Federal privacy bill could make it easier for insurers to share suspicious auto claims information

A bill before Parliament could, if passed into law, help organizations investigate fraud by sharing personal information without having to obtain consent, a federal Cabinet minister suggested in Ottawa Tuesday, though critics contend that part of Bill S-4 could “lead to excessive disclosures” and that firms should eventually be required to notify affected individuals.

Bill S-4, the Digital Privacy Act, proposes a change – supported by Insurance Bureau of Canada – to Canada’s Personal Information and Protection of Electronic Documents Act (PIPEDA), which essentially prohibits disclosure of personal information, without individuals’ knowledge and consent, except in very specific circumstances.

It is currently at the consideration at report stage and second reading stage in the Commons and was debated Tuesday.

A time allocation motion May 28 stipulated that only one further sitting day be allotted to consideration at the report stage and second reading stage of Bill S-4, and that one sitting day be allotted to consideration of the bill at third reading. Once it passes third reading, the Digital Privacy Act can be signed into law, because it was already passed by the Senate in 2014.

Bill S-4 proposes to permit disclosure of personal information, without consent, when the disclosure is “made to another organization and is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with the knowledge or consent of the individual would compromise the ability to prevent, detect or suppress the fraud.”

Michelle Rempel, Minister of State for Western Economic Diversification, referred Tuesday to remarks made by IBC officials last month before the Commons’ Standing Committee on Industry, Science and Technology.

IBC supports the part of Bill S-4 that would “repeal the sections in PIPEDA that create investigative bodies and instead allow for an organization to disclose information to another organization in limited circumstances,” said Randy Bundus, IBC’s senior vice president, legal and general counsel, at the time. “These circumstances, as set out in Bill S-4, are to investigate a breach of an agreement or contravention of a law of Canada, and to detect, prevent, or suppress fraud.

The ruling Conservatives made a similar proposal, in 2011, in Bill C-12. The following year, the Ontario Auto Insurance Anti-Fraud Task Force recommended that the Ontario government ask the federal government to “move quickly” on passing Bill-12, in order to remove any “undue limitations” on the ability of insurers to pool claims information to combat fraud.

But Bill C-12 died on the order paper – in September, 2013 – when Prime Minister Stephen Harper prorogued parliament.

The following April, British Columbia Conservative Senator Yonah Martin tabled Bill S-4, which the Senate passed in June, 2014.

The bill is opposed by the New Democratic Party, partly because it “contains a provision that would make it easier for companies to share our information without our knowledge or consent, without a warrant,” said Jasbir Sandhu, NDP MP for Surrey North, B.C., in the Commons Tuesday.

But there is a “real public interest” in ensuring that organizations such as IBC “have the ability to investigate,” Rempel countered Tuesday.

“As it stands right now under the current law, investigators who want to access personal information must be listed as an investigative body in the regulations,” Rempel said. “This involves coming forward with an application to the government and if the federal cabinet decides that the application is warranted, the organization is added to the list. This is an extremely burdensome process for organizations.”

Richard Dubin, IBC’s vice-president of investigative services, was asked by Commons industry committee member Cheryl Gallant last March why IBC is supporting a change to PIPEDA when IBC is already a designated investigative body.

In reply to Gallant (Conservative MP for Renfrew-Nipissing-Pembroke, Ont.), Dubin used an example of a left-turn accident at an intersection. In Dubin’s example, there is no significant damage, there are no witnesses other than the drivers, police are not called to attend and three “jump-ins” – or co-conspirators who were not actually occupants – claim to have been passengers.

“All three occupants were claiming soft tissue injury, but they didn’t report it at the scene of the accident so the police didn’t attend,” Dubin told the committee at the time.

In that example, the insurance claims adjuster could look into the “general history” of the driver and vehicle and contact IBC, Dubin said.

“They’d find out from that information that this driver and the vehicle were involved in a previous collision,” Dubin explained. “It does identify the other insurer as well in those public reports. What that information has that they’re not able to get to yet is that the other insurer also had a left-turn situation with multiple occupants in this vehicle.”

So in this scenario, under PIPEDA, “the adjuster obviously can’t contact the other insurer to find out the facts of the other collision, so they’re in the dark at this point,” Dubin suggested to the committee at the time. “In the meantime, the claim starts getting paid and the occupants receive weekly income disability payments. They attend rehab facilities for extensive treatment, all of them usually receiving the same type of extensive treatment of physiotherapy, massage therapy, or chiropractic. At the same time that these bills are building up, the body shop is now doing the repairs to a vehicle that could very well have been previously repaired in the other accident.”

So if Bill S-4 is passed into law, “it would allow the insurer of this vehicle to contact the other insurer,” Dubin said. “They would find out some of the scenarios, that the same scenario existed with the same service suppliers: they used the same rehab facility, the same body shop, everything was virtually the same.”

Also addressing the committee was Éloïse Gratton, a privacy lawyer with Borden Ladner Gervais, who said she has “some reservations” about the proposed change to PIPEDA.

“The bottom line is that I agree that we need to have a provision authorizing the disclosure of personal information without consent to address these types of situations,” she said at the time. “Still, given the way the proposed provision is drafted, I am concerned that the amendments could lead to excessive disclosures, used for broad purposes justified under the investigation of a breach of an agreeme
nt provision, or the purposes of detecting fraud provision. These disclosures would further be invisible to both the individuals concerned and to the Office of the Privacy Commissioner.”

Gratton added that if there was a way to “minimize the risk of over-disclosing, while including a provision under which companies disclosing in such a situation would have to be transparent about these disclosures, I would offer my support to this type of amendment.”

IBC’s Bundus told the Commons industry committee in March how the proposed change to PIPEDA could affect “opportunistic” insurance fraud.

“For example, a driver hits a guardrail and then invites a friend, a ‘jump-in,’ to falsely state that he was also in the vehicle and suffered an injury for which he then claims compensation,” Bundus said at the time. “Opportunistic claims are handled by insurers, but PIPEDA does not allow one insurer to verify facts by reaching out directly to another insurer that might also have been victimized by the suspected fraudulent incident.”

Another expert addressing the committee was University of Ottawa law professor Michael Geist, who expressed concern about the proposed PIPEDA amendment.

He said organizations who disclose data without individuals’ knowledge “should be at some point in time required to notify affected individuals within a reasonable time.”

Once an investigation is concluded “or a reasonable amount of time has passed, either get a court order to continue the secrecy or disclose the disclosure to the affected individual,” Geist added.