“Personal Information” is defined in PIPEDA as information about an identifiable individual. Personal Information includes, without limitation, information relating to identity, nationality, age, gender, address, phone number, e-mail address, social insurance number, date of birth, marital status, education, employment, health history, assets, liabilities, payment records, credit records, loan records, income and information relating to financial transactions as well as certain personal opinions or views of an individual. Personal Information, however, does not include the name, business title, business address or telephone number of employees of organizations.
TYPES OF PERSONAL INFORMATION COLLECTED
We collect personal information for the Identified Purposes outlined in this policy. The type of personal information that we hold depends upon the nature of your relationship with us, and includes, but is not limited to:
· name, address and telephone number;
· date of birth, family and marital status;
· credit rating and payment records;
· prior insurance experience including claims history;
· driver’s licence number, vehicle identification number (VIN) and driving record;
· banking and credit card information;
· medical and health information;
· employment and income information.
We use or disclose such information only for the Identified Purposes described below.
LIMITING THE COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION
We limit the collection, use and disclosure of your personal information to only what is necessary to provide you with the insurance protection that you have requested, or, in the case of a claim, to provide you with the compensation to which you are entitled. In order to do this, we collect, use and disclose your personal information for the following purposes (our “Identified Purposes”):
· offering and providing insurance products and services to you;
· establishing and maintaining communications with you;
· verifying your personal information with government agencies, brokers or agents, other insurers, insurance reporting agencies and credit bureaus;
· assessing and underwriting risks on a prudent basis;
· facilitating your payment of premiums and fees;
· investigating and payment claims;
· detecting and preventing fraud or other illegal activities;
· compiling statistics;
· complying with the law or requests of law enforcement agencies or regulators.
When we collect your personal information, we are doing so for all the Identified Purposes simultaneously. Therefore, you can expect that while we may initially use the data for underwriting your policy, we may subsequently use it for claim purposes, and vice versa.
We may, however, in accordance with PIPEDA, collect personal information without your knowledge or the consent if:
• The collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;
• It is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for the purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
• The collection is solely for journalistic, artistic or literary purposes;
• The information is publicly available;
• The collection is made for the purposes of making a disclosure to a government institution, or part of a government institution, that has made a request for the information, identified its lawful authority to obtain the information and indicated that its suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;
• The collection is made for the purposes of making a disclosure on the initiative of HBI to an investigative body, a government institution, or a part of a government institution and HBI suspects that the information related to national security, the defence of Canada or the conduct of international affairs; or
• It is required by law.
Consent is required for the collection of personal information and the subsequent use or disclosure of this information in accordance with the Identified Purposes. We may obtain your express consent or we may determine that consent has been implied by the circumstances. Express consent could be in writing (for example in a signed consent, e-mail or application form submitted to us), or verbally in person or over the telephone. We may imply consent when information is provided and submitted to us via an application or form on our website or app, or by access or use of our website or app, and the services provided thereon.
When we receive personal information from you in order to allow us to provide you with a requested product or service, your consent to allow us to use that personal information in a reasonable manner is implied. If you need to provide personal information about other individuals (such as other family members, employees, etc.), you must first obtain their consent for these purposes prior to your disclosure to us.
Providing us with your personal information is always your choice. When you request services from us, we ask that you provide the respective information that enables us to provide your requested services to the best of our abilities. When you do so, you will be authorizing us to use and retain this personal information in accordance with this policy.
We ask that you know our Identified Purposes and provide your consent to before we collect, use or disclose your personal information. We rely on the following actions by you as indication of your knowledge and consent:
· you provide your implied consent when you voluntarily provide personal information to miBroker;
· you provide your express consent when you complete a written, verbal or electronic application process;
· we may also ask for your express consent for a specified purpose.
We will not disclose your medical and health information, or your employment and income information, without your express consent.
Your consent remains valid even after the termination of our relationship with you, unless you provide us with written notice that such consent is withdrawn. By withdrawing your consent, or not providing it in the first place, you may limit or even prevent us from being able to provide you with the products or services desired.
This policy does not cover statistical data from which the identity of individuals cannot be determined. We retain the right to use and disclose statistical data as we determine appropriate.
You may withdraw your consent, subject to legal or contractual obligations and on reasonable notice, but this may limit our ability to provide you with the requested product or service. In the event that you wish to withdraw your consent, you should contact miBroker’s Privacy Compliance Officer first to understand the implications of such withdrawal, and then if you choose to proceed, give the requisite notice.
MAINTAINING ACCURATE INFORMATION
miBroker will work to keep your personal information as accurate, complete and up-to-date as is necessary for our Identified Purposes.
WE WILL ONLY USE YOUR PERSONAL INFORMATION FOR THE PURPOSES WE MENTIONED
In the event that we want to use your personal information for a purpose not previously identified, consent with respect to use or disclosure may be sought but before it is used.
We may, however, in accordance with PIPEDA collect personal information without your knowledge or consent for a variety of reasons, including:
• miBroker has reasonable grounds to believe the information could be useful when investigating a contravention of a federal, provincial or foreign law that has been or is about to be committed, and the information is used for that investigation;
• An emergency exists that threatens an individual’s life, health or security;
• The information is for statistical or scholarly study or research, the purposes of which cannot be achieved without using the information and the information is used in a manner that will ensure its confidentiality and it is impracticable to obtain consent and miBroker informs the Privacy Commissioner of the use before the information is used;
• The information is publicly available;
• The use is clearly in the individual’s interest and consent is not available in a timely way;
• miBroker reasonably expects that the collection with the knowledge and consent of the individual would compromise the availability or accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
• The disclosure is made to a government institution, or part of a government institution, that has made a request for the information, identified its lawful authority to obtain the information and indicated that it suspects that the information relates to national security, the defence of Canada, or the conduct of international affairs;
• The disclosure is made on the initiative of miBroker to an investigative body, a government institution, or a part of a government institution, and miBroker suspects that the information relates to national security, the defence of Canada, or the conduct of international affairs; or
• It is required by law.
PROTECTING YOUR PRIVACY
We are committed to protecting your privacy. We maintain physical, electronic and procedural safeguards to protect your personal information from unauthorized access.
We review our policies and practices, monitor our computer networks, test the strength of our security and monitor our compliance with relevant laws in order to help us ensure the safety of your personal information. We restrict access to your personal information to those employees whom we have determined need to know that information to provide products or services to you. In addition, our employees are bound by a Privacy Code of Conduct. Employees who violate these standards are subject to disciplinary measures.
There are situations where we will disclose personal information in accordance with our Identified Purposes. For example, as part of the underwriting handling process, we may transfer personal information to other insurance companies including reinsurance companies which share in the risk. Additionally, personal information may be disclosed to government agencies, brokers or agents, other insurers or insurance reporting agencies for underwriting, claims, classification and rating purposes. We may also disclose personal information to businesses that provide goods and services to insurance companies and their customers, such as claims adjusters, appraisers and repair shops. As well, we may disclose personal information to government and regulatory agencies as required by law. Only the information necessary for these services will be provided by us to these service providers, and it is done on the basis that they will maintain the confidentiality of the information. If we discover that third parties are improperly handling your personal information, we will take appropriate action to protect your personal information.
If you conclude your relationship with us, we will continue to safeguard the privacy of your personal information in accordance with this policy and as required by law.
Finally, personal information is retained only as long as it is needed, or to meet any legal, regulatory or tax requirements.
PIPEDA permits miBroker to disclose personal information to third parties, without an individual’s knowledge and consent only if the disclosure is:
• Made to a lawyer who is representing miBroker;
• Required to comply with a subpoena or warrant issued, or an order made by a court, person, or body with jurisdiction to compel the production of information, or to comply with the rules of the court relating to the production of records;
• Made to a government institution, or part of a government institution, that has made a request for the information, identified its lawful authority to obtain the information and indicated that:
· It suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;
· The disclosure is requested for the purposes of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purposes of enforcing such law; or
· The disclosure is requested for the purpose of administering any law of Canada or its provinces;
· Made on the initiative of HBI to an investigative body, a government institution, or a part of a government institution, and the organization:
· has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, or
· suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;
• Made to a person who needs the information because of an emergency that threatens the life, health or security of an individual and, if the individual whom the information is about is alive, miBroker will inform that individual in writing of the disclosure;
• For statistical, or scholarly study or research purposes that cannot be achieved without disclosing the information, it is impracticable to obtain consent and miBroker informs the Privacy Commissioner of the disclosure before the information is disclosed;
• Made to an institution whose functions include the conservation of records of historic or archival importance, and the disclosure is made for the purpose of such conservation;
• Made after the earlier of:
· one hundred (100) years after the record containing the information was created; and
· twenty (20) years after the death of the individual whom the information is about;
• Of information that is publicly available;
• Made by an investigative body and the disclosure is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province; or
• Required by law.
PIPEDA permits HBI to transfer personal information to a third party, without the individual’s knowledge or consent, if the transfer is simply for processing purposes and the third party only uses the information for the purposes for which it was transferred. HBI will ensure, by contractual or other means that the third party protects the information and uses it only for the purposes for which it was transferred.
HOW DO WE SECURE YOUR INFORMATION?
Personal Information is collected and stored on our secured servers for an indefinite period of time. You are entitled to request that such information be reviewed and deleted in accordance with this policy.
We shall destroy, erase, or make anonymous personal information that is no longer required to fulfill the identified purposes and/or that is requested to be deleted by you.
We will shred paper documents containing personal information and properly dispose of them through a federally approved disposal company.
We will delete personal information from our files.
In the event that the personal information cannot be deleted, we would then make the information anonymous to make sure that the identity of the person having that personal information is not compromised.
ACCESSING YOUR PERSONAL INFORMATION
You can request access to your personal information that we have on file in order to verify the accuracy and completeness of the personal information. To request access please send your written request to miBroker’s Privacy Compliance Officer. We will respond to your request within 30 days or advise you if additional time is required to respond to your request.
There may be situations in which we are legally prohibited from allowing you access to your personal information. If this is the case, we will advise you of why, subject to any legal restrictions.
We may charge you for providing access to your personal information, however we will only do so after first advising you of the approximate cost.
If you believe that any of your personal information is incorrect, you can request that it be amended. We will amend personal information that is demonstrated to be inaccurate or incomplete and will make reasonable efforts to advise other parties to whom we have supplied your personal information of corrections that are needed. There is no charge for verifying and correcting information.
PRIVACY AND THE INTERNET
We may collect user information from our websites or app (for example, via cookies which are alphanumeric identifiers transmitted from a website to a visitor’s browser and IP address). This information is used solely for enabling us to provide you with a customized online experience and to find ways to improve our site. Although cookies are widely used, it may be possible to disable cookies via your browser settings. However, in so doing, some websites may not function properly or optimally.
Privacy Compliance Officer
miBroker, a division of McClelland Insurance Brokers Limited
56 Aberfoyle Cres., Suite 110
If we do not resolve your questions or complaint to your satisfaction, you may address your concerns to:
The Privacy Commission of Canada
112 Kent Street
E-mail: [email protected]