P2015-ND-67

During the course of employment with Royal Bank of Canada, an individual accessed client profiles as part of his mandated employment duties, including “[c]lient information [that] may be collected, used and shared by and between Royal Bank” and the Organization. During this legimitate access to client profiles for the period of November 2013 to April 6, 2015, it appears the individual copied some client information. Some of the information was used for unauthorized transactions on client accounts. In two cases, the client information of Alberta residents was disclosed to third parties. The third parties used the information to open bank accounts, redeem funds from investment accounts, and attempt withdrawals (in one case, the attempt was successful). The employee resigned on April 6, 2015.