Thank you, Frank.
Thank you, Mr. Chairman and members of the committee. I would like to provide you with a brief background in the next few minutes to the various issues that we have discussed in part IV of the CLHIA's written submission.
Life and health insurers operate on a national basis and deal with a very large number of Canadians, as Frank indicated. In addition, Canadian insurers also carry on their business operations internationally in locations including the U.S., China, India, and the U.K. The operations of life and health insurers cover a variety of personal situations, including financial planning for a potential death, the processing of a disability claim, reimbursing the costs of prescription drugs and other health care expenses, and administration of savings plans or employer pension plans.
These insurance, pension, group benefit operations involve thousands of transactions each day. As these transactions vary in nature, so do the insurers' needs for personal information. We believe a brief description of the parties and individuals involved in our life and health insurance industry might be helpful as context for our issues.
In the group environment, the insurer may insure the benefit plan or only administer an employer's group benefit plan or group pension plan. That's where the employer self-insures its plan.
As well in the group environment, the players then involve the employer, the employee, the employee's dependants, which would be spouse or children, and of course the insurer. It also involves a possible third-party administrator who's retained by the employer to help administer premium payments, etc., and also likely a consultant or advisor to help the employer decide on what should go in their benefit plan.
In the individual insurance world, the players would include the individual policyholder; perhaps a life insured, different from the policy holder; an adviser; and the insurer. In all types of life insurance--individual, group, or pensions--there are also beneficiaries. So you can appreciate the different types of information that would be required to be collected from each of those individual players in the insurance world.
As for the type of information we collect and use under an individual life insurance policy, detailed medical and financial information may be collected when the individual applies for insurance. This is then used to assess the applicant's eligibility for coverage. That file, then, may be relatively dormant for several decades until a death occurs and then a claim is made. In contrast, under most group employee benefit plans, whether insured or just administered by insurers, the insurer is required to collect a small amount of personal information initially, such as name, date of birth, beneficiary designation, and dependents' names. Additional information is collected when a claim actually occurs for the cost of a prescription drug or at the time of a disability, for example. At that time, sufficient additional information must be collected and used to process the claim.
In contrast to the banks, national or international organizations that are provincially regulated are required to contend with an array of privacy legislation across Canada. A transaction that involves the transfer of information from an individual or organization subject to one protective regime--for example, a physician complying with Alberta's Health Information Act--to an individual or organization subject to a different regime, such as an insurer subject to Quebec's private sector legislation or to PIPEDA, will have to meet the requirements of both regimes with respect to consent to disclose under one and consent to collect and use under the other. An employee resident in B.C. may expect that B.C. privacy legislation will apply, but if her employer is located in Ottawa and the insurer processes claims in Toronto, PIPEDA will apply.
In this environment a lack of clarity, gaps, overlaps, or inconsistencies in the legislation can create confusion and unnecessary administrative complexity for life and health insurers, and confusion for their customers. We believe that the coordination or harmonization of the provisions of PIPEDA with privacy legislation at the provincial level would help to avoid such confusion for consumers, organizations, and regulators alike. To appropriately balance the need to protect information privacy with the need to conduct efficient commercial activities, such as providing life and insurance products to Canadians, it is essential that harmonization be given high priority.
While the life and health insurance industry's experience during the three years it has been subject to PIPEDA has been that the current rules are generally workable, a large portion of our specific comments in part 4 of our submission fall under the category of harmonization, with a view to making the provisions under PIPEDA “more practical and more predictable”, to use the words of the Privacy Commissioner.
One of those specific comments relates to the detection and deterrence of fraud. The impact of fraudulent and deceptive conduct on insurance and other financial services can be extremely costly and damaging. Efforts to minimize them are essential. Fraudulent and deceptive conduct can involve a small number of consumers, service providers, and other parties not directly involved with the contract.
Our efforts to control the incidence of fraud in our industry are not in conflict with our protection of personal information, but the current provisions need to be adjusted to make our efforts work better. Specifically, there is a gap in PIPEDA that restricts our ability to disclose information without the consent of an individual for the purpose of conducting an investigation into a breach of an agreement or a law of Canada.
It is the industry's view that instead of, or in addition to, a system of investigative bodies, PIPEDA should be amended to adopt the model used in both Alberta and B.C.'s PIPAs, which allow collection, use, and disclosure of personal information without consent for the purpose of an investigation. In this way, the range of acceptable circumstances as to when personal information can be collected, used, and disclosed during an investigation can be more clearly set out and understood by all parties.
