But he said it is standard practice to make such loans payable to the franchisor…But Country Style chief executive Patrick Gibbons said he's never heard of such a practice…"A loan agreement is business between the franchisee and the lending party, period," he said.
The Ottawa Citizen
May 14, 2005
Bank springs another privacy leak
CIBC hands client details of other customers' accounts
Andrew Mayeda
Fresh off fax blunders that earned it a rebuke from the federal privacy commissioner, the Canadian Imperial Bank of Commerce admitted yesterday that it mistakenly handed over the personal-account details of more than 100 individuals.
Toronto computer analyst Andrei Oudovikine was handed the account information by a CIBC employee when he requested a printout of his account history in the fall. He approached the Citizen this week with details on the case.
Because he had done few transactions through the account, Mr. Oudovikine was expecting to receive a single sheet of paper. Instead, he received a thick, sealed envelope containing more than 30 pages of personal information on other individuals at his branch in Thornhill, north of Toronto.
The information included names or partial names, account numbers and monthly balance on the other individuals' accounts over nearly two years.
"When I went through the information and saw how much money some people have —some of them just live across the street from me … the next day at 6 a.m. I called the privacy commissioner's office and explained what happened."
After reporting the incident to the privacy commissioner, Mr. Oudovikine was asked to turn over the documents to the commissioner's office, which sent a courier to pick them up and eventually returned them to CIBC.
A spokeswoman for the commissioner's office, Renee Couturier, said it is investigating. She wouldn't elaborate, saying the agency doesn't comment on complaints under investigation.
Privacy commissioner Jennifer Stoddart slammed the bank last month after it misdirected faxes containing customer account information to a West Virginia junkyard and a firm in Dorval, Que., between 2000 and 2004. Her office called it "a serious breakdown in CIBC's privacy practices at the most basic organizational level."
CIBC chief executive John Hunkin apologized to customers for the gaffes, calling any breach of privacy unacceptable.
When customers make requests for account information, transaction journals printed out at the bank's processing centre often include information on other account holders, said CIBC spokesman Rob McLeod. Usually, information not directly related to the customer making the request is removed.
"Unfortunately, that did not happen in this case," Mr. McLeod said in an e-mail.
He said the bank's internal privacy office immediately began an investigation when informed by Mr. Oudovikine about the incident. He also said the bank contacted the privacy commissioner and apologized to Mr. Oudovikine.
But Mr. Oudovikine says he never received an apology and was only contacted by CIBC staff to sign an "acknowledgement" releasing the bank from responsibility.
The bank has contacted customers whose account information was compromised and given them the option to change their account number. It reached "all but a few" whose address had changed, said Mr. McLeod.
"We determined that the risk of fraud was remote based on the limited amount of information that was contained in these documents."
The bank has taken several steps to prevent a recurrence.
Processing-centre staff have been asked to manually double check any information sent directly to customers. When sending customer reports to branches, staff now attach a large cover sheet advising branch staff to review the information.
Frontline staff have been notified about the error and the measures taken.
"Longer term, we are looking at a technology solution that permits us to print off only the requested transaction journals," said Mr. McLeod.
Mr. Oudovikine, 31, has clashed with CIBC before.
He has been embroiled in a dispute with the bank for several years over a small-business loan he secured to start a Country Style Donuts franchise.
He also worked for the bank until 1999 as a computer analyst, though he claims he left on good terms to do contract work.
He is now working on contract for TD Bank Financial Group through IT consultancy M Systems Group Inc.
In 2003, Mr. Oudovikine was issued two loans totalling $232,500 from CIBC through Industry Canada's Small Business Financing Program. But he says the money was transferred without his authorization to Country Style by CIBC. He says he wanted to see a business plan, sales projections and other details about the franchise before transferring the money to Country Style to invest in equipment and other assets.
He ended up with his donut shop, but he says it is losing $30,000 a month.
The loan has also landed him in hot water with the Canada Revenue Agency, which launched an audit last year after he was unable to show how the loan proceeds were spent.
Mr. Oudovikine requested the transaction history on his U.S.-denominated savings account at CIBC when the agency asked for details on all his accounts. He had details on all accounts except the U.S. savings account, which he set up in 2003 and rarely used.
Mr. McLeod said CIBC is also investigating the loan granted to Mr. Oudovikine to start the franchise. But he said it is standard practice to make such loans payable to the franchisor, and noted that bank loan documents make that clear.
But Country Style chief executive Patrick Gibbons said he's never heard of such a practice. He was unaware of any dispute over Mr. Oudovikine's loan.
"A loan agreement is business between the franchisee and the lending party, period," he said.
© The Ottawa Citizen 2005
Brought to you by WikidFranchise.org
Risks: Canadian Imperial Bank of Commerce, CIBC, Fraud, Bank violates federal privacy laws, Privacy Commissioner of Canada, Privacy breaches a prerequisite for fraud, Coerced waiver of legal rights, self, Government guaranteed loans, Predatory lending practices, Industry Canada small business loans, Bank pays franchisor with franchisee's funds, Unauthorized funds transfer by bank, Canada Revenue Agency, Government guaranteed loan made without proper security, Canada, 20050514 Bank springs
