We are all aware of the new trend toward Usage-Based Insurance Pricing or UBIP. UBIP technologies are capable of collecting detailed information about where, how and when vehicles are driven. Although the technology does not currently have the capability to identify who is driving a vehicle at any particular time, in many circumstances ie. where a vehicle has only one listed driver, the data collected by the device may reasonably be assumed to be about that individual The data collected is personal information as defined in the Personal Information Protection and Electronic Documents Act (PIPEDA). The Financial Services Commission of Ontario, has issued a Bulletin on USBIP which, among other things, addresses privacy issues raised by this technology. The Bulletin makes it clear that insurers are responsible for ensuring that any UBIP that they roll out is in compliance with PIPEDA.
Some components of compliance emphasized by the Financial Services Commission are consent by the insured, voluntary enrollment, and full disclosure of how the information collected will be used and disclosed by the insurer or by any third party provider of the service to the insurer. Specifically, the Bulletin provides that:
Prior to enrollment, insurers need to inform consumers what personal information is being collected, who may use or have access to the information, how the information is being used, under what circumstances the information will or could be disclosed to other parties, and what their rights are with respect to the information. Consumers should also be made aware of, and given the opportunity to give or withhold consent to, any relevant changes to what or how personal information is collected, used or disclosed.
Any personal information collected through a UBIP program, or its accompanying devices or software, should not be disclosed to any other party unless expressly consented to by the person or as required by law.
In addition, enrolment in a SBIP program cannot be tied to other programs such as marketing, vehicle location services or assistance in emergency situations. Insurers cannot require customers to consent to the collection, use of disclosure of information beyond that required by the UBIP program. Consent should be "opt-in" not "opt-out" for any of these additional services or usages.
The Bulletin also reminds insurers of their obligations regarding data accuracy, security and storage.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
