Insurance company requires property owners to collect tenants' personal information

PIPEDA Case Summary #2006-343

(Section 2; subsection 5(3); and Principle 4.3 of Schedule 1)

The complainant, who owned a rental property, alleged that, as a condition of receiving insurance services, her insurance company required her to collect and disclose information about her tenants, such as their insurance company’s name, their insurance policy number, and its expiry date.  When she refused to provide the information, the insurance company did not renew its coverage of her property. 

The Assistant Privacy Commissioner determined that the insurance company’s purpose for requiring this information was reasonable and that it was the complainant’s obligation, as she was an organization engaged in a commercial activity, to obtain her tenants’ consent to the collection and disclosure.  Nevertheless, the Assistant Commissioner was of the view that the insurance company could better explain why it required this information.  The company agreed, and amended its forms accordingly.

The following is a detailed overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant’s property had been insured by the insurance company in question for a number of years.  A few months prior to renewal, the company sent her a rental dwelling questionnaire and asked that she complete and return it.  When the complainant did not respond to this request, the company wrote to her, indicating that her coverage was being refused.  She attempted to have the requirement that she provide tenant information waived, but was unsuccessful.  The complainant then obtained insurance coverage from another insurance company that did not request any personal information about her tenants.

The insurance company in question stated that it instituted the questionnaire in 2002 for two reasons: to be able to subrogate against a tenant and to control the policy premium.  The insurance company stated that it only insures the owners of a rental property and not the tenants.  If a tenant were to cause damage to an insured rental property, the insurance company would be required to make payment to the insured property owner to cover the loss.  However, as an insurance company, it has the contractual right to step into the insured’s shoes and bring a subrogated claim against the tenant to recover the loss.  If the tenant does not have insurance coverage, the insurance company states that it is very unlikely that it would be able to recover the loss from the tenant personally.  Therefore, it asks the question to ensure that it can recover any loss as a result of a tenant’s negligence.

Secondly, the insurance company indicated that although it could charge a higher amount of money for the risk associated with a rental property and not distinguish whether the tenant is insured or not, it chooses only to charge according to actual risk.  If tenants have proper liability insurance coverage in place, the insurance company states that it then knows that there will be funds available from which it can recover any loss if the tenant negligently causes damage to property the insurance company insures.  If it can recover its loss, the insurance company contends, it can then charge less for the insurance it provides.  The insurance company states that it is to the advantage of all insured parties to have its company engage in this practice, as it is the best method of keeping insurance rates as low as possible.

In the insurance company’s view, the level of risk it would have to underwrite, were it to provide insurance coverage on rental properties with uninsured tenants, is unacceptably high.  The company stated that it assesses the level of risk based on the tenant information that is provided (including such items as the basis of the rental or lease agreement) and determines the corresponding insurance premiums based on actuarial calculations of items, such as expense ratios versus cost recoveries.

The insurance company requests the name of the tenant’s insurance company, policy number and expiry date to increase the likelihood that the tenant is responding truthfully.  Its underwriting department retains the information on file to assess the risk but does not share it with other areas of the company.  Thus, in the event of a claim, the insurance company’s claims department would contact the owner of the property to obtain the tenant’s name and insurance information.  The insurance company does not ask for the tenant’s name initially so that the insurance information cannot be linked to a specific person.  Since the insurance information cannot be linked to a specific person, the company contended that the information is not personal information.

According to the insurance company, its policy is a common industry practice.  The Office requested comments from the Insurance Bureau of Canada (IBC) on the matter.  The IBC states that there is no property and casualty insurance industry standard with respect to insurance companies requesting information about a tenant’s insurance status from the rental owner.  According to the IBC, practices vary from insurer to insurer, depending upon each insurer’s underwriting requirements and privacy code.  Nonetheless, the IBC presented a rationale for the practice that is similar to the one put forward by the insurance company.  It stated that one reason an insurer may ask for such information is that the legal obligations of an owner and tenant are joint and several.  Joint and several liability means that, in the case of damage to property of the condominium corporation or of another condo unit, the liability insurer of the owner or the tenant may be required to pay the full amount of damages.  If there is damage to the condominium corporation property caused by the tenant, it is likely that the corporation will turn to the unit owner for compensation through the owner’s insurance policy.  The insurer of the unit owner would then claim against the tenant (i.e. the tenant’s insurer, provided the tenant has liability insurance) to recover the damages it paid towards the loss.  Insurers need information about the risk that they are being asked to underwrite and, for this reason, may ask tenants for information such as their insurance policy.  Based on its underwriting requirements, an insurer may choose not to accept a particular risk.  The IBC was of the view that it is appropriate for a unit owner’s insurer to request the information that the insurance company is seeking from tenants.

Findings

Issued July 21, 2006

Application: Section 2, which defines personal information as information about an identifiable individual; subsection 5(3), which states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and Principle 4.3, which states that the knowledge and consent of the individual are required for the collection, use and disclosure of personal information. 

In making her determinations, the Assistant Commissioner deliberated as follows:

• While the company stated that since the information was not linked to a name, it was not personal information, the Assistant Commissioner noted that section 2 of the Personal Information Protection and Electronic Documents Actstates only that the individual must be “identifiable,” not necessarily identified. 
• Since information such as an insurance policy number could be linked to a person’s name, and be, therefore, identifiable, she was satisfied that the information is personal information as defined in section 2.
• The Assistant Commissioner stated that company’s purposes for collecting tenant insurance information, namely, to reduce its exposure to risk and to maintain competitive insurance premiums, appeared to be purposes that a reasonable person would consider appropriate in the circumstances.  Although they were not explicitly specified (a matter which is addressed under Further Considerations), in the circumstances of this complaint, they were explained to the complainant when she sought clarification of the company’s practice.
• With respect to the issue of consent to the collection and disclosure of tenant information, the Assistant Commissioner pointed out that as a landlord, the complainant was, for the purposes of the Personal Information Protection and Electronic Documents Act (the Act), an organization engaged in a commercial activity.  If she had chosen to insure her property through this insurance company, the responsibility to ensure compliance with the consent provisions set out in Principle 4.3 of Schedule 1 of the Act would have rested with her.  The Assistant Commissioner stated that the complainant would also have assumed other obligations under the Act, such as the obligation to inform the individual of the purposes for which the information is being collected and disclosed, and the need to safeguard the information. 

Accordingly, she concluded that the complaint was not well-founded.

Further Considerations

As noted above, the Act requires that the purposes for any collection, use, or disclosure of personal information be explicitly specified.   Had the complainant chosen to continue to be insured through this particular insurance company, this obligation would have been the complainant’s, since she is an organization involved in commercial activities.  The Assistant Commissioner noted, however, that it is an obligation that would have been difficult for her to discharge in the circumstances, since the insurance company’s form did not set out the purposes for the collection and disclosure of tenant information. 

The Assistant Commissioner therefore recommended that the company amend its insurance form to include an explanation outlining the rationale for requesting tenant information on the questionnaire (namely, to reduce its exposure to risk and to maintain competitive premiums) and how it will be used.  In explaining the purpose for the collection and the intended use, the insurer should also explain that in the event of damage caused by a tenant, the property owner may be asked to provide information again about the tenant for subrogation purposes.  She also recommended that the company advise property owners that they have responsibilities under the Act when collecting tenant personal information and disclosing it to the company, specifically with respect to obtaining tenant consent, informing tenants of the purposes for the collection and proposed disclosure, and safeguarding and retaining the information. 

The company adopted these recommendations and provided the Office with a copy of its amended questionnaire and standard letter that accompanies the questionnaire.  The Assistant Commissioner reviewed these and was satisfied that the amendments adequately addressed her concerns.