Pursuant to the Budget Implementation Act, 2024, No. 1, passed on June 20, 2024, reporting entities subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act ("PCMLTFA"), including banks and other institutions, are to be permitted to share an individual's personal information with each other, without the individual's knowledge or consent, for the purpose of detecting or deterring money laundering, terrorist activity financing or sanctions evasion. This permission will be set out in the PCMLTFA, with consequential amendments to be made to the Personal Information Protection and Electronic Documents Act ("PIPEDA"). The amendments will come into force on a date to be fixed by order in council.
Such information sharing will be governed by at least three conditions:
- The information must have been collected in the course of the entity's activities;
- The disclosure is reasonable for the purpose of detecting or deterring money laundering, terrorist activity financing or sanctions evasion; and
- Making the disclosure with the individual's knowledge or consent would risk compromising the ability to detect or deter money laundering, terrorist activity financing or sanctions evasion.
Further conditions are expected to be added by way of regulation, including conditions on how the shared information is to be disclosed, received and used.
The Act even protects the sharing entities from "criminal or civil proceedings" provided the information is disclosed in good faith and in accordance with the above conditions.
This marks a significant expansion in financial institutions' right to share personal information without the consent of the individuals concerned. At present, protecting personal information is the rule, while disclosure without consent is the exception. The exceptions currently in force in PIPEDA are limited, among others, to information that is necessary to detect, suppress or prevent fraud and, in Quebec legislation, to cases in which an individual has committed or is about to commit an offence against the receiving entity. To our knowledge, no corresponding amendments to Quebec legislation governing the protection of personal information are currently anticipated. It will be interesting to see how the potentially more stringent restrictions under Quebec legislation interact with the expanded sharing to be permitted under the PCMLTFA and PIPEDA.
Expanding the right to share information among financial institutions is part of intensified anti-money laundering measures. Many countries have already implemented legal frameworks allowing financial institutions to share personal information securely. In the United States, for instance, such sharing was authorized over 20 years ago when the U.S. Congress passed the Patriot Act. In the United Kingdom, recent pilot projects allow banks and the UK National Crime Agency to systematically share information pertaining to serious economic crimes, such as violations of economic sanctions. These developments illustrate legislators' willingness to ensure that recent reforms to legislation governing the protection of personal information do not hinder anti-money laundering initiatives.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
