Report of Findings: Privacy Commissioner of Canada v. SWIFT
This investigation concerned SWIFT's disclosure of personal information originating from Canadian financial institutions to the US Department of the Treasury in response to administrative subpoenas. The OPC found that PIPEDA applied to SWIFT's commercial activities in Canada. However, the Commissioner concluded that SWIFT's disclosure of information to comply with valid US subpoenas was permissible under PIPEDA, interpreting subsection 7(3)(c) to allow compliance with lawful orders from foreign jurisdictions where the organization operates. The Commissioner recommended that US authorities use existing information-sharing mechanisms rather than subpoenas to obtain Canadian financial data.
- Does PIPEDA apply to SWIFT's collection, use, and disclosure of personal information in its Canadian operations?
- Was personal information disclosed to US authorities in accordance with PIPEDA?
- Interpretation of subsection 7(3)(c) regarding compliance with foreign subpoenas.
- Balancing privacy protection with counter-terrorism financing efforts.
Complaint not well-founded
The Commissioner determined that while PIPEDA applied to SWIFT's activities in Canada, the Act permits disclosure of personal information to comply with valid subpoenas from jurisdictions where the organization lawfully operates. SWIFT's disclosure to the US Department of the Treasury was therefore found to be in compliance with PIPEDA.
AI-generated summary for reference only. Always verify against the official decision ↗
- s. 4(1)(a) PIPEDA
- Principle 4.3 PIPEDA
- s. 7(3)(c) PIPEDA
- s. 5(3) PIPEDA
This summary is informational only and not legal advice.