Today’s Court of Appeal for Ontario judgment in Citi Cards Canada Inc. v. Pleasance, 2011 ONCA 3 (Ont. C.A.) is an important victory for judgment debtors and upholds debtor privacy rights under Ontario’s Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, (“PIPEDA”). The appeal dealt with the issue of whether a judgment creditor is entitled to obtain a mortgage statement, unrelated to the judgment debt, from a third-party creditor of the debtor so that the judgment creditor is able to pursue a legal remedy to enforce its judgment.
The appellant, Citi Cards, held a credit card-related judgment in the amount of $11,039.77 against the respondent, Pleasance , which it sought to enforce via a sheriff’s sale of the Pleasance home. The Sheriff refused to enforce the writ of execution unless provided with mortgage discharge statements from the mortgagees of the property, The Canada Trust Company and The Toronto-Dominion Bank; neither of whom were willing to disclose without prior written consent of the mortgagors.
The application judge dismissed Citi Cards’ application for an order requiring the mortgagees to produce the statements on the basis that they contained “personal information” of the judgment debtor, which was prohibited under section 7 of PIPEDA. Price, J. further ruled that Citi Cards had an alternative remedy under Rule 60.18(6) of the Rules of Civil Procedure to examine the debtor’s wife, who was also joint owner of the home. The application was adjourned to allow her to be be served with notice of the proceeding, since her privacy interests were potentially affected as well.
Blair J.A. (Juriansz and LaForme JJ.A. concurring) dismissed the appeal.
Justice Blair read the definition of “private information” expansively and the statutory exemptions under PIPEDA restrictively:
“ Whether the provisions of PIPEDA prohibit the Banks from disclosing the mortgage statements to the appellant depends upon whether the information contained in the sought-after mortgage statements is “personal information” within the meaning of the Act and whether any of the PIPEDA exemptions apply to permit disclosure. These questions must be assessed in light of the purpose of the legislation, which is stated in s. 3 to be the following:
The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
 In short, PIPEDA seeks to balance the privacy rights of individuals in their own personal information with the needs of organizations to collect, use or disclose personal information for reasonable purposes. Generally speaking, in my view, those “reasonable purposes” will relate to the needs of the organization.
 PIPEDA prohibits organizations from disclosing personal information without the knowledge or consent of the affected individual unless disclosure is permitted by one of the exemptions provided in s. 7(3). Here, Citi Cards relies upon two of those exemptions, namely that the disclosure is required to comply with an order of the court (para. (c)) and that disclosure is required by law (para. (i)).
 The relevant portions of s. 7(3) state:
For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if disclosure is
(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;
(i) required by law.
 It is accepted that PIPEDA applies to banks: see Royal Bank of Canada v. Welton (2009), 93 O.R. (3d) 403 (C.A.); Vanderbeke v. Royal Bank of Canada (2006), 294 F.T.R. 216; Officer of the Privacy Commissioner of Canada, PIPEDA Case Summary #2005-312. This is consistent with s. 4(1) of the Act, which states in part:
4(1) This Part applies to every organization in respect of personal information that
(a) the organization collects, uses or discloses in the course of commercial activities[.]
 As the application judge noted, “[t]he Banks collect and use the kind of information they possess about Mr. Pleasance in the course of their commercial activity of mortgage lending.'”
Justice Blair adds,
 … Had Parliament intended that organizations would be required to disclose personal information of an individual in circumstances where, in a commercial context, the individual might be required to do so, it could easily have dispensed with the need for consent and created another exemption in those circumstances. Parliament did not do so. Moreover, if the appellant’s argument is correct, any organization could disclose personal financial information about the individual to interested third parties, without that individual’s consent, any time there is an outstanding judgment against the individual. Such a result would effectively negative the protection afforded to the privacy rights of individuals pursuant to PIPEDA.
Although not cited, the Court of Appeal’s reasoning comports with its previous decision in Murano v. Bank of Montreal (1998), 41 O.R. (3d) 222 , 163 D.L.R. (4th) 21 (Ont. C.A.), which dealt with, inter alia, a claim for breach of confidentiality against a bank:
 In Crawford and Falconbridge, Banking and Bills of Exchange, 8th ed. (1986) at p. 802 it is said that the law respecting a bank’s duty of confidentiality to its customer is stated in the headnote to Tournier v. National Provincial Bank,  1 K.B. 461 (C.A.) which “is the leading case in England and throughout the Commonwealth …” The headnote reads:
It is an implied term of the contract between a banker and his customer that the banker will not divulge to third persons, without the consent of the customer, expressed or implied, either the state of the customer’s account, or any of his transactions with the bank, or any information relating to the customer acquired through the keeping of his account, unless the banker is compelled to do so by order of a Court, or the circumstances give rise to a public duty of disclosure, or the protection of the banker’s own interests require it.
 It might be thought that the gravamen of Mr. Murano’s complaint was not so much that confidential information was disclosed but, rather, that the “information” that was disclosed was both wrong and harmful to him. It was defamatory. This part of the case was not pleaded, nor argued, as one of defamation and so I will say nothing further on this. (It may be noted that in the leading case of Tournier two causes of action were pleaded, slander and breach of confidentiality.) At the very least, the statement of what Mr. Murano had done, which was not true, takes this case out of the exception to Tournier upon which the bank relies.”
In the end, the Court of Appeal reiterated that a creditor should exhaust all other reasonable means available before a rule 60.18(6)(a) order is made: see C.I.B.C. v. Sutton (1981), 34 O.R. (2d) 482 (C.A.): Bock v. Fairborn (1990), 40 C.P.C. (2d) 277 (Ont. Dist. Ct.); Parks v. Sullivan (1982), 29 C.P.C. 124 (Ont. Master); Bank of America Trust and Savings Assn. v. Shefsky (1997), 24 C.P.C. (4th) 135 (Ont. Gen. Div.); Blastco Corp. v. Pittman Environmental Technologies Inc. (2001), 10 C.P.C. (5th) 106 (Ont. S.C.).