45 St. Clair Ave. West, Suite 600
Toronto, Ontario, M4V 1K9
Tel: (416) 925-7400

Bill S-4 (the Digital Privacy Act): Protecting Everyone’s Privacy… except Older Adults?

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private sector organizations that collect, use or disclose personal information in the course of commercial activities.1 The legislation seeks to balance the protection the privacy rights of individuals (what is known about them and by whom) and the legitimate needs of business organizations to manage their information holdings.2

In 2011 the federal government introduced amendments to PIPEDA in the form of Bill C-12, which was drafted, according to Industry Canada, to protect and empower consumers.3

On April 8, 2014 the government introduced Bill S-4, the Digital Privacy Act, which replaces Bill C-12.

If enacted, the Digital Privacy Act will permit banks to disclose personal information, without the consent or knowledge of its customers, to next of kin and government institutions.

The proposed amendments were drafted specifically to assist older adults, yet it appears as though the legislation was developed without any meaningful input from older adults or stakeholders. If enacted, the implementation of the Digital Privacy Act may be discriminatory. As such, it should be substantively re-worded, or abandoned.

Background: PIPEDA’s Exceptions to the Knowledge and Consent Requirements

PIPEDA governs the handling of personal information by the private sector, including banks. Section 7(3) of PIPEDA provides that an organization subject to PIPEDA may disclose personal information without the knowledge or consent of the individual in certain circumstances. For example, disclosure may be made without consent if the disclosure is requested by a government institution for the purpose of law enforcement or related investigation, or if the disclosure is required by law.4

Section 7(3) begins with a preamble that states that it applies for the purpose of section 4.3 of Schedule 1 of PIPEDA, and despite the note that accompanies that clause.

Section 4.3 of Schedule 1 of the Act is reproduced below:

4.3 Principle 3 — Consent

The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Note: In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated. In addition, organizations that do not have a direct relationship with the individual may not always be able to seek consent. For example, seeking consent may be impractical for a charity or a direct-marketing firm that wishes to acquire a mailing list from another organization. In such cases, the organization providing the list would be expected to obtain consent before disclosing personal information.

When read together, the above sections provide that knowledge and consent are always required for disclosure, unless inappropriate, and that disclosure without consent is only permitted in the circumstances set out in section 7(3).

Statutory Review of PIPEDA

Section 29 of PIPEDA requires a statutory review of Part 1 of the Act every 5 years. The first review was completed and tabled by the Standing Committee on Access to Privacy and Ethics (the “Committee”) in 2007.

The Committee heard from numerous stakeholders, primarily from banking, marketing, financial and privacy sectors.

The Canadian Bankers Association (“CBA”) has suggested that bankers would like to alert authorities of their suspicions of financial abuse, but PIPEDA prevents them from doing so. They take the following position:

Bankers feel a moral obligation and are frequently under pressure from public interest groups and public authorities to act on their suspicions of financial abuse, with both elderly and other customers, and to report the suspected abuse to another family member or authorities. Yet s. 7(3) of PIPEDA does not allow such disclosure without the customer’s consent, which is difficult to request in this type of situation.”5

The Committee summarized the Canadian Bankers’ Association’s submissions as follows in its report:

The Canadian Bankers Association (CBA) raised the issues …were also concerned about the incidence of elder financial abuse and the inability of PIPEDA to address this problem. Mr. Warren Law of the CBA outlined the banks’ concern:

An example of such a situation in the banking context is where a banker suspects financial abuse, particularly with seniors, and when a customer is withdrawing money from his or her account and it appears that the customer may be under pressure from the person accompanying him or her, or the withdrawal is uncharacteristic of that person.

Prior to PIPEDA, under common law, banks were able to disclose their suspicions about abuse to the authorities, to the vulnerable customer’s family, or to another responsible person who might be able to investigate and stop any abuse. Financial abuse of the elderly is a significant issue in Canada. The public and families of such customers expect bankers to help prevent any abuse. Under the current legislation, though, while branch employees want to help, they are not allowed to because there are no exceptions that cover such situations. We are recommending an exemption for disclosure without consent when it is in the public interest. (January 30, 2007)

The CBA recommends that section 7(3) of PIPEDA be amended to permit disclosure of personal information to appropriate authorities, next of kin or a designated contact for the individual when the release of that information is in the individual’s or the public’s interest.6

There is no record of submissions made to the Committee by or on behalf of individuals or organizations representing the interests of older adults. If such submissions were invited and received, they do not form part of the public record provided on the legislative summary in respect of Bill C-12, the precursor to Bill S-4.

BILL S-4: Proposed Amendments to PIPEDA

Bill S-4 will amend sections 7(3) to permit banks to disclose information without the knowledge or consent of its customers, when such disclosure is:

(d.3) made on the initiative of the organization to a government institution, a part of a government institution or the individual’s next of kin or authorized representative and

(i) the organization has reasonable grounds to believe that the individual has been, is or may be the victim of financial abuse,

(ii) the disclosure is made solely for purposes related to preventing or investigating the abuse, and

(iii) it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the ability to prevent or investigate the abuse;

The proposed amendments raise two concerns:

  1. The statutory waiver of consent in section 7(3)(d.3)(i) is intended to apply to older adults and, as such, may be discriminatory, and
  2. The list of people and organizations that may receive disclosure without consent is unnecessarily broad and not necessarily helpful.

Section 7(3) of PIPEDA pertains to the waiver, in prescribed circumstances, of PIPEDA’s statutory consent and knowledge requirements. The proposed amendments at s. 7(3)(d.3) arise from the Canadian Bankers Associations submissions about its concerns regarding financial abuse, “particularly with seniors.”7 We are not aware that the Government invited or received input from any organizations representing the views of older adults regarding these amendments.

If the Government agrees with the Canadian Bankers Association that PIPEDA must be amended to permit disclosure of private information in circumstances of suspected financial abuse, such amendments do not belong in section 7(3), where the statutory waiver of consent is in effect.

The right to privacy and the application of the fair information obligations set out in PIPEDA should apply equally to all banking customers, regardless of their age. Unless and until an individual is found to lack capacity to manage their property, he or she is free to make decisions regarding their finances. If a banker thinks that a given transaction is “uncharacteristic,” his or her first step should not be the disclosure without the consent. The first step of any concerned banker should always be to discuss the matter directly with his or her client.

With respect to the list of individuals or organizations who may be notified of the bank’s concerns, the list is unnecessarily broad, and potentially harmful. It is unclear why any bank should, in any circumstances, report concerns about financial abuse to anyone other than the police. Financial abuse, whether in the in the form of theft, extortion, or fraud, is a crime and should be reported to the police. The Act may be interpreted to mean that financial abuse is not a reportable offence if the alleged victim is an older or vulnerable adult. Instead, the Act seems to suggest that in such circumstances, concerns about financial abuse should be reported to next of kin or authorized representatives.

Sadly, the perpetrators of financial abuse, and in particular, the financial abuse of older adults, are often next of kin or authorized representatives.8 Disclosure of information to next of kin or authorized representatives without the knowledge or consent of the alleged victim, as contemplated in (d.3), may therefore alert the perpetrator to the bank’s awareness of the abuse, which may increase the likelihood of further harm to the alleged victim.

Conclusion

The Canadian Bankers Association and the Government are right to be concerned: the financial abuse of older adults is an appalling crime and an increasing societal concern.

Amendments to PIPEDA, if properly drafted with the input of those individuals who are the focus of those amendments, may assist the financial sector and other stakeholders in reducing the occurrence of financial abuse. However, the rights of older adults should not be compromised to ensure their protection.

We hope the federal government will reconsider its current approach and invite the input of older adults and other stakeholders in the drafting of amendments to PIPEDA.


1. Standing Committee on Access to Information, Privacy and Ethics, “Statutory Review of the Personal Information Protection and Electronic Documents Act (PIPEDA),” May 2007, 39th Parliament, 1st session.

2. Ibid.

3. Ibid.

4. Personal Information Protection and Electronic Documents Act, SC 2000, c 5, (c.1), section 7(3).

5. Submission by the Canadian Bankers Association to Industry Canada: Implementation of the Government of Canada’s Response to the Fourth Report of the Standing Committee on Access to Information, Privacy and Ethics on the Personal Information Protection and Electronic Documents Act, January 15, 2008.

6. Ibid.

7. Supra note 5.

8. R. v. Kaziuk, 2011 ONCJ 851; R. v. Webb, 2011 SKPC 181; R. v. Taylor, 2012 ONCA 809; Nguyen-Crawford v. Nguyen, 2010 CarswellOnt 9492; Johnson v. Huchkewich, 2010 CarswellOnt 8157; McMaster v. McMaster, 2013 ONSC 1115; see also Law Commission of Ontario, “A Framework for the Law as it affects Older Adults:  Advancing Substantive Quality of Older Persons through Law, Policy and Practice” (Toronto:  April 2012); Alberta Law Reform Institute, “Enduring Powers of Attorney: Safeguards Against Abuse” (Edmonton: February 2003).

Author

Previous Post:
Next Post:
Click here or on top Blog logo to return to Blog front page.

Search Blog by Keyword(s)

Site Search

Site Map