A file that stayed inside your own head for weeks suddenly has to move — to the lawyer closing the deal, the lender underwriting it, maybe the other side’s brokerage. Two separate rules govern that handoff, and they don’t say the same thing.
Key takeaways
PIPEDA’s meaningful-consent guidance is specific about what a client needs to be told before information moves: “with whom” it will be shared, spelled out with real precision, alongside what is collected and why. A client who agreed generally to “working with your brokerage” has not necessarily consented to their financial details reaching every party who touches the transaction — the disclosure has to be something they could reasonably anticipate, or it needs its own, more specific consent.
Ontario registrants operate under a second, more specific layer. RECO’s confidentiality bulletin states plainly that “brokerages and real estate agents must not disclose any confidential client information to a third party without the client’s written consent” except where legally required, and that any consent to share must answer what information, who receives it, the purpose, and who benefits. RECO’s own consumer-facing Information Guide names two categories specifically as protected: “your motivation for buying or selling” and “the amount you would be willing to pay or accept” — and the duty is explicit that it survives the client relationship: the Guide states confidential information cannot be shared outside the brokerage “without your written consent, except where required by law, even after your client relationship ends.” Written consent, not a verbal understanding, is the standard both sources set.
Not every third party sits in the same category. Sending the completed file to the lawyer who is actually closing the transaction is generally the kind of disclosure a client would reasonably expect as part of buying or selling a property — it’s squarely inside what PIPEDA’s consent guidance calls a person’s reasonable expectations, the factor that determines whether implied consent is enough or express consent is required. An unrelated third party — a lender the client hasn’t engaged, a service provider outside the transaction, a colleague at another brokerage fishing for a referral — sits outside that expectation, and RECO’s written-consent standard applies without the same cushion.
RECO’s bulletin asks any consent to share to specify four things: what information, who gets it, for what purpose, and who benefits from the disclosure. A blanket “you may share my file as needed” line buried in an intake form is unlikely to meet that standard — the whole point of naming all four elements is that the client actually understands the specific disclosure being authorized. Once consent is in place, how the file travels matters too: PIPEDA’s safeguards principle (see securing the phone that holds your business) applies to the transfer itself, not only to storage — a secure, traceable method beats an unencrypted email attachment or a text thread for anything containing financial or identification details.
The other side’s agent is not a routine third party, and RECO governs what can be shared with them through a distinct rule rather than the general confidentiality bulletin alone. The Information Guide is explicit that a buyer who has made an offer is entitled to know the number of competing offers, but content — price and terms — is a different matter entirely: the seller must give clear written direction before any of that content can be shared with a competing buyer or their agent, and personal or identifying information contained in an offer cannot be shared even where the seller authorizes sharing the dollar figures. Treat a request from the co-operating brokerage for anything beyond the number of offers as its own consent event, separate from whatever general sharing consent you already have on file.
RECO’s confidentiality rule carves out disclosures the law itself requires — the bulletin's own language excepts sharing that happens “except where required by law.” A FINTRAC report, a court order, or a regulator's own inquiry into your file are examples of disclosure the confidentiality rule was never meant to block; the written-consent requirement is aimed at voluntary sharing with a third party for the third party's own purposes, not at a legal obligation you're required to meet regardless of what the client wants.
Two different standards, working together
PIPEDA sets the federal floor: meaningful consent, naming who receives the information. RECO’s confidentiality bulletin sits on top of that floor for Ontario registrants specifically, requiring written consent for anything confidential leaving the brokerage. Meeting PIPEDA’s standard alone does not automatically satisfy RECO’s written-consent requirement — treat the stricter of the two as the operative rule.
Sending the file to the closing lawyer does not hand off your FINTRAC duties — the lawyer is not working under that rule at all. “Lawyers are not regulated directly by FINTRAC”; the Law Society of Ontario sets its own separate identification rules for them instead.
RECO’s bulletin requires written consent for confidential information leaving the brokerage; sending the file to the transaction’s own closing lawyer is generally what a client would reasonably expect, but building that consent into your standard engagement paperwork removes any ambiguity rather than relying on an assumption.
That’s generally internal use within the brokerage rather than third-party disclosure, provided the assistant is bound by the same confidentiality obligations RECO's bulletin describes — it isn’t the same act as sending information to an outside party.
That request is exactly the kind of third-party disclosure RECO’s confidentiality bulletin is aimed at — confirm what specific written consent you already have before sharing anything beyond what the transaction documents themselves already disclose.
Only with the seller’s clear written direction — per RECO’s own guidance, a buyer who made an offer is entitled to know the number of competing offers, but sharing price or terms requires the seller’s specific, written authorization, and identifying information cannot be shared regardless.
A short call can help you build file-sharing language that actually satisfies both standards.
