The CBA Code, like the Quebec legislation, requires that the purpose for which the information is collected and the uses to be made of it identify the categories of employees with access. The CMA Code refers to preventing unauthorized access to customer information. About half of bank branches said access to personal information given to open a chequing account was restricted to tellers and advisors. The advisor category presumably opens the door to the cross-marketing of other products and services. Access by others outside the business should not occur without the consent of the person concerned.
All regimes require consent for secondary uses.
Nearly all respondents said their company did not sell or exchange customer lists with other companies. The two bank branches which said they did sell or exchange their lists also said the customers' consent was requested. One caisse and two Zellers outlets did not know whether customer lists were sold or exchanged. In financial institutions, more than four fifths of bank respondents and two thirds of credit union respondents had been trained while four fifths of caisses respondents had not. In non-financial services, none of Air Canada respondents and only one third of Zellers respondents had received training.