Insurance adjusters’ consent form considered overly broad

PIPEDA Case Summary #2007-368

[Principles 4.3.3 and 4.4.1]

A victim of theft was concerned about the Personal Information Consent form that the insurance adjuster required him to sign as a condition of service. When he refused to sign it because he objected to the requirement that he consent to the collection of a wide range of information, the adjuster stated that it could not further process his claim.

The Assistant Privacy Commissioner agreed with the complainant that the language was too broad and made recommendations to the adjuster, as well as to industry groups that had recommended the use of the form in question to their membership. The adjuster discontinued using the form in question and replaced it with two others, one for property claims and the other for injury claims. The Office reviewed the forms and was satisfied that the language now meets the requirements of the Act.

The following is a detailed overview of the investigation and findings.

Summary of Investigation

When jewellery and money were stolen from the complainant, he reported the theft to his insurance company. His claim was then referred to an adjuster for processing.

The adjuster asked him to complete a Proof of Loss form (a standard form required under provincial law) and to sign a Personal Information Consent form. An adjuster interviewed the complainant, and obtained a statement which he signed. He also submitted a description of disappeared jewellery form. He refused, however, to sign the Personal Information Consent form, and, as a result, the adjuster refused to refer his claim to his insurer. The adjuster contended that it could not further process the claim without the complainant’s consent.

The first paragraph of the Personal Information Consent form sets out three broad purposes for the collection, use, and disclosure of personal information. These are:

• To determine the value of the claimed loss, damage or injury;
• To determine the available coverage for the loss; and
• To prevent fraud.

These purposes are repeated and slightly expanded within the main text of the consent form.

The form lists seven types of personal information that may be collected, depending upon the nature of the claim that is being made. These types are:

• Basic identifying information
• Claims and credit history
• Financial information
• Medical information
• Driver’s record
• Employment information
• Witness statements

As the complainant was making a claim for theft of personal property, he objected to the requirement that he consent to the collection of information such as his claims and credit history, financial information, medical information, driver’s record, and employment information.

One portion of the form lists the sources from which this information may be collected. They include credit organizations, motor vehicle and driver licensing authorities, financial institutions, medical professionals, and fire/intrusion protection system installers and monitoring companies, and various police and other authorities. Another part of the form lists nine categories of third parties to whom the personal information may be disclosed.

The Office learned that the form in question was an industry standard form, drafted by one association and adopted by another. Nevertheless, the adjuster indicated that it would be willing to amend the form.

After discussing the complainant’s concerns with the adjuster, the adjuster agreed to waive the requirement to sign the Personal Information Consent form for him. The form continues, however, to be used by the company and within the insurance claims industry.

Findings

Issued January 11, 2007

Application: Principle 4.3.3 states that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified and legitimate purposes. Principle 4.4.1 stipulates that organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified. Organizations shall specify the type of information collected as part of their information-handling policies and practices.

In making her determinations, the Assistant Commissioner deliberated as follows:

• She agreed with the complainant that, based on the language of the Personal Information Consent form, the adjuster was requiring benefit claimants to consent to the collection and disclosure of a broad array of personal information that was not necessarily relevant to the claim the individual was filing.
• In the complainant’s case, much of the information listed was not necessary for the purposes and was clearly beyond that required to fulfil the purposes. For example, he should not have been required to consent to the collection of information such as his credit history, financial information, medical information, his driver’s record, and employment information. Such information had nothing to do with his claim concerning the theft of jewellery and money.
• In her view, this consent language did not meet the requirements of Principles 4.3.3 and 4.4.1.
• She therefore recommended that the adjuster redraft the language of its Personal Information Consent form to comply with the requirements of the Act. She also raised the matter with the Canadian Independent Adjusters’ Association and the Insurance Brokers Association of Canada.
• The adjuster advised its members to discontinue using the form in question and has replaced it with two others, one for property claims and the other for injury claims. The Canadian Independent Adjusters’ Association also agreed during the investigation to revise its consent forms to ensure that its members firms are using the new forms.
• The property claim form authorizes the adjuster to collect, use and disclose personal information as permitted by law and for the purposes necessary to investigate and settle claims, detect and prevent fraud, validate information provided, and exchange information with other property and casualty insurance companies, adjusters, assessors, valuators and other insurance related service or information providers. The form then asks for the claimant’s express consent.
• The injury claim form language is virtually the same, except it includes the exchange of information with health professionals. It too requests the claimant’s express consent.
• The Office reviewed the language of these forms and was satisfied that the adjuster was now meeting its obligations under Principles 4.3.3 and 4.4.1.

The Assistant Commissioner concluded that the complaint was well-founded and resolved.