institution's argument of consent, stating that the privacy policy's general language was insufficient for informed consent, especially for sensitive financial information. The financial institution agreed to review its procedures and provide training to ensure compliance with production orders. The complaint was found to be well-founded and resolved.

Key issues
  1. 1Whether the disclosure of RESP account information from 1999 was justified under paragraph 7(3)(c) of PIPEDA as being required by a production order
  2. 2Whether the financial institution could rely on the complainant's consent, as stipulated in its privacy policy, for the disclosure of personal information to law enforcement
  3. 3Whether the RESP account information constituted sensitive personal information
Outcome breakdownFavours: Applicant / complainant
  • Scope of disclosure: Disclosure exceeded production order
  • Consent for disclosure: General privacy policy insufficient for consent
  • Complaint outcome: Complaint well-founded and resolved
  • Institutional practices: Institution agreed to review procedures and provide training
Outcome

Complaint well-founded and resolved

Reasoning

The OPC found that the financial institution disclosed information outside the scope of the production order and that the general terms of its privacy policy did not constitute valid consent for such a disclosure. The financial institution agreed to implement corrective measures.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The financial institution agreed to review its procedures for complying with production orders and provide dedicated training and job aids to staff responsible for such disclosures.

Statutes considered
  • Principle 4.3 PIPEDA
  • s.6(1) PIPEDA
  • s.7(3)(c) PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro