Banks, lessors, mortgage companies and other lenders routinely collect personal information about borrowers and guarantors when underwriting credits, and frequently have a need to later disclose this personal information to receivers, bankruptcy trustees, monitors and others in debt restructuring transactions. The collection, use and disclosure of personal information in any context requires consideration of having to remain in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) which came into force in Canada on January 1, 2004.

In some instances, compliance with PIPEDA by lenders will conflict with usual or historical practices used in the banking and finance industries.

When Debts are Assigned and Sold

If the lender proposes to assign a debt incurred or guaranteed by an individual, then there is the obvious question as to whether the lender in fact has the right to disclose the borrower’s or guarantor’s personal information to the assignee without the borrower’s consent. The right to sell loans and loan portfolios, which is very important to the efficient operation of credit markets, would be greatly restricted if the need to obtain consent is a prerequisite.

Although it was not the fundamental reasoning of the Court in the case of Rodaro v. Royal Bank of Canada, the Ontario Court of Appeal suggested in this 2002 decision that the disclosure of confidential personal information of the borrower or guarantor was essential to the exercise of the bank’s rights under its agreement with the borrower which include the absolute right to assign the loan. It therefore seems that if the bank or lender has the unqualified right to assign the benefit of the loan and security documents, then it will be permitted to disclose the personal information of the borrowers and guarantors as part of the assignment transaction without having to obtain consent.

Information Demands by Bankruptcy Trustees

In a different and more complicated set of circumstances reported in PIPEDA Case Summary 336, a bank received a demand from a trustee in bankruptcy under Section 164(1) of the Bankruptcy and Insolvency Act to disclose the bank’s complete file relating to a mortgage of the bankrupt’s matrimonial home. The property in question was held in co-ownership by the bankrupt and his spouse. In response to the demand, the bank gave over its entire mortgage file, including the tax returns and net worth statements of the spouse. The spouse, of course, objected. In this case, the spouse was neither a borrower nor guarantor of the loan, nor was she herself subject to the bankruptcy proceedings. The bank asserted the following three defenses to the Privacy Commission:

1. The trustee in bankruptcy is not an “organization” carrying on a “commercial activity” and therefore, use and disclosure of the personal information to the trustee in bankruptcy was not covered by PIPEDA. This defense was not successful, which is consistent with the opinion of many commentators that the concepts in PIPEDA of “organization” and “commercial activity” will be very broadly construed.
2. The bank next argued that the exception contained in Section 7(3)(b) of PIPEDA applied. This exception permits an organization to disclose personal information without knowledge or consent if disclosure is for the purpose of collecting a debt owed by the individual to the organization. This “debt collection exception” was also unsuccessful because the mortgage was not in default. This ruling of the Privacy Commissioner suggests that this debt collection exception will be strictly interpreted.
3. The third and last defence of the bank was that because it was compelled to disclose the information by law, it should be entitled to rely on the “legal compulsion exception” in PIPEDA. The bank was required to disclose the information under Section 164 of the Bankruptcy and Insolvency Act, which permits a trustee to demand any person to produce documents that the trustee believes may be property of the bankrupt or which relates to the property of the bankrupt. The “legal compulsion exception” in Section 7(3)(i) of PIPEDA permits disclosure of personal information without knowledge or consent if the disclosure is required by law. Applying this exception, the Privacy Commissioner ruled in favour of the bank and also ruled that the bank was not under an obligation to sort through the personal information in its file to produce only the material which was relevant to the trustee in bankruptcy.

Resulting Implied Right to Collect Personal Information

As a corollary to this successful defense by the bank under the “legal compulsion exception”, the Privacy Commissioner also determined that if an organization is required to disclose information by law, there is an implied right on the part of the recipient of the information to collect that information. Normally, an organization cannot collect personal information without consent.

Summary and Conclusions

From a broader perspective, there has been a concern that the broadly encompassing language of PIPEDA could lead to the heavy-handed application of these privacy laws without sufficient regard or balancing of other interests. While this case before the Privacy Commission is by no means definitive, it does show that the Privacy Commission will carefully examine the circumstances in debtor/creditor relationships when complaints are filed. The denial of the “debt collection exception” in this case shows that the Privacy Commission will carefully examine creditor enforcement actions to ensure that disclosure of information without consent in the course of such actions, are within the four corners of the exception. However, the successful reliance by the bank on the “legal compulsion exception” is important because there are many instances in both the individual credit markets and the corporate credit markets where information disclosure is compelled by law. Section 164(1) of the Bankruptcy & Insolvency Act is just one such example.

For more information, contact Wesley Brown by phone at (416) 368-1744 or by email at wbrown@businesslawyers.com.

© Morrison Brown Sosnovitch LLP, 2007 All rights reserved.