Under the Act respecting the Protection of personal information in the private sector (ARPPIPS), any person carrying on an enterprise must adopt and implement measures to protect the personal information that it holds on another person. The general principle underlying the ARPPIPS is that the communication of personal information may only take place if the person concerned has given his consent. In certain exceptional cases provided for under the ARPPIPS, such consent is not necessary. Let’s look at three examples of such exceptions in the field of damage insurance.

A REMINDER CONCERNING OBLIGATIONS

All the records firms hold contain personal, confidential information on clients such as their names, home addresses, telephone numbers (home and cell), e-mail addresses and banking information. In a nutshell, personal information is information on a natural person that would enable his or her identification.

Confidentiality must be protected at every stage of the personal information’s “life cycle” (collection, communication, use, holding, preservation and destruction), regardless of the nature of the medium used to preserve the information and the form in which it is accessed, be it written, graphic, taped, filmed, computerized, or other.

Before and during the collection of personal information, the person concerned must be informed of the object of the file, in other words, the purposes for which the information is collected and recorded in the file. The person must also be made aware of how the personal information will be used, where it will be kept, and who will have access to it, as well as be informed of his or her rights to access personal information in the file and make rectifications to it. The purpose of this is to enable the individual to give his manifest, free and enlightened consent. Furthermore, consent—which is also required for the communication or use of personal information—must be given for specific purposes and for a set length of time in order for it to be valid.

THREE CASES OF COMMUNICATION TO A THIRD PERSON WITHOUT PRIOR CONSENT

All certified damage insurance professionals are therefore obliged to respect the confidentiality of the personal information they hold concerning a client and only use such information for the purposes for which it was obtained, unless they are relieved of this obligation by a provision of law or an order of a competent court.¹

The ARPPIPS contains approximately ten exceptions that allow the communication and use of personal information without the consent of the person concerned, notably under section 18. For example, personal information may be transmitted without the consent of the person concerned to the “Director of Criminal and Penal Prosecutions if the information is required for the purposes of the prosecution of an offence under an Act applicable in Québec” or to “a person who is authorized by law to recover debts on behalf of others and who requires it for that purpose in the performance of his duties.” It should nevertheless be noted that only indispensable personal information may be provided in order to perform one’s duties or as part of a prosecution mentioned above.

Here are three concrete examples of such exceptions that ChAD professionals have encountered in the past:

• SUMMONS TO APPEAR BEFORE A TRIBUNAL

A professional has received a summons to appear before a tribunal and is required to produce a client-file in his possession. Since he cannot refuse to appear or to produce the documents requested, he contacts the ChAD to find out how to comply while continuing to respect the confidentiality of the personal information contained in the file.

If the document or evidence the court requests contains personal information, the professional must tell the court, at the time he provides it, that he is ethically obliged to protect the information contained therein. This does not mean giving unfettered access to the file if the tribunal only asks for information specifically related to the dispute. Only information that is necessary and indispensable should be handed over.

The tribunal will ensure that it too respects the obligation to confidentiality. For example, when evidence presented to the Discipline Committee of the ChAD contains personal information on insureds, the Committee issues an order to ban the disclosure, publication and release of all personal information that identifies the insureds mentioned in the evidence filed with the tribunal, pursuant to section 142 of the Professional Code.

• A MINISTRY REQUEST FOR INFORMATION

In another case, a professional receives a request from a ministry or government body such as Revenue Quebec to provide information on an insured. Furthermore, pursuant to their legislation, certain bodies have investigative powers that allow them to obtain personal information without first having to ask the person concerned for his consent.

Under section 18 of the ARPPIPS, the professional may communicate the information without the insured’s consent. However, he must make sure to obtain a written request that releases him from his obligation to maintain confidentiality and keep it in his files for any future use.

• AN INVESTIGATION BY THE SYNDIC’S OFFICE OR THE AUTORITÉ DES MARCHÉS FINANCIERS

If the Syndic’s Office of the ChAD is conducting an investigation of a client’s file, the Office may request and obtain personal information without the insured’s consent. The same applies to investigations undertaken by the Autorité des marchés financiers. It should be remembered that pursuant to their Code of Ethics, professionals are obliged to cooperate with these bodies.

1. The Code of ethics of damage insurance representatives, section 23, and the Code of ethics of claims adjusters, section 22.