Individual objects to being photographed by private investigation firm

PIPEDA Case Summary #2008-392

[Principles 4.3, 4.4 of Schedule 1, paragraphs 4(2)(b), 7(1)(b)]

An individual objected to being photographed by a private investigator who was acting on behalf of the individual’s insurance company, which was sceptical of his claim for disability benefits. He believed that the investigator had no right to photograph him without his knowledge or consent. He also objected to the deception used by the investigator in order to take his photograph.

The investigation firm contended that it could photograph the individual without his knowledge or consent since it was reasonable for purposes related to investigating a breach of an agreement.  According to the firm, the photograph was necessary to positively identify the claimant, confirm that he was at home, and provide evidence to help the insurance company decide whether his claim for benefits was valid. The Assistant Commissioner did not agree that the photograph was necessary for the identified purposes. Moreover, she determined that the investigation firm had already collected sufficient evidence for its purposes without resorting to taking a photograph of the individual by means of a pretext.

The following is an overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The individual was on long-term disability. At the time he submitted his complaint to this Office, he was involved in a dispute with his employer’s insurance company, which had terminated his benefits. (The benefits have since been reinstated.)

According to him, someone came to the door of his home and handed him a copy of a magazine. This person asked the individual to sign a form stating that the magazine was a “thank you” for completing a telephone survey. However, he did not recall ever completing such a survey.

The next month he received a letter from his insurance firm informing him, among other things, that an investigation firm had been hired to conduct surveillance on him. Included in the letter was a copy of the investigation report, which contained a photo of him accepting the magazine. He contacted the magazine to ask whether a promotion had been conducted on that date. The magazine responded that it was not involved with the insurance company or with any private investigators, and that no telephone surveys had been conducted on the date in question.

The insurance company provided our Office with background information on the complainant’s disability claim. According to the company, the individual’s functional impairment was very difficult to assess. In its opinion, he submitted inconsistent medical information from his family physician and the specialist who was treating him. This made the company question his condition. As he had refused to attend scheduled independent medical examinations, the company had not had an opportunity to examine him.

The insurance company’s position was that the purpose of the surveillance was to determine whether the individual was exhibiting any kind of behaviour that was not consistent with his condition. His symptoms created an expectation of limited activity and limited sociability. Therefore, any evidence to the contrary would have brought the severity of his impairment into question. The company did not specifically request a photograph of him.

According to the investigation firm, the insurance company had instructed it to conduct three days’ surveillance on the individual to determine his “activities and movements.” The investigation firm noted that there was no documentation of the business arrangement between the two companies. Typically, the firms would call each other and transfer the necessary information pertinent to a particular investigation.

After receiving its instructions, the investigation firm completed a provincial-government vehicle search to determine what vehicles the complainant owned, in order to ensure it undertook surveillance on the right individual.

As instructed, the firm conducted surveillance for three days on the individual’s house. The investigators made pretext telephone calls to see if the complainant was at home. They did not observe him leaving the house. In order to get a picture of him, an investigator delivered a magazine to the complainant on the pretext that it was a “thank you” for a telephone survey in which the investigator said the individual had participated. According to the investigator, the photograph was taken with a concealed video camera. The purpose of taking the photograph was to assist the investigation firm in positively identifying the subject of the investigation and to confirm that he was actually at home at the time. This was to comply with the insurance company’s request to determine the movements and activities of the individual, an issue that the firm presumed was relevant to the insurance company’s claim handling. The photograph also supplied proof that the investigation firm did the job it was contracted to do.

The firm stressed that it needed to ascertain that the individual was actually at home. It pointed out that telephone calls can be call forwarded to other locations; thus, such calls are not a foolproof way of establishing that the individual is at home. Additionally, the fact that an individual is not seen to leave his or her house does not conclusively mean that he or she never left—sometimes views are obstructed or the individual leaves by an exit not observable to public view. The investigation firm maintained that its belief that people can occasionally leave their residences unobserved was validated by the complainant’s claim that he did indeed leave his house during the period in question.

The insurer had not provided the investigators with a photograph of the claimant. The investigation firm explained that often there are multiple individuals of a common description present in the premises under surveillance. The only way to positively identify the target of the surveillance is to obtain a photo under a pretext in which the person confirms his or her identity. This procedure ensures that the correct person is put under surveillance.

Another factor highlighted by the firm was that claimants often give false or misleading addresses or telephone numbers. In this case, the insurance company provided the investigation firm with the address and telephone number on file for the claimant. However, the firm’s inquiries showed that the telephone number was not registered in the claimant’s name.  Although the first initial of the registered name matched that of the claimant’s wife, this did not necessarily prove that the telephone number belonged to the claimant. Taking a photograph of the individual believed to be the claimant ensured that the firm had the right person. Moreover, if surveillance was again requested by the same insurer on the same individual at a later date, no new photograph would be necessary.

The firm contended that it was standard practice for its private investigators to always videotape subjects. Investigators are not in a position to judge illness or injuries; therefore, the tapes are needed to assist adjusters or specialists in determining the extent of the subject’s problems. The Assistant Commissioner noted, however, that this was not the reason for the taping in this instance.

A copy of the investigation firm’s policy on surveillance revealed that “due diligence” must be shown in the work performed for the client. The policy provides guidance regarding pretexting, limiting its type and scope; and it cautions private investigators to avoid direct contact with the subject unless necessary. As for determining whether the subject is within the residence or for identifying the correct individual, private investigators are told to do so in “as least an obtrusive manner as possible.”

The investigation firm submitted its report to the insurance company, as well as a digital video. The video and a photograph in the report showed the individual signing for the magazine delivery. The firm believed that pretexting was a legitimate investigative technique. According to the firm, pretexting has been recognized by the provincial Registrar of Private Investigators in its guidelines for the industry. The Registrar clearly enunciated the prohibited forms of pretexts, implicitly providing that other forms of pretexts are sanctioned. Prohibited are pretexts under the guise of lawyers, doctors, firefighters, police officers, by-law enforcement officers, armed forces officers, government employees and utility workers.

This Office reviewed the provincial legislation by which investigators are bound, and learned that it does not prohibit pretexting. We also examined the provincial legislation that governs trespassing. It states that “there is a presumption that access for lawful purposes to the door of a building on premises by means apparently provided and used for the purpose of access is not prohibited.”

Findings

Issued February 27, 2008

Application: Principle 4.3 states that the knowledge and consent of an individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.4 requires that the collection of personal information be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Principle 4.4.1 adds, in part, that organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfill the purposes identified.

Paragraph 4(2)(b) states that the Act does not apply to any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose.

Paragraph 7(1)(b) notes that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

The investigation firm contended that the Office did not have jurisdiction in the matter, based on the issues of implied consent and commercial activity as interpreted in the court case of Ferenczy v. MCI Medical Clinics et al. (2004)^{Footnote 1}.

In Ferenczy, the Court suggested that the initiation of legal action implied consent for the reasonable collection of relevant information. However, the Assistant Commissioner does not believe that Ferenczy stands for the broad proposition that any contest of a claim by an organization is outside the scope of the Act.

In the complaint at hand, the insurance company thought there were reasonable grounds to believe that the individual would initiate a claim against it. The investigation firm argued that the pre-litigation contested phase is no different than the situation after a formal legal claim has been filed. The firm concluded that there was implied consent for the collection of the individual’s personal information since it believed legal action was forthcoming.

However, the Assistant Commissioner noted that no formal legal action had commenced at the time the investigation firm was conducting its surveillance. Although the individual had initiated an internal appeal of the decision to terminate his benefits, formal legal action was not taken until several months after the surveillance incident at issue.

The Assistant Commissioner did not agree with the investigation company’s argument that the “pre-litigation contested phase” is no different than the situation after a formal legal claim has been filed. The insurance company thought there were reasonable grounds to believe that the complainant would initiate a claim against it. However, the belief that a claim would be filed at some future date is not sufficient to support the findings that a claim would, in fact, be made, and that there was thus implied consent to surveillance and a waiver of the insured’s right to privacy.  

The Assistant Commissioner asserted that the initiation of an internal appeal of a decision is not equivalent to the initiation of a lawsuit. The internal appeal should not, therefore, be considered to constitute implied consent to the gathering of information.

Paragraph 4(2)(b) of the Act states that the Act does not apply to any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose.

In Ferenczy, the Court viewed participation in a lawsuit to be a personal activity entirely unrelated to commerciality, with the only evident commercial activity being that of the private investigator. In this interpretation, were the doctor to undertake the surveillance of the plaintiff himself, there would be no commercial activity to draw the scrutiny of the Act. The Court suggested, therefore, that it was inconsistent for the use of a private investigator to attract scrutiny under the Act when the information was still being collected for the same non-commercial purpose, namely, defending oneself against a lawsuit.

The investigation firm in this complaint contended that, in Ferenczy, the Court concluded that the Act did not apply to scenarios in which an insurer is collecting personal information of a claimant in response to a contested insurance claim. According to the investigation firm, the insurance company, as any corporation, is a “person” at law. Therefore, the insurance company was not collecting the individual’s personal information for a commercial activity, but for the personal purpose of defending itself against a claim. Since the collection was not undertaken for commercial purposes, the investigation firm believed that the Act does not apply.

In Ferenczy, the private investigator was hired by a doctor who was the defendant in a lawsuit initiated by the plaintiff. The Court emphasized that it was the defendant’s purpose in conducting the surveillance that must be examined, and concluded that the doctor’s purpose was “collecting information to defend himself against the lawsuit brought by the plaintiff.” The Court categorized this as a non-commercial purpose, and invoked subsection 4(2) to conclude that the Act does not apply.

In this complaint, the private investigator was retained by an insurance company. Paragraph 4(2)(b) creates an exemption from the Act for collection, use or disclosure by any individual for personal or domestic purposes. The Assistant Commissioner pointed out that the insurance company is not an “individual,” but rather an organization. As such the exemption of paragraph 4(2)(b) does not apply. Furthermore, it could not be said that the insurance company was collecting the information for a personal or domestic purpose. According to the Assistant Commissioner, the collection of information by the company should be viewed as a core part of its business (that of contesting claims).

The Assistant Commissioner therefore determined that the activity at issue here, in other words the surveillance, took place in the course of commercial activities and thus fell under the rubric of the Act. Accordingly, the Assistant Commissioner was satisfied that the Office had jurisdiction in this matter.

In making her determinations, the Assistant Commissioner deliberated as follows:

• There was no disputing the fact that the investigation firm had collected the complainant’s personal information without his knowledge and consent, contrary to the requirement of Principle 4.3. However, the issue was whether the exception to consent outlined in paragraph 7(1)(b) could be used as justification in this instance.
• It was incontrovertible that seeking consent for the surveillance would have compromised the availability or accuracy of the information to be collected. The Assistant Commissioner noted, however, that in order for paragraph 7(1)(b) to apply, the collection must be reasonable for purposes related to investigating. In addition, paragraph 7(1)(b) should be read in conjunction with Principle 4.4.1, which governs the nature and amount of personal information that may be collected. It provides that organizations shall not collect personal information indiscriminately. Both the amount and type of information collected must be limited to that which is necessary to fulfill the identified purposes.
• The investigation firm was retained to conduct three days’ surveillance on the complainant to determine his activities and movements. The purpose of the surveillance, as described by the insurance company, was to determine whether the individual was displaying behaviour inconsistent with his condition. It did not specifically ask for a photograph of him.
• On the dates that the surveillance occurred, a private investigator made pretext telephone calls to see if the complainant was in residence. In addition, an investigator delivered a magazine to the individual under the pretext that it was a “thank you” for completing a telephone survey. The firm indicated that this was done in order to take a photograph of the complainant, which would positively identify him and would confirm that he was at home at the time, in addition to contributing to the insurer’s requirement for information about his condition.
• With respect to the latter purpose, the investigation firm noted that it was not in a position to judge medical conditions, and the photograph was taken to assist the insurer in so doing. However, given the non-physical nature of the complainant’s “injuries,” it is not clear how a photograph of him could, if viewed by medical experts, shed any light on the existence or severity of his problems. Moreover, the conditions and their symptoms created an expectation of limited activity and sociability by the complainant. The evidence gathered by the investigators over three days was consistent with this expectation, in that the investigators never saw the complainant leave the house and there were no visitors.
• Since all of the evidence gathered prior to the pretext was entirely consistent with the expectation of limited activity or sociability, the Assistant Commissioner questioned whether any further confirmation was required. When such additional confirmation of existing evidence is as privacy intrusive as a photograph, and its utility to the investigation is so limited, the Assistant Commissioner did not deem it to be reasonable. Therefore, with respect to the purpose of verifying the complainant’s medical condition, she was of the view that the investigation firm did not uphold paragraph 7(1)(b) when read in light of Principle 4.4.1.
• Regarding the purposes of identity and location verification, the investigation firm contended that it did not possess enough information to be absolutely positive that it was conducting surveillance on the right person. It had taken a number of less privacy-invasive steps prior to the photograph to ensure that it was viewing the correct house (e.g. checked the complainant’s vehicle registration with the province). The insurer had not provided the investigation firm with either a photograph or a physical description of the complainant. However, the investigation firm knew his full name, date of birth, home address, telephone number, his wife’s name, and the fact that his daughter was of a certain age and did not live at home. The firm thought that the additional measure of drawing the complainant out of the house and photographing him was necessary in order to be completely certain that it had the correct person under surveillance.
• Nevertheless, considering that the insurer had given the investigators substantial contact and other data from the complainant’s file, there was no reason to suggest that this information was not accurate. In addition, the investigation firm’s research on the complainant’s vehicle confirmed not only vehicle details, but also his home address. All of this information gathered by the investigators was consistent with the information supplied by the insurer. The Assistant Commissioner was of the opinion that there was nothing to suggest that the investigators might have been conducting surveillance on the wrong location or subject.
• As for ensuring that the complainant was actually at home, the investigation firm contended that the pretext telephone calls were not enough to establish for certain that he was there, nor was the vehicle’s presence in the driveway during the three days of surveillance. The firm also cited the possibility that telephone calls could be call forwarded to other locations, that views might be obstructed or that targets of surveillance might slip outside the house by exits not observable from public view.
• In the Assistant Commissioner’s view, the evidence obtained by the investigation firm through pretext telephone calls and by noting the presence of the complainant’s car in his driveway, all pointed with a sufficient degree of certainty to the complainant being at home, most likely for the majority of the time in question. The complainant later claimed that he did actually leave the house once during the surveillance period. Whatever the truth was, the photograph added no value to the existing evidence. In light of the privacy-invasive nature of the photograph, the Assistant Commissioner reasoned that it was excessive.
• For the purposes of verifying identity and location, the Assistant Commissioner did not believe that the investigation firm met the requirements of paragraph 7(1)(b) and Principle 4.4.1. In short, taking a photograph of the complainant was not necessary for any of the identified purposes. Therefore, the Assistant Commissioner determined that the exception to consent in paragraph 7(1)(b) did not apply, and Principle 4.3 was contravened.
• The Assistant Commissioner therefore recommended that the investigation firm:
• • apologize in writing to the complainant for having unreasonably taken his photograph without his consent;
  • adopt a policy explicitly acknowledging that it would only collect an individual’s personal information, including through the use of surreptitious video or still photography, if it is reasonable to do so in the circumstances and if it is in accordance with the Act; and,
  • include in its policy an explicit acknowledgement that the company will limit its collection of personal information to that which is required for purposes identified by the firm in advance of the collection.
• After reviewing the investigation firm’s policy on surveillance, the Assistant Commissioner was satisfied that the policy adequately restricted how the firm conducted surveillance and that the policy complied with the Office’s recommendations. She was concerned, however, that the firm did not wish to apologize in writing to the complainant.

The Assistant Commissioner therefore concluded that the complaint was well-founded.

Other

The investigation firm expressed concern that if this Office determined that the pretext at issue was a contravention of the Act, it would have significant, widespread implications for the private investigation industry. However, in this specific case, the finding concerned the use of a privacy-invasive technique in circumstances that demonstrated such a use to be unnecessary. This complaint was assessed and determined on the basis of its particular facts — the complaint did not address the merits of the use of pretexting by the private investigation industry in general.

See also

#311 A woman’s activities recorded and videotaped by a private investigator hired by an insurance company

#379 Condition of washrooms prompts management to monitor facilities