Insurance Company's 'Formal Dispute Resolution Process' Not Formal Enough To Avoid PIPEDA Access Request

The Office of the Privacy Commissioner of Canada ("OPC") investigated a complaint made to its Office after an insurance company refused to provide a policyholder access to her personal information relating to a joint home insurance policy she held with her husband. The policyholder had made her original request for access pursuant to the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 ("PIPEDA"), which the insurance company had denied.

The policyholder then made a complaint about the denial of access to the Office of the Ombudsman ("Ombudsman") for the insurance company's parent company, which is a bank ("Bank"). The insurance company continued to deny the policyholder access, and also denied the policyholder access to any subsequent information generated following her complaint filed with the Ombudsman. The policyholder had sought access to a recorded telephone conversation along with emails, internal reports and other communications related to a claim. The policyholder then complained to the OPC, which investigated.

In its submissions, the Respondent insurance company attempted to rely on three exemptions to disclosure in order to support its refusal to provide access to the complainant: first, the Respondent relied on s. 9(1) of PIPEDA, which allows access to be denied if such access would reveal personal information about a third party (in this case, the Respondent argued that the complainant's spouse's consent was required); second, the Respondent argued that the Ombudsman's services were not a "commercial activity" and therefore beyond the scope of PIPEDA (which applies to those organizations in respect of personal information which the organization collects, uses or discloses in the course of commercial activities). Finally, the Respondent relied on paragraph 9(3)(d) of PIPEDA which exempts from disclosure information generated in the course of a "formal dispute resolution process".

Finding

The Commissioner, in its Report of Findings #2016-006, found that the Respondent violated PIPEDA when it refused access to the complainant's personal information. The Commissioner rejected the Respondents arguments.

Regarding third party information, the OPC found that despite the fact that the home insurance policy was held jointly with the complainant's spouse, the Respondent's proper response would have been to remove the third party's personal information (the complainant's spouse) and to provide access to the rest.

...