Getting the Customer's Consent

Principle #3: Getting the Customer's Consent

Scotiabank will make a reasonable effort to make sure customers understand how their personal information will be used by Scotiabank. Scotiabank will obtain consent from its customers before or when it collects or uses the personal information. Scotiabank will not attempt to deceive a customer into giving consent.

A customer's consent can be express, implied, or given through an authorized representative. A customer can withdraw consent at any time, with certain exceptions.

Scotiabank may collect, use or disclose personal information without the customer's knowledge or consent in exceptional circumstances where such collection, use or disclosure is permitted or required by law.

3.1 Scotiabank will make a reasonable effort to make sure customers understand how the personal information will be used and disclosed by Scotiabank. It will get the customer's consent before or when it collects, uses, or discloses personal information.

Generally, Scotiabank will seek consent to use and disclose personal information at the same time it is collected. Sometimes, however, Scotiabank may identify a new purpose and it will seek consent to use and disclose personal information for that purpose after the information has been collected.

3.2 Scotiabank will not obtain consent through deceptive practices. It will explain to customers how personal information will be used before they give their consent, except where applicable laws do not require consent.

3.3 Customers can give consent orally, in writing or electronically. They can imply consent through action or inaction. They can also give consent through an authorized representative. Express consent is the preferred form.

Customers can grant consent:

  • Orally, such as when information is collected over the telephone;
  • In writing, such as when completing and signing an application; or
  • Electronically, such as when applying through a computer or electronic communicating device.

Customers can grant implied consent by:

  • Using a Scotiabank Group Member product or service; and/or
  • Not responding to Scotiabank’s offer to have their personal information removed from a direct marketing list. In this case, Scotiabank may assume that the customer consents to the use of the personal information.

Customers can also give consent through an authorized representative, such as a legal guardian or a person with a power of attorney. This is necessary, for example, if Scotiabank cannot obtain express consent from a customer who is a minor, seriously ill, or mentally incapacitated.

Before deciding what form of consent is appropriate, Scotiabank will consider the type of personal information it needs, the reason for its use, and the type of customer contact that is involved.

Customers always have the option to withdraw consent to the use of personal information for marketing purposes.

3.4 Scotiabank can collect or use personal information without the knowledge and consent of the customer in exceptional circumstances where such collection or use is permitted or as required by law.

For example, Scotiabank will not ask for consent when personal information is collected used, or disclosed:

  • In the clear best interests of the customer and consent cannot be obtained in a timely way;
  • When asking for consent may compromise the information sought and collection relates to an investigation of a breach of an agreement or a contravention of Canadian laws, as for example to detect and prevent criminal activity and dealings in proceeds of crime;
  • When the information is publicly available, as defined in applicable laws; or
  • When Scotiabank obtains customer lists from another regulated organization, on the assumption that the organization providing the personal information obtained each customer's consent before disclosing the information to Scotiabank.

3.4.1 Scotiabank can disclose personal information without the knowledge and consent of the customer in exceptional circumstances where such disclosure is permitted or required by law. For example Scotiabank will not ask for consent when personal information is:

  • Given to agents of Scotiabank who need it to carry out business-related functions, such as fulfilment (e.g. mailing follow-up information packages), data processing or the printing of cheques and credit cards, insurance underwriting and/or claims adjudication;
  • Given to its legal representatives;
  • Disclosed for the purpose of collecting an overdue account; and/or
  • Disclosed in order to:
    • comply with a subpoena or warrant;
    • respond to a governmental authority that has lawful authority to obtain the information;
    • facilitate the activities of an investigative body or government institution in dealing with a past, potential or actual breach of an agreement or contravention of the laws of Canada or a province or a foreign jurisdiction; or
    • comply with the law; and/or
    • process or otherwise administer insurance products and to transfer personal information to other insurance companies that share the risk.

3.5 Subject to legal and contractual restrictions, customers can refuse or withdraw consent at any time as long as:

  • Scotiabank is given reasonable notice of the withdrawal;
  • Consent does not relate to a credit product where Scotiabank must collect and report information after credit has been granted. This is to maintain the integrity of the credit system; or
  • Consent does not relate to the underwriting of an insurance policy, or an insurance claim where Scotiabank must collect and report information after the application has been underwritten or the claim has been adjudicated. This is to maintain the integrity of underwriting and claims systems.

Scotiabank will let the customer know the consequences of refusing or withdrawing consent when customers seek to do so. Refusing or withdrawing consent for Scotiabank to collect, use or disclose personal information could mean that Scotiabank cannot provide the customer with some product, service or information of value to the customer.

For example if a customer does not:

  • Allow Scotiabank to get a credit history report, Scotiabank may not be able to lend money to the customer. Prudent lending practices, deposit insurance standards, or other regulations may prevent the Scotiabank Group Member from lending money in this circumstance.
  • Provide the information needed to underwrite an insurance application or adjudicate a claim, Scotiabank may not be able to provide the service to the customer.
  • Provide the information needed to open a securities or investment account or needed to assess the suitability of an investment transaction, Scotiabank may not be able to provide the service to the customer.

Scotiabank will not, however, unreasonably withhold products, services or information from customers who refuse or withdraw consent.

3.6 Scotiabank may ask customers for government identification numbers to match credit bureau information. When Scotiabank asks a customer for a government identification number for this purpose, it will:

  • explain why it is needed;
  • tell customers that they are not required to provide their government identification number to Scotiabank; and
  • ask for consent to use and disclose the government identification number if the customer does provide it.

Scotiabank will not deny credit to a customer just because the customer does not provide a government identification number.

3.7 Should Scotiabank be involved in the provision of an insurance product, Scotiabank may ask a customer for the name of their attending physician in order to obtain additional medical information when necessary for the underwriting of insurance coverage or the adjudication of an insurance claim. When Scotiabank asks a customer for this information, it will:

  • Explain why it is needed; and
  • Tell the customer they are not required to provide the name of their attending physician, however, Scotiabank may deny coverage on the basis they have insufficient information to assess the risk or claim.