Source: http://mccagueborlack.com/emails/articles/privacy-law.html
Timestamp: 2019-04-20 22:11:25+00:00

Document:
The last 20 years have seen radical advances in technology, the like humankind has never known. The revolutionary way in which data can now be stored, catalogued, and shared has arguably led to a significant “digitization” of individuals. Simply, more of our lives are being recorded than ever before, whether it be voluntary (Facebook, Instagram, Snapchat etc.) or involuntary (intelligence gathering, surveillance etc.).
In light of this digitization, there has been a growing pressure to carve out a space where neither corporations nor government can intrude on the individual, and when they do, to govern what can be made of that information. This is essentially the concept the law recognizes as “privacy”.
While the courts continue to grapple with how the common law should expand and react to the growing need to protect individual privacy, governments have taken legislative steps to assist in filling the legal void.
It is now well – accepted PIPEDA applies to insurance companies, and more specifically, to the accident benefits process.
The government of Canada, for example, enacted the federal Privacy Act on Canada Day in 1983. This legislation governs the collection, use, and disclosure of “personal information” by federal government institutions.4 The provincial equivalents in Ontario are the Freedom of Information and Protection of Privacy Act5 and the Municipal Freedom of Information and Protection Act.6 When an individual makes a request under either of these acts, they are commonly referred to as FIPPA or M-FIPPA (pronounced “fippah” and “em-fippah” respectively) requests.
Insurers, of course, are not government institutions and as such, the above – noted pieces of legislation have no applicability. The only importance that the Privacy Act holds for insurers is that it also established the Office of the Privacy Commissioner of Canada, an independent office which acts as the enforcer – along with the courts – of federal privacy legislation.
It is now well-accepted PIPEDA applies to insurance companies, and more specifically, to the accident benefits process.
PIPEDA applies to private sector organizations when they are acting commercially. The definition of “organization” in PIPEDA is broad and covers corporations, associations, partnerships, sole proprietorships and individuals.9 As such it applies to a first-party statutory accident benefits insurers, since an accident benefits insurer could be classified as a private sector organization acting commercially.
PIPEDA only applies to personal information. Personal information is defined as any “information about an identifiable individual”.10 The Courts have commented that this definition is “very far reaching” and “remarkably encompassing”.11 It has been found to include information such as names, birth dates, income, physical descriptions, medical histories, genders, religions, addresses, political affiliations, beliefs, education, employment, and visual images such as photographs and videotape where individuals may be identified.
Personal health information, which is defined in PIPEDA, is just a subset of personal information.
Once PIPEDA has been found to apply, the legislation goes on to regulate the collection, the use, and the disclosure of “personal information”.
...the most onerous effect of PIPEDA is its obligation to account for, and disclose, information to an individual.
An organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party, unless the information about that third party is severable (s. 9(1)).
the information was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act (s. 9(3)(f)).
PIPEDA, as federal legislation, is enforced by the Office of the Privacy Commissioner of Canada. There are two stages to a complaint: the investigation and the report.
The investigation process is handled by an investigator on behalf of the Privacy Commissioner. Most investigators simply take an informal approach between the complainant and the organization, in order to reach a resolution. Mediation and conciliation are two express powers given to the Commissioner.
During the investigation stage, the investigator is bestowed with significant and extensive powers. This includes the power to summons any person to give testimony, and even enter any premises occupied by an organization to interview individuals. In the event that a resolution cannot be met, the investigator will issue a report setting out the findings.
The investigator involved in a complaint process cannot grant remedies. However, once the findings are made, the complainant can then bring an action in the Federal Court based on the complaint regardless of the findings of the OPC (positive or negative). The action before the court is a fresh hearing (known as a hearing de novo), and the court can order damages.
Adjusting a claim implicit requires a gathering of relevant information. Accident benefits claims, in general, require a significant amount of information to adjust on an on-going basis, and as such, privacy legislation should be a forefront concern for insurers.
the Application for Accident Benefits (OCF – 1)...contains mandatory consent language which facilitates and enables the insurer to adjust the accident benefits claims file.
Any information reasonably required to assist the insurer in determining the applicant's entitlement to a benefit.
A statutory declaration as to the circumstances that gave rise to the application for a benefit.
The number, street and municipality where the applicant ordinarily resides.
Proof of the applicant's identity.
(6) The insurer is not liable to pay a benefit in respect of any period during which the insured person fails to comply with subsection (1) or (2).
Of course, s. 33 does not explicitly discuss what use can be made of the information gathered or to whom the information may be disclosed. What if it is necessary to provide a self-employed insured's tax returns to an accountant to calculate the income replacement benefit?
For this reason, the Application for Accident Benefits (OCF-1) – which is signed by the applicant and submitted to the insurer – contains mandatory consent language which facilitates and enables the insurer to adjust the accident benefits claims file. It is contained at the last (8th) page of the OCF-1 and is immediately above the signature area.
I UNDERSTAND that you, and persons acting for you, will collect personal information and personal health information about me that is related to my claims for accident benefits arising out of the accident described in this application, and that all such information will be collected directly from me or from any other person with my consent.
I ALSO UNDERSTAND that you and persons acting for you will collect information about my driving record, automobile insurance policy history and automobile insurance claims history if they exist.
I ALSO UNDERSTAND that if I am the holder of an automobile insurance policy, you, and persons acting for you, will collect the driving record, automobile insurance policy history and automobile insurance claims history of any listed drivers on my automobile insurance policy or other drivers whom I have permitted to drive my automobile.
Assessing underwriting risks and claims experience.
I ALSO UNDERSTAND that you, and persons acting for you, may disclose this information to the following persons or organizations, who may collect and use this information only as reasonably necessary to enable you or them to carry out the purposes described above: Insurers; insurance adjusters, agents and brokers; employers; health care professionals; hospitals; accountants; financial advisors; solicitors; organizations that consolidate claims and underwriting information for the insurance industry; fraud prevention organizations; other insurance companies; the police; databases or registers used by the insurance industry to analyze and check information provided against existing information; and my agents or representatives as designated by me from time to time.
I ALSO UNDERSTAND that you, and persons acting for you, may pool this information with information from other sources and may analyze this information for the limited purpose of preventing, detecting or suppressing fraud.
I CONSENT and, if I am the holder of an automobile insurance policy, declare that I have obtained consent from the listed drivers on my policy and any other drivers whom I have permitted to drive my automobile, to you collecting, using and disclosing this information in the manner described above, but no more of such information than is reasonably necessary to meet the legitimate purpose of such collection, use or disclosure.
I UNDERSTAND that if I have any questions about this consent I am free to consult with my insurance company representative or legal advisor before signing this document.
I AM ALSO AWARE that you, and persons acting for you, may be required or permitted by law to disclose this information to others without my knowledge or consent.
I CERTIFY THAT THE INFORMATION PROVIDED IS TRUE AND CORRECT. I UNDERSTAND THAT IT IS AN OFFENCE UNDER THE INSURANCE ACT to knowingly make a false or misleading statement or representation to an insurer under a contract of insurance. I FURTHER UNDERSTAND THAT IT IS AN OFFENCE UNDER THE FEDERAL CRIMINAL CODE for anyone, by deceit, falsehood, or other dishonest act, to defraud or attempt to defraud an insurance company. This information will be used for processing payments of claims; identifying and analysing the nature, effects and costs of goods and services that are provided to automobile accident victims, by health care providers; and PREVENTING, DETECTING AND SUPPRESSING FRAUD.
...the purposes for the consent were presented by her insurance company in a manner that could be reasonably understood.
14. At issue is whether, pursuant to Principle 4.3, the complainant's insurance company obtained the complainant's consent to use and disclose her personal health information to obtain an annuity via third party organizations. Germane to this issue is whether the purposes for the consent were presented by her insurance company in a manner that could be reasonably understood (Principle 4.3.2).
15. The investigation revealed that the complainant signed the OCF-1, which contains explicit language concerning the collection, use and disclosure of her personal information, including for personal health information. The OCF-1 also contains a detailed list of the purposes for the collection and use of personal information as well as an exhaustive list of parties with whom information may be shared in order to carry out the described purposes.
16. Our Office's comparison of the purposes described in the OCF-1 (to which the complainant had consented) with those for which her insurance company later shared the complainant's personal information revealed that the latter are subsumed in the former. That is to say, in our view, her insurance company was not sharing the complainant's personal information for purposes other than those to which she had consented to when she signed the OCF-1. We also note that both "financial advisors" and "insurers" are named in the OCF-1 as parties to which her insurance company may disclose a claimant's personal information and that the disclosure to the third parties in question fit those descriptions.
17. The use and disclosure in this case clearly occurred in relation to the processing of the complainant's claim with her insurer, specifically to arrange for an annuity for payment.
18. In our view, for the purpose of processing her claim, the complainant's insurance company had her consent to share her personal medical information with the third parties involved in this complaint. Principles 4.3 and 4.3.2 were thus upheld.
Given the sensitivity that surrounds an individual's medical records, disclosure of health information to an independent medical examiner is often met with higher scrutiny than disclosure of other types of information.
44. (1) For the purposes of assisting an insurer to determine if an insured person is or continues to be entitled to a benefit under this Regulation for which an application is made, but not more often than is reasonably necessary, an insurer may require an insured person to be examined under this section by one or more persons chosen by the insurer who are regulated health professionals or who have expertise in vocational rehabilitation.
Indeed, an insurer would likely have breached its duty of good faith if did not produce all relevant medical documentation in its possession! Yet still, the insurer must be cautious of disclosing information in contravention of applicable privacy law.
Insurers; insurance adjusters, agents and brokers; employers; health care professionals; hospitals; accountants; financial advisors; solicitors; organizations that consolidate claims and underwriting information for the insurance industry; fraud prevention organizations; other insurance companies; the police; databases or registers used by the insurance industry to analyze and check information provided against existing information; and my agents or representatives as designated by me from time to time.
It is becoming more common that an insured will refuse to “consent” to the examination where an assessor requires a form of consent be executed.
In our experience, an applicant's counsel will sometimes attempt to interfere with the proper administration and adjusting of an accident benefits claim file by indicating the applicant “does not consent” to an independent medical examination under the Schedule. To that end, can an assessor require the applicant to sign a consent prior to the examination? If the applicant refuses to sign it, does this constitute a “refusal to attend” for the purpose of denying benefits?
The answer can be found in the arbitral decision of Arbitrator Wilson in Luther v. Economical14 as well as the Superior Court decision of Justice Beaudoin in Intact Insurance v. Anne Beaudry.15 Both decisions quite clearly stand for the proposition that some kind of consent can be required by a medical health practitioner duly appointed under the Schedule prior to the conducting of an assessment.
 An FAE by its very nature is challenging and may cause an individual to feel pain, and possibly more serious consequences. Likewise for the physiatry assessment, Dr. Clifford's consent form indicates that "some parts of the Physical Examination may cause you to feel pain" and that "on a few occasions, the movement will be passive – that is, Dr. Clifford will move a relaxed joint."
 However much they may be minimized, it is clear that examinations may involve both pain and touching. In the absence of consent, or other legal justification, at common law a battery would take place.
The College of Physicians and Surgeons of Ontario, being the regulatory body for medical doctors in Ontario, recommends that a consent form be signed.
Out of an abundance of caution, given the case law above and the recommendations of the CPSO, we always recommend that a consent be presented to an applicant regarding the conduct of the examination in order to protect the physician as well as the insurer.
Insurers will typically retain an IME centre to oversee the administration of the assessment. Administration includes the retaining of the appropriate medical health practitioner and clearing conflicts with the same, arranging for the assessment itself in terms of notice, transportation, venue and interpreter etc., and the organization of payment. The IME centre will also often employ quality assurance measures, such as editing for grammar and flow (not substantive changes for the opinion).
The IME centre itself typically does not employ IME assessors directly. Rather, the centre ordinarily has a roster of medical health practitioners which have contracted their services to the centre. The IME centre often integrates quality assurance measures into its roster as well to ensure high quality reports, timeliness, responsiveness, etc.
A growing issue is what needs to be disclosed to the applicant by the IME assessor, and the IME centre generally, when faced with a request under Principle 4.9 of PIPEDA. We have seen relatively innocuous requests for clinical notes and records of assessors on the mild end, all the way to the internal business contract between the insurer and the IME centre!
Needless to say, referencing PIPEDA does not automatically entitle a free-for-all in terms of disclosure.
The best guidance we have was provided to us by the Federal Court of Appeal in Wyndowe v. Rousseau.16 This was not an accident benefits decision, however, it involved a PIPEDA request for disclosure made to a physician, Dr. Wyndowe, for his notes and records as a result of an assessment conducted on behalf of a disability benefits insurer, being Maritime Life.
This area of insurance is of course nowhere near as regulated as automobile insurance and statutory accident benefits, but it does concern an IME.
49. In light of the Privacy Commissioner's recognition that there are in the notes information which is personal to Mr. Rousseau and information which is not, it may be said that in the end, Mr. Rousseau has a right of access to the information he gave the doctor, and to the final opinion of the doctor in the form of the report to the insurer. In accordance with Principle 4.9.1. of Schedule I to the PIPED Act, this enables Mr. Rousseau to correct any mistakes in the information he gave the doctor or which the doctor noted, as well as any mistakes in the doctor's reasoned final opinion about his medical condition. But the process of getting to that final opinion from the initial personal information of Mr. Rousseau belongs to the doctor.
It can therefore be said that information relating to process is information that is personal to the physician and therefore not disclosable.
Importantly, the right to information given to the physician would be satisfied by the production of the final report. This is because the information given to the assessor verbally during the assessment and any documentation reviewed for the same will be contained explicitly in the final report. The final report is both a catalogue of information and a final opinion.
Physicians should ensure that they have obtained and reviewed all available clinical notes, records and opinions relating to the patient or examinee that could impact the findings of the report, including the physician's final opinion and/or recommendations.
Draft medical reports, notes and records, quality assurance documentation etc. is all not disclosable as process. Further, the information given to the physician by the insured will be listed in the report along with the final opinion. The medical documentation reviewed by the physician is typically returned to the IME centre and not retained in the possession of the assessor.
Of course, an applicant is often entitled to draft reports through by way of arbitral Order. It is important to keep in mind what an applicant is entitled to under the Schedule is separate and distinct from the remedies available under PIPEDA.
The question therefore remains as to what the insured is entitled to from the IME centre itself.
Therefore, everything that the insured is entitled to under PIPEDA from an IME physician is satisfied by production of the final report by the insurer.18 The question therefore remains as to what the insured is entitled to from the IME centre itself.
Everything in the possession of the IME centre which is producible is already accessible from the insurer directly. This is an important fact. The IME centre and the IME physician are carrying out functions pursuant to Schedule on behalf of the insurer. To this extent, the IME centre and physician are merely independent agents of the insurer.
36. In the context of these two commercial relationships – between Dr. Wyndowe's corporation and Maritime Life on the one hand and between Mr. Rousseau and Maritime Life on the second hand – I find it hard to believe that by introducing a third relationship – between Dr. Wyndowe and Mr. Rousseau – the commercial nature of the overall transaction is defeated. In my view, Dr. Wyndowe is merely the medical agent of Maritime Life. If Dr. Wyndowe worked as a full time doctor for Maritime life, there would be no question the transaction is commercial; being examined by him would merely be a step which Mr. Rousseau had to follow to collect his benefits. In that sense the examination would be akin to filling out a form required by Maritime Life in order to begin collecting benefits. Just because Dr. Wyndowe is an independent consultant hired by Maritime Life does not change the fact that the overall transaction retains its commercial nature. It also does not change the fact that Mr. Rousseau was only doing what his contract with Maritime Life required him to do to maintain his benefits, i.e. submitting to an IME.
As of now, we have taken the position that a PIPEDA request cannot be made to the IME centre directly without involving the insurer. The requirement that the insured advance a PIPEDA request to the insurer allows the insurer to adjust the claims file and adhere to its duty of good faith by not creating an external relationship between the assessor and the applicant directly.
It is clear that PIPEDA cannot simply be inserted into the accident benefits process without disruption of this comprehensive scheme. One of the most disruptive elements which has come to light in our recent experience is the request by insureds to “correct” independent medical examination reports by demanding changes from the assessor directly.
4.9.5 When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.
As stated earlier, the assessor functions as the medical agent of the insurer the purpose of completing an examination under the Schedule. The assessor merely carries out the functions of the Schedule delegated to it by the insurer who is in turn empowered by legislation and regulation.
The insured cannot contact and demand changes to a report, or an addendum, outside of the processes of the Schedule. Doing so not only frustrates the ability of the insurer to adjust the claim fairly, it allows the insured to step between the insurer and its own agent thereby creating a separate relationship not contemplated by the Schedule. Arguably, exercising this right is a breach of the duty of good faith of the insured to the insurer, which we have noted earlier to be reciprocal.
...while there is currently limited case law on the application of PIPEDA, this will change rapidly in the coming years.
In effect, the insured would be entitled to “correct” a report vis-à-vis the insurer, who again is using that information to adjust the claims file. The insurer is then responsible under principle 4.9.5 to transmit said amended information to the assessor for an addendum pursuant to s. 44, which it would be obligated to do anyways under its duty of good faith.
Privacy is an important but infantile area of law; while there is currently limited case law on the application of PIPEDA, this will change rapidly in the coming years.
Should an issue concerning an applicant's right to privacy arise in the course of the adjusting of an accident benefits, whether that be after a complaint or before one is alleged at all, it is vital that legal advice be sought in order for the insurer to maintain its duty of good faith and be in compliance at all times with applicable privacy law.
1 Jones v. Tsige, 2012 ONCA 32.
2 Jane Doe 464533 v. N.D., 2016 ONSC 541.
3 Jones v. Tsige, 2012 ONCA 32 at para. 67.
4Privacy Act, RSC 1985, c P-21.
5 Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31.
6 Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M. 56.
7 Personal Information Protection and Electronic Documents Act, SC 2000, c 5. [PIPEDA]. PIPEDA came into force between 2001 and 2004 in stages.
8 PIPEDA, supra, s. 4(1).
9 PIPEDA, supra at s.2(1). .
10 PIPEDA, supra s. 2(1).
12 Subject to minor exceptions, such as artistic or literary purposes.
13 PIPEDA Report of Findings #2015-003.
16 Wyndowe Appeal, supra note 46 at TAB U.
18 Of course, the insured could apply for an arbitral Order for production of the same. It is for this reason that PIPEDA requests seeking these documents appear to be a litigation strategy to place administrative costs on the IME assessors and undermine the relationship between the insurer and the insured through a third party.
19 See e.g. Babakar v. Brown, 2010 ONSC 255.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.