Consent provided during application for benefits allows insurer to share client's personal information with third-party broker

PIPEDA Report of Findings #2015-003

April 14, 2015

---

After being injured in an automobile accident, a woman applied for benefits through her insurer. Because of the long-term nature of her benefits, her insurer later opted to arrange a structured settlement annuity which would see long-term benefits paid to her throughout her life. In doing so, the insurer shared some of her personal information with a third-party insurance broker. The broker then shared some of this information with multiple annuity issuers, in order to obtain annuity quotes. When the complainant learned of this, she objected, saying that her personal information was used and disclosed without her consent. She then filed a complaint with our Office.

In her complaint, she claimed that the form she had signed to apply for benefits — OCF-1 - Application for Accident Benefits — was limited specifically to her insurer's internal assessment of her claim. The OCF-1 is a standardized form used in Ontario automobile insurance claims. It is approved by the Financial Services Commission of Ontario (FSCO), the regulator overseeing the legislation covering automobile insurance in the province. The consent language contained in the OCF-1 is standardized for all automobile insurance carriers in Ontario.

According to the complainant's insurer, the third party broker it used to arrange the annuity is a "financial advisor" as recognized by Part 12 of the OCF-1. The insurer also explained that a client's health information is required to determine an annuity quote because the total cost depends on the projections of the client's life expectancy.

Our Office examined the OCF-1 and compared its language describing the purposes for the collection, use and disclosure of the complainant's personal information with those purposes for which her insurer later shared her personal information. We were ultimately satisfied that the company did not share her personal information for purposes other than those she had consented to in signing the OCF-1. We also found that both "financial advisors" and "insurers" are named in the OCF-1 as parties to which an insurance company may disclose a claimant's personal information.

Consequently, our Office determined that the complaint was not well-founded.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the "Act" or "PIPEDA")

Summary of Investigation

1. The complainant was insured for automobile insurance when she was involved in a motor vehicle accident.
2. The complainant subsequently received benefits from her insurance company but several years later she began receiving her payments under a structured settlement annuity (the "annuity").

Complaint filed with this Office

3. The complainant claims that she never provided her consent to her insurer to use or disclose her personal information for a structured settlement annuity. More precisely, the complainant submitted that the form that she signed — OCF-1 - Application for Accident Benefits (the "OCF-1"), to apply for the subject benefits from her insurer — was limited to her insurer's internal assessment of the claim and did not cover this type of use or disclosure.
4. Consequently, she filed the current complaint with our Office.

Respondent's position

Annuities and personal information sharing

5. The respondent confirmed to our Office that it had arranged the annuity for the complainant and that, moreover, it is industry practice to use structured settlement annuities to facilitate the settling of claims such as the complainant's, given that automobile insurance is not organized to pay long-term benefits for severely injured claimants.
6. Concerning the sharing of personal information, the respondent stated to us that it relied on third-party organization to evaluate the claimant's health information and to provide this information to annuity issuers, as needed, to obtain annuity quotes. The respondent further explained that the insured's health information is required for the quote because the total cost of the structured benefits will depend on the annuity issuer's projections of the insured's life expectancy.

Consent and identified purposes

7. With regard to consent, the respondent stated to our Office that it believes the complainant consented to the disclosure when she completed the OCF-1. The respondent stated that the purposes for which it disclosed the complainant's personal health information to the broker were subsumed in the following purposes from Part 12 of the OCF-1:
   
   Investigating my claims and processing my claims as required by law, including the Ontario Automobile Policy
   
   and
   
   Obtaining or verifying information relating to my claims in order to determine entitlement and the proper amount of payment.
8. Further, the respondent considers the third party it used to arrange the annuity as a "financial advisor" for the purposes of Part 12 of the OCF-1.

Application for Accident Benefits - OCF-1

9. The OCF-1 is a standardized form used in automobile insurance claims. It is approved by the Financial Services Commission of Ontario (FSCO), which is the regulator that oversees the Insurance Act, the legislation covering automobile insurance in Ontario. Consequently, the consent language contained in the OCF-1 is standardized for all automobile insurance carriers; it is not specific to the insurance company in this case.
10. Our Office examined the OCF-1 that the complainant had signed. Part 12 speaks to the collection, use or disclosure of personal information as well as the purposes for using said personal information. It is cited below in part:
    
    I UNDERSTAND that you, and persons acting for you, will collect and use personal information and personal health information about me that is related to my claims for accident benefits arising out of the accident described in this application, and that all such information will be collected directly from me, or from any other person with my consent.
    
    I ALSO UNDERSTAND that this information will be collected and used only as reasonably necessary for the purposes of:
    
    1. Investigating my claims and processing my claims as required by law, including the Ontario Automobile Policy
    2. Obtaining or verifying information relating to my claims in order to determine entitlement and the proper amount of payment;
       [ … ]
    I ALSO UNDERSTAND that you, and persons acting for you, may disclose this information to the following persons, who may collect and use this information only as reasonably necessary to enable you to carry out the purposes described above:
    
    • Insurers; insurance adjusters, agents and brokers; employers; health care professionals; hospitals; accountants; financial advisors; solicitors; organizations that consolidate claims and underwriting information for the insurance industry; and my agents or representatives as designated by me from time to time.
    I CONSENT to you collecting, using and disclosing this information in the manner described above, but no more of such information than is reasonably necessary to meet the legitimate purpose of such collection, use or disclosure.
    (Our italics)

Application

11. In making our determinations, we applied Principles 4.3 and 4.3.2 of Schedule 1 of PIPEDA.
12. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.
13. Principle 4.3.2 requires "knowledge and consent". It stipulates that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

Findings

14. At issue is whether, pursuant to Principle 4.3, the complainant's insurance company obtained the complainant's consent to use and disclose her personal health information to obtain an annuity via third party organizations. Germane to this issue is whether the purposes for the consent were presented by her insurance company in a manner that could be reasonably understood (Principle 4.3.2).
15. The investigation revealed that the complainant signed the OCF-1, which contains explicit language concerning the collection, use and disclosure of her personal information, including for personal health information. The OCF-1 also contains a detailed list of the purposes for the collection and use of personal information as well as an exhaustive list of parties with whom information may be shared in order to carry out the described purposes.
16. Our Office's comparison of the purposes described in the OCF-1 (to which the complainant had consented) with those for which her insurance company later shared the complainant's personal information revealed that the latter are subsumed in the former. That is to say, in our view, her insurance company was not sharing the complainant's personal information for purposes other than those to which she had consented to when she signed the OCF-1. We also note that both "financial advisors" and "insurers" are named in the OCF-1 as parties to which her insurance company may disclose a claimant's personal information and that the disclosure to the third parties in question fit those descriptions.
17. The use and disclosure in this case clearly occurred in relation to the processing of the complainant's claim with her insurer, specifically to arrange for an annuity for payment.
18. In our view, for the purpose of processing her claim, the complainant's insurance company had her consent to share her personal medical information with the third parties involved in this complaint. Principles 4.3 and 4.3.2 were thus upheld.

Conclusion

19. Accordingly, the matter is not well-founded.