B.C. judge quashes order requiring insurer to review all credit score consent forms obtained since 2004

A British Columbia court ruled last week in favour of Economical Mutual Insurance Company when it set aside orders from the province’s Information and Privacy Commissioner that would have required the carrier and its brokers to review all credit score consent forms obtained from home policyholders since 2004.

In 2011, a delegate for the Information and Privacy Commissioner ruled that Economical had “not adequately” informed one home policyholder, Alfred Hughes, and his wife, that their credit information could be collected for the purpose of underwriting or assessing future risk of loss.

Court records indicate that Hughes and his wife were insured by Federated Insurance Company of Canada, later acquired by Economical. When they applied for their policy in 2003, they used a standard form created in October 1996 by the Centre for Study of Insurance Operations (CSIO).

That form included a statement that the applicants “agree that reports containing personal, credit, factual record, premium payment or claims history information may be sought or exchanged in connection with this application for insurance or renewal, extension, variation or cancellation thereof.”

The form has since been updated.

In September 2008, the Hughes’ home was burglarized and they settled a claim the following year. However, Hughes later found out that Economical had sought information on his credit score prior to renewing his policy, so he complained to the provincial Information and Privacy Commissioner that Economical had breached his privacy by looking into his credit score.

The Information and Privacy Commissioner in 2011 appointed a delegate to conduct an inquiry. The province’s Personal Information Protection Act, which came into force Jan. 1, 2004, provides that an organization must not collect, use or disclose personal information unless it has the express or implied consent of the individual who the information is about” or unless the law “otherwise authorizes the collection, use or disclosure of the information.”

Upon completing an inquiry into a complaint, the B.C. Information and Privacy Commissioner is required by law to “dispose of the issues” by making an order. An organization subject to an order must comply unless an application for judicial review is brought. An organization that fails to comply can be fined up to $100,000.

In the case of Economical, the Information and Privacy Commissioner’s delegate ruled in May, 2011 that Economical’s use of Hughes’ Canadian Property Loss Score (CPLS) “was for a purpose that a reasonable person would consider appropriate,” and that Economical “can require consent to collection of a credit score for the purpose of assessing future risk of loss as a condition of supplying homeowner’s insurance.”

However, the delegate also ruled there was “no deemed consent” in Hughes’ case, nor did Economical give Hughes “adequate notice of its purpose for collecting his CPLS or credit score.”

She noted that in order to satisfy the notice requirements in the Personal Information Protection Act, policyholders would have to be told that their credit information may be collected for the purpose of assessing future risk of loss, so it was “not reasonable,” when using the language of the 1996 CSIO form, to expect consumers to understand how Economical would actually use their credit scores.

Economical did not challenge the finding that Hughes had not been provided with adequate notice when using the 1996 CSIO form. However, the carrier did challenge the delegate’s orders.

Economical was ordered, in 2011, to “provide all home insurance policyholders who have not been provided with adequate notice, and all present and future applicants for home insurance, with notice that a credit score based on their credit information may be obtained for the purpose of assessing future risk of loss in connection with underwriting their policies.”

The delegate also ordered Economical to “review the consents it has obtained from home insurance policyholders” since the privacy law came into force on Jan.1, 2004 “and ascertain whether these individuals have been provided with notice that a credit score based on their credit information may be obtained for the purpose of assessing future risk of loss in connection with underwriting their policies.”

One affidavit cited by the court suggested that Economical Insurance has thousands of applications stored in hundreds of brokers’ offices, and in case when a broker submits a paper form application, the copy is stored for two years and then destroyed.

Economical objected to the Information and Privacy Commissioner’s orders on the grounds of procedural fairness and on the grounds that they would impose hardship and costs on brokers in B.C.

In his decision May 22, 2013, Mr. Justice Richard Goepel of the Supreme Court of B.C. noted that the delegate conducting the inquiry of Hughes’ complaint was required to “confine her orders to the ambit of the question before her.” The issues before her, Judge Goepel added,  “did not include notice to or consents given by” policyholders other than Hughes.

The effect of the orders, Judge Goepel added, was that Economical would be required to determine whether the CSIO standard forms in 2003 and 2008 provide adequate notice under the provincial privacy law. He found that nothing in the provincial law “allows the delegation of such a decision to an organization whose conduct is the subject matter of the inquiry.”

Judge Goepel set aside the orders against Economical, and also found that a settlement, in a separate case heard by the Office of the Privacy Commissioner of Canada, provided that all new applicants for insurance would be given notices explaining how Economical collects and uses personal information, including CPLS scores. That case arose from a complaint against Economical Insurance and credit rating firm Equifax.

Because under that settlement,  Judge Goepel wrote, Economical was required to start sending out notices July 19, 2012. This means that by July 18, 2013, “all of Economical’s British Columbia policyholders will have been provided with a copy of the notice.”

Judge Goepel also noted that the B.C. Information and Privacy Commissioner can still initiate an investigation into how carriers obtain consent to obtain credit scores. Section 36 of the Personal Information Protection Act gives the commissioner the power to initiate investigations and audits, whether a complaint is received or not, if the commissioner is satisfied there are reasonable grounds to believe that an organization is not complying” with the law.