PIPEDA Case Summary #344Couple's safety deposit box opened in error(Principles 4.6 and 4.7.1 of Schedule 1) An opened safety deposit box and a missing wedding tape – these were at the heart of a complaint before the Assistant Privacy Commissioner. A safety deposit box belonging to a couple had been opened by their bank branch in error. The Assistant Commissioner felt that the bank’s security safeguards were not adequate in this case, and the bank took several steps to strengthen its safeguards – measures which the Assistant Commissioner concluded were satisfactory. Although the couple had also alleged that their wedding video, which they claimed was in the box, was lost during the transfer of the box contents to a sealed bag, the Assistant Commissioner could not determine with any degree of certainty that the tape had been in the box in the first place. The following is an overview of the investigation and the Assistant Commissioner’s findings. Summary of InvestigationThe complainants had a number of items in a safety deposit box at their local bank branch. One day, they received a telephone call from the branch informing them that their box had been opened in error. They visited the branch and learned that the contents of their box had been transferred to a bag, which was then sealed and placed in a safe. The complainants stated that they were originally told that the safety boxes from another branch were moved to their branch. As a result, there were two safety deposit boxes bearing the same number. In its representations to our Office, the bank clarified that it was not the case that the complainants and the other customer had the same box number at the same time. The other customer originally had box number 21, but later changed to another box and number. This change, however, was not reflected in the customer’s signature card, which was the only record detailing the box owner’s name and box number. Employees were supposed to check the name of the customer and signature against those contained on the signature card and note the box number listed on that card. When the other customer could not access box 21, the bank employee checked that customer’s signature card which erroneously confirmed that box 21 was rented to that customer. Assuming that the problem was with her key, the bank called in a locksmith, who started to drill. It was at this point that it was noted that the box did not belong to the other customer, but in fact to the complainants. The employees entered the bank vault and emptied the contents of the box into a tamper-proof cash bag. The bag was closed, sealed, stamped and signed as per bank policy. According to the complainants, a few days after learning of the incident and being given access to the contents of their safety deposit box, they realized that their wedding video was missing from the items that had been transferred from the box to the bag. The complainants had not mentioned anything about the video when they were at the bank following the incident. Nevertheless, they were convinced that this tape had been in the safety deposit box. Although the branch had offered them some compensation, the complainants felt this was not sufficient to cover the loss of their personal information. They contacted the bank and voiced their concerns. The bank conducted a search, but could not locate a video tape. It believed that the entire contents of the safety deposit box had been placed in the tamper-proof bag. The bank employees who oversaw the removal of the items from the safety deposit box did not see a video and confirmed that everything in the box was placed directly into the tamper-proof bag. The complainants did not mention the loss of the video until several days after the meeting at the bank, during which they were given access to the contents of their safety deposit box. As a result of this incident, a meeting was held with the appropriate employees of the branch to review policy and procedures with respect to the drilling of safety deposit boxes. Two employees conducted a review of all safety deposit boxes, rental agreements and signature cards of the branch. The employees matched all boxes with the rental agreements and signature cards. The branch also implemented a computer-based system whereby every box number of the branch was entered into a database. All requests for modifications to existing rental agreements or new safety deposit boxes must be directed to either of the employees who conducted the review. All employees of the branch were informed that only these employees are authorized to set up or cancel safety deposit box rentals, and as to access the computer database to make modifications. FindingsIssued July 17, 2006 Application: Principle 4.6 states that personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. Principle 4.7.1 stipulates that the security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Organizations shall protect personal information regardless of the format in which it is held. In making her determinations, the Assistant Commissioner deliberated as follows:
She therefore considered the issue of safeguards and accuracy to be resolved. As for the allegation that the couple’s wedding video tape was lost, the bank conducted a search for the tape and could not find it. Neither of the employees present when the contents were transferred recalls seeing the tape. The complainants insisted, however, that it was there. It could not, however, be determined with any degree of certainty that the tape was or was not in the box. |
Date published: 2006-10-16 |
Important Notices |