An insurance company’s internal ombudsman office is not a “formal dispute resolution process” under PIPEDA

PIPEDA Report of Findings #2016-006

February 12, 2016

---

The complainant alleged that an insurance company refused to provide her with access to her personal information.

The complainant was involved in a dispute over the company’s assessment of her insurance claim, which resulted in her filing a complaint with the company’s ombudsman, who later advised that her dispute could not be resolved.

The complainant requested access to her personal information related to the claim, including the recording of a telephone conversation. The complainant was refused access to the recording as the conversation included her spouse and so his consent was said to be needed as well.

Objecting to having to obtain her spouse’s consent to access her own information, she filed a complaint with our Office.

The company explained that it refused to provide the complainant with documents generated from her ombudsman complaint, since, in its view, this service constituted a “formal dispute resolution process” and, therefore, fell under the exemption pursuant to paragraph 9(3)(d) of PIPEDA. The company also submitted that because the ombudsman office’s services are not a “commercial activity,” they are beyond PIPEDA’s scope.

First, regarding the refusal to give the complainant access to the recorded conversation without her spouse's consent, the proper first response would have been to remove third party personal information, and to provide access to the rest. The company ultimately did so, but more than a year after her initial request and only after a complaint was filed with our Office. The company therefore contravened Principles 4.9 and 4.9.1 of PIPEDA, which oblige an organization to provide an individual with access to their personal information on request.

Second, on the refusal to release personal information related to dealings with the ombudsman, our view is that while the ombudsman provides a means for resolving complaints, it lacks the framework and structure that would qualify it as a “formal process.” As a result, the company's use of the exemption in paragraph 9(3)(d) was not justified.

The company also argued that the ombudsman's services are not a “commercial activity,” as defined in PIPEDA, and therefore not subject to PIPEDA. We found that, in attempting to resolve a dispute arising in the course of commercial with a company, the services of the ombudsman are in fact subject to the provisions of PIPEDA.

The company agreed to follow our recommendation to provide the complainant with access to her personal information generated as a result of the ombudsman process.

Accordingly, we determined this complaint to be well-founded and resolved.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”)

1. The complainant alleges that an insurance company (“the Respondent”) has refused to provide her with access to the personal information it holds about her. Specifically, she alleges that the Respondent has inappropriately refused to provide information related to a joint home insurance policy she holds with her husband, and subsequent information generated following a complaint filed with the Office of the Ombudsman (“the Ombudsman”) for the Respondent’s parent company, which is a bank (“the Bank”).

Summary of Investigation

2. The complainant filed an insurance claim with the Respondent, following damage to her home. When the results of the insurance claim were not to her satisfaction, she escalated her concerns with the Respondent, in accordance with the first two stages of the Bank's complaint resolution process.
3. In early April 2013, she subsequently filed a complaint with the Ombudsman, the third stage in the complaint resolution process. This complaint reached its conclusion in late June 2013, as the Ombudsman believed that the matter could not be resolved.
4. In late July 2013, the complainant requested access to all personal information the Respondent had collected, used and/or disclosed, making specific reference to a letter of the Ombudsman and a tape recording.
5. In August 2013, the Respondent advised her that it was unable to proceed with her request for access to the claim file since the claim was related to a policy that is jointly held by the complainant and her husband. Accordingly, the Respondent requested written consent from both the complainant and her husband before it could proceed with her request.
6. According to the Respondent, this position was taken because the tape recording requested was of a telephone conversation between the complainant's husband and the Respondent.
7. The complainant objected to having to obtain her spouse's consent to obtain her own information, and subsequently filed a complaint with our Office.
8. In early September 2014, the complainant confirmed during a telephone conversation with the Respondent's Claims Department that she was requesting claim file notes, recorded calls, and any other information regarding her policy and/or claim from January 2012 to the present. An acknowledgement letter dated September 2014 was sent to the complainant, following this telephone conversation.
9. In October 2014, the Respondent released a number of documents to the complainant, from which the personal information of third parties had been removed, including a transcript of the aforementioned tape recording.
10. Upon receiving the documents, the complainant stated that significant information was missing from the documents provided to her, namely, internal reports, emails between the preferred vendors and the adjustor, emails from the Ombudsman, and emails from the claims department.
11. The Respondent advised our Office that it could not provide any records of internal reports, or emails between the preferred vendors and the adjustor as they did not exist.
12. During the course of our investigation, our Office sought to clarify whether emails from the claims department had been provided to the complainant in October 2014. In response, the Respondent advised our Office in mid-August 2015 that after following up with its claims department, it would be providing the complainant with access to six emails. The Respondent advised that the information in these additional emails was provided to the complainant in October 2014 and/or is information that the complainant should already have in her possession, given that the emails are directly between the complainant and the claims department.
13. Lastly, the Respondent confirmed that it had emails and other communications and/or notes to and from the Ombudsman. However, it was refusing to provide the complainant with access to documents generated from her Ombudsman complaint, as it was of the opinion that the Ombudsman's services constituted a “formal dispute resolution process” and therefore, information generated in the course of this process fell under the exemption pursuant to paragraph 9(3)(d) of the Act. The Respondent also submitted that the Ombudsman's services are not a “commercial activity” and therefore beyond the scope of the Act.

a. The Ombudsman is a formal dispute resolution process

14. The Respondent pointed to previous OPC decisions that support a broad interpretation of a formal dispute resolution process, including:
    • A company's grievance process is a formal dispute resolution process where its objective is at least in part to resolve complaints that it receives^{Footnote 1};
    • Grievance documentation generated, in part, for the purposes of settling a dispute and not solely for the purpose of responding to allegations or providing a defence properly fall within paragraph 9(3)(d) of the Act^{Footnote 2}; and
    • The purpose of paragraph 9(3)(d) of the Act is to protect the process where the parties voluntarily meet for the purpose of negotiating an acceptable resolution^{Footnote 3}.

i. Legislatively required and governed

15. The Respondent advised that the Bank Act and the Insurance Companies Act require federally regulated financial institutions and insurance companies to: (i) establish formal procedures and processes for resolving customer complaints, (ii) designate an individual to be responsible for implementing those procedures and to deal with those complaints, (iii) make information about these processes available to consumers; and (iv) file a copy of these procedures with the relevant regulator.^{Footnote 4}
16. It also advised that the Financial Consumer Agency of Canada (“FCAC”) Commissioner's Guidance document No. CG 12 states that all federally regulated financial institutions “are required by legislation to have dedicated procedures as well as personnel in place to deal with consumer complaints.”
17. Moreover, the Financial Services Commission of Ontario (“FSCO”) General Insurance Bulletin No. G-02/03 states that customers must attempt to resolve their complaints directly with their insurer before accessing the Office of the Insurance Ombudsman. Moreover, the FSCO General Insurance Bulletin No. G-05/96 requires all insurance companies to have in place a “Consumer Complaint Handling Protocol” for dealing with consumer complaints and to appoint an Ombudsman Liaison Officer to liaise with the Office of the Insurance Ombudsman.

ii. Independent and impartial

18. The Respondent further submits that the Ombudsman is “independent from other the Bank's business, performing its dispute resolution function free from interference, direction, or influence from the Bank's businesses or executives”. According to the Respondent, the Ombudsman is an independent and impartial office which reports to the Deputy General Counsel of the Bank and is not associated with or aligned to any business line within the Bank. The Ombudsman has the mandate to independently review the concerns of the Bank customers that remain unresolved after the dispute has been addressed by the Bank's internal complaints resolution process.
19. The Respondent advised that the Ombudsman dispute resolution process is not an administrative process for resolving complaints, nor are customers' complaints automatically escalated to the Ombudsman. Customers have the option to voluntarily contact the Ombudsman after attempting to resolve their issues with the Bank directly, as part of the first two administrative stages of the Bank's complaint resolution process.
20. The Respondent further advised that the role of the Ombudsman is primarily as a mediator and settlement facilitator between the Bank and its customers, who investigates and attempts to fairly and impartially resolve issues relating to customers' concerns. The Ombudsman works with the customer and the Bank to understand what the customer expected of the Bank, what service the Bank agreed to deliver and why the customer's expectations were not met. The goal of the Ombudsman is to apply principles of fairness to find an acceptable resolution, without any interference, direction or influence from the Bank.

iii. Generates information subject to settlement privilege

21. According to the Respondent, the information generated during the course of resolving a dispute is subject to settlement privilege. The Respondent indicated that one of the functions of the Ombudsman is to negotiate with both parties and recommend settlement terms. The current Ombudsman process requires that all communications with the Ombudsman are kept private and confidential between the customer, the Bank and the Ombudsman, meaning that the customer and the Bank agree not to seek to have the Ombudsman representative(s) produce its files and records, nor to testify or give evidence.
22. The Respondent submitted that the Ombudsman's commitment to confidentiality is also particularly important as it enables the Ombudsman to discuss issues openly with all parties. Both the customer and the bank are able to share information with the Ombudsman and make settlement concessions without fear that their statements might be disclosed or used against them in subsequent proceedings.
23. According to the Respondent, the courts have consistently recognized the privilege surrounding settlement negotiations, including mediation. This privilege is based on the public policy and the importance of encouraging parties to resolve their disputes without litigation. The courts have held that facilitating settlement outweighs the desire to have all relevant documents or statements disclosed, because “in the absence of such protection, few parties would initiate settlement negotiations (including mediation) for fear that any concession that they would be prepared to offer could be used to their detriment if no settlement was forthcoming.”

iv. Efficient and Effective

24. The Respondent provided our Office with statistics to demonstrate that the Ombudsman is an efficient and effective formal dispute resolution process.

b. The Ombudsman does not participate in “commercial activity”

25. The Respondent further states that its Ombudsman dispute resolution process does not fall under the definition of “commercial activity” pursuant to subsection 2(1) of the Act and therefore the information generated during this dispute resolution process is beyond the jurisdiction of the Act.
26. According to the Respondent, not all personal information that an organization collects, uses and discloses is subject to the Act. It must be collected, used or disclosed in the course of “commercial activity.” In the Federal Court of Canada's State Farm decision^{Footnote 5}, the Court applied a narrow interpretation of “commercial activity” and found that personal information collected by an insurer for the purpose of defending a claim against its insured was not subject to the Act, even though the information in issue was collected before any claim had been commenced. In particular, the Court stated the following at paragraph 106 of its decision:

    The primary characterization of the activity or conduct in issue is the dominant factor in assessing the commercial character of that activity or conduct under [the Act], not the incidental relationship between the one who seeks to carry out the activity or conduct and third parties.

27. According to the Respondent, similar to State Farm, the dominant purpose for the information collected or generated in the course of the Ombudsman dispute resolution process is to resolve customer complaints (independently from the Bank) and not a commercial activity. Therefore, the Respondent submits that this information is outside of the scope of the Act.

Application

28. In making our determinations, we applied subsections 2(1) and 9(1), and paragraphs 9(3)(a) and 9(3)(d) of the Act, as well as Principle 4.9 of Schedule 1 of the Act.
29. Subsection 2(1) of the Act defines “commercial activity” as “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”
30. Subsection 9(1) of the Act states “Despite clause 4.9 of Schedule 1, an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the information about the third party is severable from the record containing the information about the individual, the organization shall sever the information about the third party before giving the individual access.”
31. Paragraph 9(3)(a) of the Act states that an organization is not required to give access to personal information only if the information is protected by solicitor-client privilege, while paragraph 9(3)(d) of the Act states that an organization is not required to give access to personal information only if the information was generated in the course of a formal dispute resolution process.
32. Principle 4.9 of Schedule 1 of the Act states “Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.” Specifically, Principle 4.9.1 indicates that “An organization shall inform an individual whether or not the organization holds personal information about the individual…The organization shall allow the individual access to this information.”

Analysis

33. The response initially provided by the Respondent to the complainant in August 2013 was inappropriate given that the Respondent could have provided the complainant with access to her personal information by severing the personal information of third parties, including her husband’s, as required by subsection 9(1). Instead, the Respondent refused to provide her with any access without her husband’s consent.
34. Accordingly, it is our Office’s finding that the Respondent did not respond to the complainant’s access request appropriately and therefore contravened Principles 4.9 and 4.9.1. It was only after the complainant filed a complaint with our Office and the Respondent engaged in further discussions with the complainant and our Office, that the Respondent provided the complainant with access to records containing her personal information in October 2014.
35. However, several additional records were not provided to the complainant as the Respondent was of the opinion that these records should not be provided to the complainant pursuant to paragraph 9(3)(d), as well as the absence of commercial activity with respect to the Ombudsman’s activity of dispute resolution. The remainder of this report will determine whether the Respondent properly withheld records from the complainant.

a. Whether the Ombudsman is a formal dispute resolution process

36. Paragraph 9(3)(d) constitutes an exemption to an organization’s obligation to provide an individual with access to personal information under the Act. Since the Act has been recognized as quasi-constitutional legislation,^{Footnote 6} the rights accorded under it should be given a liberal and purposive interpretation, and restrictions on those rights should be interpreted narrowly^{Footnote 7}. In this case, any ambiguity concerning the scope of paragraph 9(3)(d) should be resolved in favour of granting access to personal information.
37. The idea of “dispute resolution” contemplates two parties agreeing, or being required by legislation, to use a particular mechanism to resolve a dispute. For something to qualify as “formal dispute resolution”, the process must be beyond the generic description of “dispute resolution”. Thus, a “formal dispute resolution process”, as distinguished from a simple “dispute resolution process”, suggests the presence of a framework, either legislated or agreed to by the parties to the dispute. It also suggests a process that takes place in accordance with recognized rules.

i. Legislatively required and governed

38. The regulatory structure for banks and insurance companies referenced by the Respondent requires them to provide an internal complaints resolution process and to require customers to exhaust the internal process first. However, our Office is of the view that this regulatory structure does not speak to the formality of those processes; it requires banks and insurance companies to have a process in place, but does not provide any framework of what this process must entail. Banks and insurance companies retain considerable flexibility as to the kind of internal processes adopted.

ii. Independent and impartial

39. The Respondent’s submission argues the relative independence of the Ombudsman from its various business lines, despite the fact that the Ombudsman remains an internal function of the Bank and is led by an employee of the Bank, who reports to the Deputy General Counsel of the Bank. It is questionable whether the Ombudsman is capable of being perceived as independent of the Bank.

iii. Generates information subject to settlement privilege

40. Our Office is of the opinion that the Respondent has not made out a case for the application of settlement privilege. To the extent that the Act may allow organizations to withhold information covered by settlement privilege, this issue would be more appropriately dealt with pursuant to paragraph 9(3)(a), which provides an exemption on the basis of information protected by solicitor-client and litigation privilege.

iv. Efficient and effective

41. The Respondent emphasizes the effectiveness of its Ombudsman. The fact that a dispute resolution process is highly effective is not necessarily indicative of the formality of that process. In fact, the informal nature of certain processes may contribute to their success and the regulatory structure highlighted by the Respondent reflects a public policy goal of reducing reliance on more formal dispute resolution processes in favour of less cumbersome and more expedient responses to complaints within the bank or insurance company. Although the Ombudsman represents stage 3 in the Bank’s internal complaints resolution process, it nevertheless remains part of a complaints response process rather than a process aimed at formal dispute resolution.

v. Conclusion

42. While it is important to ensure that the purpose of the process in question is dispute resolution, it is equally important to address whether the process is formal, as part of a more contextual analysis of the exemption pursuant to paragraph 9(3)(d). As noted above, a “formal dispute resolution process” suggests the presence of a framework, either legislated or agreed to by the parties to the dispute, as well as a process that takes place in accordance with recognized rules. It is our Office’s view that the Ombudsman does not have this quality; it is a tool for responding to complaints, but lacks the structure of formal dispute resolution. This is consistent with an unpublished finding by our Office, which examined the Ombudsman’s Office of a financial institution with a framework almost identical to that of the Ombudsman.
43. Accordingly, it is our Office’s finding that the Ombudsman is not a “formal dispute resolution process” pursuant to paragraph 9(3)(d) and the Respondent cannot rely on this exemption to refuse to provide the complainant with access to documents created as a result of her complaint to the Ombudsman.

b. Whether the Ombudsman participates in “commercial activity”

44. The very presence of paragraph 9(3)(d) as an exemption to provide an individual with access to personal information under the Act indicates that information relating to a formal dispute resolution process is capable of falling under the Act.
45. It is our Office’s view that the State Farm decision^{Footnote 8} is not analogous to the current case. The State Farm case arose out of an automobile accident between a complainant and a woman insured by State Farm who, in anticipation of potential litigation, hired private investigators to conduct surveillance on the complainant. In that decision, the complainant was not a client of State Farm and there was no commercial relationship between them.
46. However, in the present situation, the dominant purpose for the information collected or generated in the course of the Ombudsman dispute resolution process arose out of the commercial activity between the complainant and the Respondent. It is our Office’s finding that on account of the commercial activity between the complainant and the Respondent, the ensuing relationship between the complainant and the Ombudsman falls under the scope of the Act.

Preliminary Report of Investigation and Recommendations

47. In January 2016, our Office issued a Preliminary Report of Investigation (“PRI”), recommending that the Respondent provide the complainant with access to all information generated during her complaint to the Ombudsman, unless another exemption pursuant to the Act applies to the information. Moreover, our Office also recommended that the Respondent refrain from advising individuals that it is unable to proceed with a request for access to information without the consent of a joint account holder, where information about third parties can be severed. In such cases, individuals should be advised that without the consent of a joint account holder, a response will be provided where information about third parties has been severed.

Response to Preliminary Report of Investigation

48. In response to our Office’s PRI, the Respondent indicated that it respectfully disagreed with our Office’s finding that the Ombudsman is not a “formal dispute resolution process” pursuant to paragraph 9(3)(d). Notwithstanding this position and without prejudice to future matters, the Respondent has provided the complainant with access to her personal information generated in the course of her complaint to the Ombudsman.
49. In addition, the Respondent advised our Office that the Respondent’s current practice is to provide joint account holders with access to their personal information where third party personal information can be severed.

Conclusion

50. Accordingly, our Office finds this matter is well-founded and resolved.