 INTRODUCTION
Wawanesa is committed to the protection of personal information of its Customers.
Rather than a contract between Wawanesa and its Customer, this Policy shall be deemed a set of principles respecting the manner in which Wawanesa protects the privacy of the personal information of Customers.
The Policy addresses two broad issues: the way Wawanesa collects, uses, discloses and protects personal information; and the right of Customers to have access to personal information about themselves and, if necessary, to have the information corrected. Ten interrelated principles form the basis of the Policy. These are the ten principles set out in the Personal Information Protection and Electronic Documents Act (“PIPEDA”). Each principle is accompanied by a commentary that elaborates on the principle.
This Policy:
(a) provides principles for the management of personal information;
(b) specifies the minimum requirements for the adequate protection of personal information held by Wawanesa;
(c) makes the Canadian public aware of how personal information is protected by Wawanesa; and
(d) provides for independent mediation when Wawanesa and its Customers disagree about Customer Access (Principle 9).
PRINCIPLES IN SUMMARY
Ten interrelated principles form the basis of this Policy. Each principle must be read in conjunction with the accompanying commentary.
1. Accountability
Wawanesa is responsible for personal information under its control and shall designate an individual or individuals who are accountable for Wawanesa's compliance with the following principles.
2. Identifying Purposes
The purposes for which personal information is collected shall be identified by Wawanesa at or before the time the information is collected.
3. Consent
The knowledge and consent of the Customer are required for the collection, use, or disclosure of personal information, except where inappropriate.
4. Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by Wawanesa. Information shall be collected by fair and lawful means.
5. Limiting Use, Disclosure and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the Customer or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
6. Accuracy
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
7. Safeguards
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
8. Openness
Wawanesa shall make readily available to Customers specific information about its policies and practices relating to the management of personal information.
9. Customer Access
Upon request, a Customer shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. A Customer shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
10. Challenging Compliance
A Customer shall be able to challenge compliance with the above principles with the person who is accountable within Wawanesa.
1. SCOPE
1.1
This Policy describes the minimum requirements for the protection of personal information. Any applicable legislation will be considered in implementing these requirements.
1.2
This Policy applies to personal information relating to "Customers" as defined in 2.1.
1.3
The objective of this Policy is to assist Wawanesa in developing and implementing practices to be used when managing personal information. In so doing Wawanesa shall balance the right of privacy of Customers, with respect to their personal information, with Wawanesa’s need to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
1.4
To the extent that this Policy conflicts with applicable legislation, including related regulations, the provisions of such legislation shall prevail.
1.5
To the extent that this Policy omits any rights or obligations, of or for, either Wawanesa or Customers, contained within any applicable legislation, including related regulations, then such provisions are deemed to be incorporated into this Policy.
2. DEFINITIONS
2.1
The following definitions apply in this Policy:
"Collection"  the act of gathering, acquiring or obtaining personal information from any source, including from third parties, by any means. Personal information necessary to carry on the business of P&C insurance for purposes that a reasonable person would consider are appropriate in the circumstances may be collected by Wawanesa, agents, brokers or their authorized agents.
"Consent"  voluntary agreement with what is being done or proposed. Consent can be either express or implied. Express consent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of Wawanesa seeking consent. Implied consent arises where consent may reasonably be inferred from the action or inaction of the Customer. See commentary in 4.3.1.
"Customer"  individuals about whom Wawanesa collects personal information in order to carry out the business of P&C insurance; and includes individuals who are insureds, former insureds, applicants, claimants, individuals involved in a claim, and individuals insured as part of a group or corporate policy.
“P&C insurers” – insurers licensed in Canada to write any class of insurance other than life insurance.
"Personal information"  shall have the definition provided in applicable personal information protection legislation, including related regulations, and shall include an individual's name, address, telephone number, date of birth, family status, marital status, occupation, medical and health records, assets, liabilities, income, credit rating, whether or not credit was extended or refused to the individual, credit and payment records of the individual, an individual's previous insurance experience including claims history, and an individual's driving record.
3. GENERAL REQUIREMENTS
3.1
The ten principles that make up this Policy are interrelated.
3.1.1
Each principle is followed by a commentary. The commentaries are intended to help Customers of Wawanesa understand the significance and the implications of the principles. Where there is also a "NOTE" following a principle (see principles 3 and 9), it forms an integral part of the principle.
3.1.2
Use of the singular does not exclude the plural (and vice versa) when the sense allows.
4.1 PRINCIPLE 1: ACCOUNTABILITY
Wawanesa is responsible for personal information under its control and shall designate an individual or individuals who are accountable for Wawanesa's compliance with the following principles.
4.1.1
Accountability for Wawanesa's compliance with the principles rests with the designated individual(s) even though other individuals within Wawanesa may be responsible for the day-to-day collection and processing of personal information. In addition, other individuals within Wawanesa may be delegated to act on behalf of the designated individual.
4.1.2
The identity of the individuals designated by Wawanesa to oversee Wawanesa's compliance with the principles shall be available upon request.
4.1.3
Wawanesa is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. Wawanesa shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.
4.1.4
Wawanesa shall implement practices to give effect to the principles, including:
(a) implementing procedures to protect personal information;
(b) establishing procedures to receive and respond to complaints and inquiries;
(c) training staff and communicating to staff information about Wawanesa's policies and practices; and
(d) developing information to explain Wawanesa's policies and procedures.
4.2 PRINCIPLE 2: IDENTIFYING PURPOSES
The purposes for which personal information is collected shall be identified by Wawanesa before or at the time the information is collected.
4.2.1
Wawanesa shall collect personal information only for the purposes of:
- establishing and maintaining communications with Customers;
- underwriting risks on a prudent basis (i.e. assessing application(s) for insurance, including renewals, and underwriting policies);
- investigating, evaluating and paying claims;
- detecting and preventing fraud;
- disclosure to property and casualty insurance industry service providers as dictated by prudent insurance practices;
- offering and providing property and casualty insurance products and services to meet Customer needs;
- compiling statistics and analyzing business results; and
- acting as required or authorized by law
Wawanesa takes a global approach to these purposes. In other words, Wawanesa is not collecting personal information just for any one of the purposes, e.g. underwriting a policy. Wawanesa is collecting the personal information for all of the purposes, so in effect a Customer can expect that although Wawanesa may initially use the data for underwriting a policy, it may later use it for claims purposes, and vice versa.
4.2.2
Wawanesa understands that the information it needs to collect to fulfill the purposes referred to in 4.2.1. requires Wawanesa or its designates to collect only that information necessary for the identified purposes.
4.2.3
The identified purposes should be communicated to Customers or other persons from whom the personal information is being collected. This can be done orally or in writing, as for example, on an application form or through pamphlets or other suitable media.
4.2.4
When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified before use. Unless the new purpose is required by law, the consent of the Customer is required before information can be used for that purpose.
4.2.5
Persons collecting personal information should be able to explain to Customers the purposes for which the information is being collected.
4.3 PRINCIPLE 3: CONSENT
The knowledge and consent of the Customer are required for the collection, use, or disclosure of personal information, except where inappropriate.
NOTE: In certain circumstances personal information can be collected, used or disclosed without the knowledge and consent of the Customer. For example, legal, medical or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the Customer might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the Customer is a minor, seriously ill, or mentally incapacitated. In addition, where there is no direct relationship with the Customer, Wawanesa may not always be able to seek consent. However, when certain types of information are being collected, such as medical or hospital records, employment records or income tax records, Wawanesa will obtain express consent from the Customer.
4.3.1
The P&C insurance business has the following unique features which make express consent impossible to obtain in some circumstances:
- As a convenience to their Customers, Wawanesa often provides insurance or amendments to existing policies over the telephone, on short notice and with little written documentation. In these circumstances, it is impossible for Wawanesa to obtain express written consent from Customers.
- Wawanesa, when it operates through independent brokers, does not have direct relationships with the Customers and therefore is not able to obtain express oral consent from the Customers.
- Wawanesa has a legal duty to defend its policyholders against claims made by third party claimants. In such situations, Wawanesa and the third party claimants are adverse parties. In order to fulfill its obligations to its policyholders, Wawanesa must collect, use and disclose personal information about such third party claimants that is relevant to the claim even if the third party claimants have not given their consent.
Given these constraints, it is reasonable for Wawanesa to infer that by dealing with it on insurance related matters (e.g. action on the part of the Customer to use, acquire or accept a product), Customers have given implied consent for the collection, use or disclosure of personal information necessary for the identified purposes (see 4.2.1).
4.3.2
The following are situations specific to the P&C insurance business where consent is not required for the collection, use and disclosure of personal information:
(a) Legal
- Collection of personal information for the detection and prevention of fraud.
- Compliance with subpoenas, search warrants, and other court or government orders.
In either of these situations obtaining consent might defeat the purpose of collecting the information.
(b) Duty to Defend
Wawanesa will transfer the personal information of Customers to lawyers retained by Wawanesa pursuant to the contractual obligation in the insurance policy to defend legal actions against its insureds.
(c) Public Duty
In exceptional circumstances, Wawanesa may, under a public duty, disclose personal information to appropriate authorities in matters of significant public interest.
(d) Medical and Other
Where the Customer is a minor, seriously ill, or mentally incapacitated, seeking consent may be impossible or inappropriate.
4.3.3
Consent is required for the collection of personal information and the subsequent use or disclosure of this information. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use.
4.3.4
The principle requires "knowledge and consent". This suggests that Wawanesa shall make a reasonable effort to ensure that the Customer is advised of the purposes for which the information will be used. The purposes shall be stated in a manner that can be reasonably understood by the Customer.
4.3.5
Wawanesa will not, as a condition of the supply of a product or service, require a Customer to consent to the collection, use or disclosure of information beyond that required to fulfill the specified, explicit and legitimate purposes. Wawanesa shall explain to the Customer the information requirements that are related to the product or service. In so doing, Wawanesa has provided a specified, explicit and legitimate purpose. Wawanesa can then refuse to deal with a Customer who will not consent to the collection, use and disclosure of the information for the specified, explicit and legitimate purpose. For example, Wawanesa provides insurance at specified rates and on certain terms and conditions based on, among other things, analysis of an individual's personal information, including date of birth, address and claims history. If this information is not obtained, Wawanesa cannot determine the basis for insurance coverage and, therefore, cannot provide insurance to the Customer. Consent shall not be obtained through deception.
4.3.6
There are certain types of information where the express written consent of the Customer will be obtained for the collection, use or disclosure of personal information. For example, medical or hospital records, employment records or income tax returns.
4.3.7
A Customer should reasonably expect that Wawanesa will use personal information in making its decisions on the Customer's insurability and in adjusting the Customer's claim. On the other hand, a Customer would not reasonably expect Wawanesa to give accident information to car sales companies to solicit individuals for the purchase of a new car if the Customer's car had incurred extensive damage in an accident.
4.3.8
Consent can be given by an authorized representative (such as, person having a power of attorney, or legal guardian). Consent can also be given by an individual on behalf of another individual. For example, where an individual applies for automobile insurance for himself and family members, the applicant is giving consent for the collection, use and disclosure of personal information both for himself and his family members even though the family members are not present during the application process. A similar situation arises where an employer, on behalf of its employees, applies for or renews a group or fleet insurance policy which provides insurance benefits to the employees even though the employees are not present during the application or renewal process.
4.3.9
Where Wawanesa seeks express consent, it can be given in many ways. For example:
(a) An application form may be used to seek consent, collect information and inform the Customer of the use that will be made of the information. By completing and signing the form, the Customer is giving consent to the collection and the specified uses.
(b) A check-off box may be used to allow Customers to request that their names and addresses not be given to other organizations for marketing purposes. Customers who do not check the box are assumed to consent to the transfer of this information to third parties.
(c) Consent may be given orally when information is collected over the telephone.
(d) Consent may be given by agreement.
4.3.10
Consent is valid for the length of time needed to achieve the identified purposes. The Customer may withdraw consent on reasonable notice, subject to legal or contractual restrictions and the requirement that Wawanesa maintain the integrity of the statistics and data necessary to carry on their business. Wawanesa shall inform the Customer of the implications of such withdrawal.
4.4 PRINCIPLE 4: LIMITING COLLECTION
The collection of personal information shall be limited to that which is necessary for the purposes identified by Wawanesa. Information shall be collected by fair and lawful means.
4.4.1
Wawanesa shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfill the purposes identified. Wawanesa obtains personal information primarily from insurance Customers, but also from others including other P&C Insurers, brokers, and underwriting or claims information networks. Wawanesa shall specify the type of information collected as part of their information handling practices in accordance with Principle 8 Openness.
4.4.2
The requirement that personal information be collected by fair and lawful means Wawanesa will not collect information by misleading or deceiving individuals about the purpose for which information is being collected.
4.5 PRINCIPLE 5: LIMITING USE, DISCLOSURE AND RETENTION
Personal information shall not be used or disclosed for purposes other than those for which the information was collected, except with the consent of the Customer or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes .
4.5.1
There are situations specific to the P&C insurance business where Wawanesa will provide personal information as dictated by prudent insurance practices. For example:
(a) Risk-Sharing: As part of the underwriting and claims handling process, Wawanesa transfers personal information to other insurance companies including reinsurance companies which share in the risk. This would include situations where the Customer has made a fraudulent application for or renewal of a policy of insurance.
(b) Information Services: Wawanesa provides personal information for underwriting, claims, classification and rating purposes.
(c) Insurance Services: Wawanesa provides personal information to businesses that provide goods and services to insurance companies and/or their Customers, such as data processors, loss control managers and claims adjusters.
(d) Insurance Intermediaries: Wawanesa may provide personal information to its insurance intermediaries, such as brokers and agents.
Only the information necessary for these services will be provided by Wawanesa to these service providers.
4.5.2
If Wawanesa uses personal information for a new purpose it will document this purpose.
4.5.3
Wawanesa shall maintain and implement procedures with respect to the retention of personal information. Personal information that has been used to make a decision about a Customer shall be retained long enough to allow the Customer access to the information after the decision has been made. Wawanesa may be subject to legislative requirements with respect to retention periods.
4.5.4
Personal information that is no longer required to fulfill the identified purposes shall be destroyed, erased or made anonymous. Wawanesa will maintain and implement procedures to govern the destruction of personal information.
4.6 PRINCIPLE 6: ACCURACY
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
4.6.1
The extent to which personal information shall be accurate, complete and up-to-date will depend upon the use of the information, taking into account the interests of the Customer. Information shall be sufficiently accurate, complete and up-to-date, to minimize the possibility that inappropriate information may be used to make a decision about the Customer.
4.6.2
Wawanesa shall not routinely up-date personal information unless this is necessary to fulfill the purposes for which it was collected.
4.6.3
Personal information that is used on an on-going basis, including information that is disclosed to third parties, shall generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out.
4.7 PRINCIPLE 7: SAFEGUARDS
Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
4.7.1
The security safeguards must protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Wawanesa protects personal information regardless of the format in which it is held.
4.7.2
The nature of the safeguards will vary depending on the sensitivity of the information that has been collected, the amount, distribution and format of the information and the method of storage. More sensitive information should be safeguarded by a higher level of protection.
4.7.3
The methods of protection should include:
(a) physical measures, such as locked filing cabinets and restricted access to offices;
(b) organizational measures, such as security clearances and limiting access on a "need to know" basis; and
(c) technological measures, such as the use of passwords and encryption.
4.7.4
Wawanesa shall make its employees aware of the importance of maintaining the confidentiality of personal information.
4.7.5
Care shall be used in the disposal or destruction of personal information to prevent unauthorized parties from gaining access to the information.
4.8 PRINCIPLE 8: OPENNESS
Wawanesa shall make readily available to Customers specific information about its policies and practices relating to the management of personal information.
4.8.1
Wawanesa shall be open about its policies and practices with respect to the management of personal information. A Customer shall be able to acquire information about a Wawanesa's policies and practices without unreasonable effort. This information shall be made available in a form that is generally understandable.
4.8.2
The information made available shall include:
(a) the title, address and telephone number of the person who is accountable for Wawanesa's policies and practices and to whom complaints or inquiries can be forwarded;
(b) the means of gaining access to personal information held by Wawanesa;
(c) a description of the type of personal information held by Wawanesa, including a general account of its use;
(d) a copy of any brochures or other information explaining Wawanesa's policies, standards or procedures; and
(e) what personal information is made available to related organizations, such as subsidiaries.
4.8.3
Wawanesa may make information on its policies and practices available in a variety of ways. The method chosen will depend on the nature of its business and other considerations. For example, Wawanesa may choose to make brochures available in its place of business, mail information to its Customers, provide on-line access, or establish a toll-free telephone number.
4.9 PRINCIPLE 9: CUSTOMER ACCESS
Upon request, a Customer shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. A Customer shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
NOTE: In certain situations, Wawanesa may not be able to provide access to all the personal information it holds about a Customer. Exceptions to the access requirement shall be limited and specific. The reasons for denying access shall be provided to the Customer upon request. Exceptions may include prohibitive cost, personal information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege.
4.9.1
Upon request, Wawanesa shall inform a Customer whether or not Wawanesa holds personal information about the Customer. Wawanesa shall allow the Customer access to this information. However, Wawanesa may choose to make sensitive medical information available through a medical practitioner. In addition, Wawanesa shall provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed. If such a request is denied, the Customer shall have the right to be given reasons, for the denial and information on how to challenge such denial including:
(a) an invitation to the Customer to send a letter to Wawanesa's President requesting reconsideration of such denial;
(b) a commitment by Wawanesa to open promptly a dialogue with the Customer; and
(c) a commitment by Wawanesa to participate in an independent mediation process should the parties be unable to resolve the dispute.
4.9.2
A Customer may be required to provide sufficient information to permit Wawanesa to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose.
4.9.3
In providing an account of third parties to which it has disclosed personal information about a Customer, Wawanesa shall attempt to be as specific as possible. When it is not possible to provide a list of the organizations to which it has actually disclosed information about a Customer, Wawanesa shall provide a list of organizations to which it may have disclosed information about the Customer.
4.9.4
Wawanesa shall respond to a Customer's reasonable request within a reasonable time and at minimal or no cost to the Customer. The requested information shall be provided or made available in a form that is generally understandable. For example, if Wawanesa uses abbreviations or codes to record information, an explanation shall be provided.
4.9.5
When a Customer successfully demonstrates the inaccuracy or incompleteness of personal information, Wawanesa shall amend the information as required. Depending upon the nature of the information challenged, amendment could involve the correction, deletion or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.
4.9.6
When a challenge is not resolved to the satisfaction of the Customer, the substance of the unresolved challenge shall be recorded by Wawanesa. When appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.
4.10 PRINCIPLE 10: CHALLENGING COMPLIANCE
A Customer shall be able to challenge compliance with the above principles with the person who is accountable within Wawanesa.
4.10.1
The individual accountable for Wawanesa's compliance is discussed in 4.1.1.
4.10.2
Wawanesa shall put procedures in place to receive and respond to complaints or inquiries about its policies and practices relating to the handling of personal information. The complaint process should be easily accessible and simple to use.
4.10.3
Wawanesa shall inform Customers who make inquiries or lodge complaints of the existence of relevant complaint mechanisms. A range of these mechanisms may exist. For example, some regulatory bodies accept complaints about the personal information handling practices of the companies they regulate.
4.10.4
Wawanesa shall investigate all complaints, unless on the face thereof they are frivolous or vexatious. If a complaint is found to be justified through either the internal or external complaint review process, Wawanesa shall take appropriate measures, including amending its policies and practices if necessary.
4.10.5
Customers who are dissatisfied with the manner in which their complaints have been handled may contact the appropriate public official designated in relevant provincial legislation, or if none, Privacy Commissioner of Canada.
Click Here to Go Back to Personal Information Protection Policy Home Page
|
