The following case summary was re-posted on November 22, 2005; some of the insurance industry terminology was changed to provide for greater accuracy. On November 30, 2005 the case summary was again updated with information on the company's response to our recommendations.

PIPEDA Case Summary #2005-314

Insurance company denies access to personal information in third party claimant's statement

(Principle 4.9 of Schedule 1; subsection 9(1))

Complaint

An individual claimed that an insurance company, with which she has automobile insurance coverage, denied her access to her personal information.

Summary of Investigation

A third party had filed a claim alleging that the complainant had damaged the third party's vehicle. The incident was investigated by the adjuster under contract with the complainant's insurance company. The adjuster accepted the claim and determined that the complainant was at fault. The complainant, however, disputed the claim.

The complainant, the adjuster, and the insurance company's claims manager exchanged correspondence on several occasions with regard to the dispute over the complainant's liability. During these exchanges, the complainant asked for various pieces of information about the claimant, such as the name of her insurance company and a written account of the claim. This correspondence was exchanged prior to January 1, 2004, when the insurance company became subject to the Personal Information Protection and Electronic Documents Act (the Act).

Unable to obtain the information she wanted and dissatisfied with the handling of the dispute, the complainant contacted the provincial superintendent of insurance. The complainant received a response that addressed the dispute and also informed her that her insurer should be prepared to show her everything on her file, including the third party’s statement to the insurer that she had requested several times. The complainant requested assistance from the superintendent's office in accessing the third party’s statement. To this end, the provincial government's director of insurance wrote to the insurance company's claims manager, to confirm in writing that the complainant was requesting various documents, including the third party’s statement.

The claims manager contacted the claimant and tried, unsuccessfully, to obtain her consent to share her statement with the complainant. The insurance company wrote back to the director of insurance stating that it could not release the claimant's statement without the claimant's consent because of the Act's consent provisions.

Findings

Issued August 9, 2005

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. An exception to access is included in subsection 9(1), which states that an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the information about the third party is severable from the record containing the information about the individual, the organization shall sever the information about the third party before giving the individual access.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• Based on her review of the third party claimant’s statement to the insurer, the Assistant Commissioner was of the opinion that some of the information in the statement was the complainant's personal information.
• While she noted that the statement also contained the third party claimant's personal information, this information could be severed in the manner described in subsection 9(1), and the complainant's personal information provided to her.
• As this had not been done, and instead the complainant was denied access to the entire document, the Assistant Commissioner determined that the insurance company had denied the complainant access to her personal information, contrary to Principle 4.9.

The Assistant Commissioner concluded that the complaint was well-founded.

Further Considerations

The Assistant Commissioner recommended that the company sever the personal information of the third party claimant and provide the complainant with access to her personal information. She also recommended to the company that:

• The adjusters who work on its behalf notify third party claimants that their statements to the insurer will be shared with the insured person upon request; and
• That, for the purposes of providing access, only the personal information of the third party claimant that is not directly related to the statement to the insurer be severed from the statement.

The Assistant Commissioner asked the company to report back to her regarding these recommendations.

Update

On September 9, 2005 our Office received written notice from the company that it had provided the complainant with a copy of the third party claimant’s statement, with the relevant personal information of the claimant severed. We were also informed that the company had also heeded and implemented our recommendations with respect to its practices.