How much will you get if the bank reveals your secrets?
A woman who took out a protection order against her ex-husband got just $550 from her bank after the man's new love used her bank job to snoop on the woman.
Another bank paid a woman $850 after it perused two years' worth of her medical records without proper consent, when it only needed to know about one diagnosis.
Having your privacy breached by a bank is seldom a route to riches.
But if you suffer direct financial loss, the banking ombudsman's office says it will award compensation to cover it.
You might get $500 to $2000 if a bank creates a significant inconvenience, distress or embarrassment by wrongly spilling your personal details, says the ombudsman's office.
"We only consider awarding more in exceptional circumstances."
So what constitutes an exceptional case?
Banking ombudsman Deborah Battell points to the case of Ms F, who escaped a violent relationship, changed her name by deed poll and moved from the North to the South Island to try and feel safe from her ex.
Sadly, the bank continued sending her ex her bank statements, despite the former couple no longer having a joint account.
The ombudsman went to the limit of her powers, advising the bank to do whatever it took to make Ms F feel safe again. The bank paid for installing and monitoring a security alarm and putting in a new fence and safety lighting at her house at a total cost of about $11,000. Ms F also received an award for inconvenience of $4000.
Asked about the woman who got a measly $550, Battell says the crucial factor in that case was timing.
The woman, known as Mrs K, got a protection order against her husband and took her kids out of town for a few weeks to get away from him. She became suspicious that her ex's new partner had looked at her bank account. The bank checked. She had.
Battell says it was crucial that at the time the snooping happened Mrs K was not yet afraid for her safety. The ombudsman ruled there was no link between her fears for her safety and the ex's new love's dubious actions. The new lover seemed more interested in gauging her finances for child support than tracking her location, as Mrs K feared.
Battell says it would have been different had Mrs K's safety been compromised, or if the breach had happened later after Mrs K became afraid. "Had it compromised her safety it would have been completely and utterly different. It would absolutely be at the top end of the scale and we can award about $9,000," she says.
In Canada, Bank of Montreal customer Sandra Jones won C$10,000 (NZ$10,600) after her ex-husband's new love, also a bank employee, looked at Jones' accounts, in a case seemingly similar to Mrs K's. Unlike Mrs K, Jones' had no safety fears but on the other hand her ex-partner's new girlfriend checked her accounts many more times - a whopping 174 times.
Jones took a costly and time-consuming Canadian court case.
But here, complaining to the banking ombudsman is free and it doesn't stop you later complaining to the Privacy Commissioner's office or even going to court.
Battell says her office often consults the Privacy Commissioner's office, as it did before supporting Mrs K's $550 payout. Sometimes she refers more serious cases there at the outset. Or you can try there later if you don't like the ombudsman's recommendation.
The only thing to stop you is if you have already accepted a settlement from the bank, says Battell.
"What I would say is I don't think our settlements are out of kilter. We talk to the Privacy Commissioner about what is reasonable"
If the Privacy Commissioner's office can't broker an outcome it may refer you to the Director of Human Rights Proceedings, who can pass your case to the Human Rights Review Tribunal.
That's where former credit union employee Karen Hammond won a whopping $168,000 dollars for severe privacy breaches and humiliation after baking a rudely-iced cake for a joke.
Before you get excited, that case exploded all previous records and involved an employer whose behaviour was extreme.
A more typical payout in banking cases is the $500 one bank forked over when it awkwardly sent a woman's bank statement showing a healthy account balance to a friend she'd just turned down for a loan. (To be fair her friend broke the law by opening her mail).
Or the $1000 another bank paid after sending a woman's account statement to her ex-husband, when the pair were in the midst of negotiating a relationship property settlement.
Getting a handle on what to expect is tricky, since bank privacy complaints are not common and many complainants sign confidential settlements.
Banks are bound not just by privacy law but by a wider duty of confidence, which can help situations where a bank might have squeaked through without penalty under the Privacy Act.
Bankers Association chief Kirk Hope says there are few times when a bank can legally divulge your information: "You've got compulsion by law, a public duty to divulge the information, or where a bank has to disclose information to protect its own interests , for example in a court case. Or where the customer agrees to it, for example letting their information be used for marketing purposes." Even divulging details to police can be challenged, if police don't have a warrant.
"Bear in mind that bank staff do have to access all sorts of your information at different times but overarching that is the duty of confidentiality," says Hope.
People often want to know what happens to bank staff who look at their accounts when they shouldn't. Banks won't tell them, ironically to protect staff privacy.
But Hope says the consequences for staff tend to be serious, including termination. "They are extremely serious breaches so in all likelihood an employee acting in that manner would be breaching their conditions of employment."
We perused some cases where wronged customers got payments, and, where possible, listed the settlements.
1 The landlord
Mr and Mrs J's landlord worked for a bank and they suspected she was viewing their transactions. The bank confirmed their suspicions and offered Mr and Mrs J $2000, which they thought was too low given the stress they were suffering from the landlord's alleged bad behaviour, including stealing their jewellery, spreading rumours and forcing them to move out suddenly. The banking ombudsman concluded the bank could not be held wholly responsible for the landlord's alleged actions that were unrelated to the privacy breach. It said $2,000 was reasonable.
2 The bad break-up
Mrs T had a bad breakup with her husband and moved to a gated community. She did not tell her ex where she lived. But after she asked the bank to top up a loan it mistakenly sent her ex-husband a letter confirming that he was the loan's guarantor and revealing her new address. The ex didn't try to contact Mrs T but she was still upset. The ombudsman backed the bank's offer of $1500 for inconvenience plus reimbursement for three hours of work she missed.
3 Bad breakup 2
A bank employee looked at Mr Z's account and passed the details to his estranged wife, who as a result demanded an extra $80,000 as part of a relationship property settlement. The ombudsman said the wife could have found out his bank balances legitimately through the relationship settlement process anyway but suggested $1000 for inconvenience was fair.
4 The credit check
This one was decided by the Privacy Commissioner. A married couple applied to open a savings account and the bank carried out a credit check without permission. The couple were turned down to open an account and later tracked down at their respective workplaces by debt collectors using workplace contact details the bank had supplied when requesting the credit check. The commissioner said the bank did not need to pass on the employment details to get a credit check and, anyway, did not not have permission to do a check. The bank made them a confidential payment.
5. The nosy teller
This is another Privacy Commissioner case. This time the bank proactively discovered the leak and alerted the customer. A teller had looked at a couple's account 58 times for no valid reason and passed the information to one of the couple's former partner. They had to change bank accounts and felt very stressed. The settlement reached "several thousand dollars" but the amount was confidential.
6. Confidence breach
This one involves Privacy Commissioner John Edwards when he worked as a lawyer before becoming commissioner. A bank let one of its staff take transaction information about a customer into a judicial hearing about a dispute between the employee and the customer. The bank argued it was safe from the Privacy Act because the information was needed for court proceedings. The customer sued for common law breach of confidence. Edwards, who has written about the case, said there was a "very handsome settlement" for his client but did not reveal the amount.