PIPEDA findings #2017-012: Financial institution discloses too much information in response to production order
The complainant discovered that his financial institution had disclosed his Registered Education Savings Plan (RESP) account information dating back to 1999 to the police. The OPC found that while production orders allow disclosure of information, the financial institution disclosed documents beyond the scope of the specific production order and did not have valid consent. The institution agreed to review its procedures and provide training to staff regarding disclosures pursuant to production orders.
- Disclosure of personal information beyond the scope of a production order
- Validity of consent based on a general privacy policy for law enforcement disclosures
- Sensitivity of financial information
Complaint well-founded and resolved
The institution disclosed personal information outside the specific timeframe and scope of the production order, and its privacy policy did not constitute informed consent for such a disclosure.
AI-generated summary for reference only. Always verify against the official decision ↗
The financial institution agreed to review its procedures, provide job aids, and offer dedicated training to staff responsible for disclosures pursuant to production orders.
- PIPEDA Schedule 1 Principle 4.3
- PIPEDA s. 6(1)
- PIPEDA s. 7(3)(c)
This summary is for informational purposes only and does not constitute legal advice.