Record Keeping: Keeping Clients Out of the Trash

Recently Alberta’s Privacy Commissioner began an investigation after boxes of mortgage brokerage files containing personal client information, including social insurance numbers and mortgage values, was discovered in a garbage bin.

Identity theft continues to create thousands of new victims every year in Canada, and the easiest way to obtain the personal information required to perpetrate identity theft has proven to be dumpster diving. The Royal Canadian Mounted Police has even gone so far as to call trash bins a “goldmine” for identity thieves.

The Real Estate Act Rules (the Rules), section 44 states:

Protection of Client Information

44(1) In addition to the requirements of relevant legislation on the protection of personal information, an industry member must not disclose information regarding a client, property or transaction to another person unless:
 
(a) authorized by the client, or;
 
(b) required by law.

44(2) Each real estate brokerage, mortgage brokerage, real estate appraiser and candidate will:
 
(a) establish adequate policies and procedures for the maintenance and protection of personal and confidential information; and
 
(b) ensure all industry members registered with the brokerage and any staff members are aware of the policies and procedures referred to in (1) above and routinely carry them out in the course of their work.

It is important to recognize the obligation to keep a client’s information confidential is ongoing. In other words, the obligations outlined in section 44 of the Rules continue after the industry member has ceased to provide services to the client under the service agreement

The Real Estate Act s.25(9) requires mortgage brokers to keep their records of mortgage brokerage activities (mortgage deals and potential deals) and accounting records for a minimum of three years after they came into existence.

Additionally, though, all businesses and organizations in Alberta must adhere to Alberta’s Personal Information Protection Act, including section 35(2), which reads:

35(2) Within a reasonable period of time after an organization no longer reasonably requires personal information for legal or business purposes, the organization must
            (a) destroy the records containing the personal information, or
            (b) render the personal information non‑identifying so that it can no longer be used to identify an individual.

Industry professionals interested in moving to a system of paperless record-keeping should review the Real Estate Council of Alberta’s Information Bulletin on Electronic Records.

For more information about record-keeping requirements and protection of client information, check out RECA’s Information Bulletins for Protection of Client Information and Records – Mortgage Brokerage.