The Scotiabank Group Member will make a reasonable effort to make sure customers understand how the personal information will be used by the Scotiabank Group Member. The Scotiabank Group Member will obtain consent from its customers before or when it collects or uses the personal information. The Scotiabank Group Member will not attempt to deceive a customer into giving consent.

A customer's consent can be express, implied, or given through an authorized representative. A customer can withdraw consent at any time, with certain exceptions.

The Scotiabank Group Member, may however collect, use or disclose personal information without the customer's knowledge or consent in exceptional circumstances where such collection, use or disclosure is permitted or as required by law.

3.1 The Scotiabank Group Member will make a reasonable effort to make sure customers understand how the personal information will be used and disclosed by the Scotiabank Group Member. It will get the customer's consent before or when it collects, uses, or discloses personal information.

Generally, the Scotiabank Group Member will seek consent to use and disclose personal information at the same time it is collected. Sometimes, however, the Scotiabank Group Member may identify a new purpose and it will seek consent to use and disclose personal information for that purpose after the information has been collected.

3.2 The Scotiabank Group Member will not attempt to deceive customers into giving consent. It will explain to customers how personal information will be used before they give their consent.

3.3 Customers can express consent orally, in writing or electronically. They can imply consent through action or inaction. They can also give consent through an authorized representative. Express consent is the preferred form.

Customers can express consent:

• Orally, such as when information is collected over the telephone.
• In writing, such as when completing and signing an application.
• Electronically, such as when applying through a computer or electronic communicating device.

Customers can imply their consent by:

• Using a Scotiabank Group Member product or service.
• Not responding to the Scotiabank Group Member's offer to have their personal information removed from a direct marketing list. In this case, the Scotiabank Group Member may assume that the customer consents to the use of the personal information.

Customers can also give consent through an authorized representative, such as a legal guardian or a person with a power of attorney. This is necessary, for example, if the Scotiabank Group Member cannot obtain express consent from a customer who is a minor, seriously ill, or mentally incapacitated.

Before deciding what form of consent is appropriate, the Scotiabank Group Member will consider the type of personal information it needs, the reason for its use, and the type of customer contact that is involved.

3.4 The Scotiabank Group Member can collect or use personal information without the knowledge and consent of the customer in exceptional circumstances where such collection or use is permitted or as required by law.

For example the Scotiabank Group Member will not ask for consent when personal information is collected used, or disclosed in instances, such as:

• In the clear best interests of the customer and consent cannot be obtained in a timely way.
• When asking for consent may compromise the information sought and collection relates to an investigation of a breach of an agreement or a contravention of Canadian laws, as for example to detect and prevent criminal activity and dealings in proceeds of crime.
• The Scotiabank Group Member will not ask for consent when personal information is collected or used if it is regulated public information.
• When the Scotiabank Group Member obtains customer lists from another regulated organization, the Scotiabank Group Member will assume that the organization providing the personal information obtained each customer's consent before disclosing the information to the Scotiabank Group Member.

3.4.1 The Scotiabank Group Member can disclose personal information without the knowledge and consent of the customer in exceptional circumstances where such disclosure is permitted or required by law. For example the Scotiabank Group Member will not ask for consent when personal information is:

• Given to agents of the Scotiabank Group Member who need it to carry out business-related functions, such as fulfillment (e.g. mailing follow-up information packages), data processing or the printing of cheques and credit cards, insurance underwriting and/or claims adjudication.
• Given to its legal representatives.
• Disclosed for the purpose of collecting an overdue account. 
• Disclosed in order to:
  • comply with a subpoena or warrant.
  • respond to a lawful authority for lawful purposes.
  • facilitate the activities of an investigative body or government institution in dealing with a past, potential or actual breach of an agreement or contravention of the laws of Canada or a province or a foreign jurisdiction; or
  • comply with the law;
  • disclosed if it is regulated public information.
  • (for insurance products) transferred to other insurance companies that share the risk

3.5 Subject to legal and contractual restrictions, customers can refuse or withdraw consent at any time as long as:

• The Scotiabank Group Member is given reasonable notice of the withdrawal.
• Consent does not relate to a credit product where the Scotiabank Group Member must collect and report information after credit has been granted. This is to maintain the integrity of the credit system.
• Consent does not relate to the underwriting of an insurance policy, or an insurance claim where the Scotiabank Group Member must collect and report information after the application has been underwritten or the claim has been adjudicated. This is to maintain the integrity of underwriting and claims systems.

The Scotiabank Group Member will let the customer know the consequences of refusing or withdrawing consent when customers seek to do so. Refusing or withdrawing consent for the Scotiabank Group Member to collect, use or disclose personal information could mean that the Scotiabank Group Member cannot provide the customer with some product, service or information of value to the customer.

For example if a customer does not:

• Allow the Scotiabank Group Member to get a credit history report, the Scotiabank Group Member may not be able to lend money to the customer. Prudent lending practices, Canada Deposit Insurance Corporation standards, or other regulations may prevent the Scotiabank Group Member from lending money.
• Provide the information needed to underwrite an insurance application or adjudicate a claim, the Scotiabank Group Member may not be able to provide the service to the customer.
• Provide the information needed to open a securities or investment account or needed to assess the suitability of an investment transaction, the Scotiabank Group Member may not be able to provide the service to the customer.

The Scotiabank Group Member, however, will not unreasonably withhold products, services or information from customers who refuse or withdraw consent.

3.6 The Scotiabank Group Member may ask customers for Social Insurance Numbers (SIN) to match credit bureau information. When the Scotiabank Group Member asks a customer for a SIN for this purpose, it will:

• explain why it is needed.
• tell customers that they are not required to provide their SIN to the Scotiabank Group Member.
• ask for consent to use and disclose the SIN if the customer does provide it.

The Scotiabank Group Member will not deny credit to a customer just because the customer does not provide a SIN.

3.7 A Scotiabank Group Member involved in the provision of an insurance product may ask a customer for the name of their attending physician in order to obtain additional medical information when necessary for the underwriting of insurance coverage or the adjudication of an insurance claim. When the Scotiabank Group Member asks a customer for this information, it will:

• Explain why it is needed.
• Tell the customer they are not required to provide the name of their attending physician, however, the Scotiabank Group Member may deny coverage on the basis they have insufficient information to assess the risk or claim.