Regulatory Affairs Symposium: Privacy rules still unclear

Almost a year into the insurance industry’s experience with new privacy legislation, many key issues remain unresolved, say panelists at the Insurance Bureau of Canada’s (IBC) Regulatory Affairs Symposium Thursday.The panel, which included three lawyers and a member of the federal privacy commission, looked at scenarios potentially facing insurers and found there was as much room for dissention as agreement in how the industry should be responding to privacy issues.For example, in the case of vehicle data systems, or “black boxes”, panelists could not come to agreement on whether such data could be used without violating the driver’s privacy rights, or even if such rights extend to a driver if they are not the vehicle owner. Also, when it comes to what constitutes “personal information” under the new federal privacy legislation or superceding acts in place in some provinces, there are still many questions about such issues as email addresses, explains Heather Black, assistant privacy commissioner of Canada. That said, Black suggests “this is not the time to panic” when it comes to privacy compliance. She has not yet had to make recommendations on an insurance incident and she says her office is focused on attempting to resolve complaints first, before recommending any penalties.Lawyer Vivian Bercovici, vice president of legal and public affairs for The Dominion of Canada General Insurance Co. says a reasoned approach to privacy is needed. There is still a great deal of “excitement/hysteria” around just what the privacy rules mean, but the intent of the legislation needs to be taken into account, she says. On the underwriting side, most insurers have already had clients sign something which gives them the ability to use personal information as is necessary, but the concerns rest more on the claims side she suggests the consent of insureds can be taken as implied if it will lead to their claim being paid more quickly.Black says the form of consent expressed or implied is less crucial than ensuring that that consent is knowledgeable, i.e. that customers know outright the possible uses to which their information may be put.