Buy a safe.

TORONTO (Reuters) - Canadian Imperial Bank of Commerce said on Friday it was overhauling its privacy procedures after confidential information about hundreds of clients was mistakenly faxed to a scrapyard in the United States for three years.

The review comes after CIBC, Canada's fourth-largest bank by assets, was notified of the problem for a second time by the scrapyard owner in West Virginia, who is also suing the bank for negligence.

Wade Peer told Toronto's Globe and Mail newspaper that he has been deluged by internal CIBC fund transfer request forms to his business fax line since 2001.

The forms contained information such as social insurance numbers and bank account data.

CIBC issued an apology to its customers on Friday evening and said it was instructing its branches to halt transmission of all internal faxes containing client information.

"This information will be transmitted to central processing operations via secure internal courier systems and by direct telephone conversation.

"Longer term, we are exploring other potential secure technological alternatives for the timely transmission of confidential information between branches and processing centres," it said.

Peer believes a toll-free fax number for an auto accessories business he started in 1999 -- AllStar Sportsline Products Inc. -- has been mixed up with the number for CIBC's central fax unit, the newspaper said on Friday.

CIBC spokesman Rob McLeod said in an e-mailed statement earlier on Friday that the bank immediately took steps to safeguard its customers' personal information when it first learned in the spring of 2002 of the misdirected faxes.

The bank said it had immediately notified its branches of the error and asked the U.S. company to shred all faxes received. It also offered to compensate Peer's company for any costs directly incurred.

The bank says it heard nothing further for more than two years until AllStar filed its lawsuit, which said the U.S. company had received faxes until 2002.

Then, last month, the company told the bank that it had been receiving faxes up to 2004.

"This news was a disturbing revelation, since we believed, and the company's lawsuit also led us to believe, that the problem had been resolved two years earlier," said McLeod.

The lawsuit, filed in a Maryland court, is on behalf of Peer's auto accessories business and accuses CIBC of negligence and seeks $3 million in damages.

In its statement, CIBC added: "To ensure that this information remains protected, we will be bringing a motion for a protective order in the U.S. court as soon as the courts reopen following the American holiday. This application will seek to protect the information of the 29 customers that has been produced as evidence in this case."