Privacy Act Blocks Creditor’s Enforcement of Writ of Seizure And Sale

A recent Ontario Court of Appeal judgment focuses on interpreting federal privacy legislation, and whether a mortgage discharge statement is “information about an identifiable individual” which is protected from disclosure without the borrower’s consent.

The Trangs were in default on their mortgage with Scotiabank. They also defaulted on a loan with Royal Bank of Canada (“RBC”), which obtained court judgment against them for about $26,000. RBC filed a writ of seizure and sale, but faced with the Trangs’ non-cooperation in the enforcement process, it asked the sheriff to sell the Trangs’ property so that it could collect on its judgment. The sheriff refused to do so unless Scotiabank could provide a mortgage discharge statement. Scotiabank, in turn, claimed it was precluded from doing so without the Trangs’ consent, citing the Personal Information Protection and Electronic Documents Act (“PIPEDA”), which legislation is designed to protect individuals’ right to privacy in their personal information.

RBC failed on a motion for a court order compelling Scotiabank to produce the statement; it then appealed to the Ontario Court of Appeal. Its position was that the mortgage statement it sought from Scotiabank was not “personal information” within the meaning of PIPEDA.

A 5-member panel of the Court of Appeal considered these arguments and, in a 3-2 split decision, disagreed with RBC. First, the court confirmed that the mortgage discharge statement – which is not otherwise publicly available – amounts to “personal information” that under PIPEDA should not be disclosed without the Trangs’ approval. As the court put it:

Undoubtedly, the amount the Trangs owe on their mortgage is, to them, personal information... The balance owing on a person’s mortgage can be an important piece of private information that opens a window to many aspects of that person’s financial profile. It indicates financial worth. It measures how a person deals with financial liabilities. It opens a portal to a person’s financial stability or instability. ...

Under PIPEDA, this type of personal information could be disclosed by Scotiabank “only for purposes that a reasonable person would consider are appropriate in the circumstances.” This approach demonstrates the Act’s goal of balancing individuals’ right to privacy against the needs of organizations such as Scotiabank – not third-parties such as RBC – to collect, use, and disclose information in its commercial activities.

Any disclosure by Scotiabank would ordinarily require the Trangs’ consent, which is normally obtained at the time the information is collected. Admittedly, PIPEDA does acknowledge that “implied consent” might be appropriate when the information is “less sensitive”, but that sensitivity assessment is still highly context-dependent, and is evaluated against the overall relationship between Scotiabank and the Trangs. Scotiabank simply cannot invoke the implied consent option in order to advance the interests of a third party such as RBC.

Finally, the reasonable expectations of the Trangs had to be factored in: the discharge statement contained sensitive financial information that the Trangs would not have expected Scotiabank to disclose to a third party without their consent – and for a purpose unrelated to enforcing the original mortgage. The court also noted that RBC, in hindsight, could also have obtained the Trangs’ advance consent for disclosure, by inserting a term in the loan agreement, which it did not do.

In the end, the information in a mortgage discharge statement was held to be sensitive personal information, and disclosure by Scotiabank to third-party judgment creditors like RBC would legally require the Trangs’ express consent. Absent such consent or a court order, Scotiabank’s disclosure would be in breach of the provisions of PIPEDA. See Royal Bank of Canada v. Trang, 2014 (ONCA).