The Freedom of Information and Protection of Privacy Act
(FOIPPA) restricts the ability of the Insurance Corporation of British Columbia (and other public bodies) from using personal information in its database for the purposes of investigating and settling claims. All insurers are subject to the similar provisions of the Protection of Privacy Act
(PIPA), although the references below are solely to FOIPPA.
When a contested claim is made, insurers are under an obligation to investigate. This may involve such measures as contacting employers or fellow workers for information about income loss, or communicating with an insured’s friends and acquaintances to confirm disability claims. The information that an insurer has on file can be used for this type of investigation.
However, before using personal information, an insurer should ensure that it is complying with privacy laws. FOIPPA defines "personal information" very broadly as "recorded information about an identifiable individual other than contact information" — essentially, that is, anything other than a person’s business address and phone number. Insurers therefore have a great deal of information on file that is personal information, governed by Section
32
of FOIPPA, which states:
A public body must ensure that personal information in its custody or under its control is used only (a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose (see section
34), (b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use, or (c) for a purpose for which that information may be disclosed to that public body under sections 33 to 36 .
When consent is not given, an insurer must resort to Section
32 (a) or (c).
With the former, the use of the information must be consistent with the purpose for which it was originally obtained or compiled. Section
34
defines "consistent purpose" as being present "if the use (a) has a reasonable and direct connection to that purpose, and (b) is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses or discloses the information or causes the information to be used or disclosed."
If the insurer’s use of the information satisfies Section
34 , it is complying with FOIPPA.
Public bodies may use personal information for any purpose listed in Sections
33 to 36; specifically, Section 33 .1(1)(j) states that ICBC may disclose personal information if it "was obtained or compiled by that public body for purposes of insurance provided by the public body, and . . . disclosure of the information is necessary to investigate, manage or settle a specific insurance claim . . . ."
The meaning of "necessary" in the context of Section
33.1(1)(j) has not been judicially considered. However, in Re. K.E. Gostlin Enterprises Ltd.
(which considered its meaning in another context within PIPA), the Privacy Commissioner relied upon a 2004 Supreme Court of Canada decision, Society of Composers, Authors and Music Publishers of Canada v. Canadian Assn. of Internet Providers , in which the Court stated:
"Necessary" is a word whose meaning varies somewhat with the context. The word, according to Black’s Law Dictionary, ". . . may mean something which in the accomplishment of a given object cannot be dispensed with, or it may mean something reasonably useful and proper, and of greater or lesser benefit or convenience, and its force and meaning must be determined with relation to the particular object sought." (emphasis in original)
In
R. v. Pham
, a 2002 case, the British Columbia Court of Appeal considered the meaning of "investigative necessity" in respect to Section 186 of the Criminal Code . Quoting the Supreme Court of Canada, the Court stated:
In the final analysis, the potentially competing values in this area must be acknowledged. The words of the
Code
must be read with some common sense having regard both to the nature and purpose of the particular investigation which the police wish to undertake. A pure last resort test would turn the process of authorization into a formalistic exercise that would take no account of the difficulties of police investigations targeting sophisticated crime. But the authorizing judge must look with attention at the affidavit material, with an awareness that constitutional rights are at stake and carefully consider whether the police have met the standard.
This reasoning may be applied analogously to Section
33 .1(a)(j) of FOIPPA. An insurer, in determining if a disclosure is necessary, must balance the nature and purpose of the investigation against an individual’s right to privacy under FOIPPA. The test of necessity requires examining the nature of the information and the importance of the investigation to determine if less intrusive means than revealing personal information may accomplish the investigative goal.