Canadian Privacy Law and Video Surveillance
For litigators and the insurance industry, one of the most vexing questions that arises about PIPEDA relates to video surveillance. These questions are not about video surveillance of the workplace or video surveillance of retail spaces -- all of which are easy to answer -- but are about the kind of video surveillance carried out by private investigators every day of every week. Every time I talk about PIPEDA to a group of lawyers (litigators in particular) or insurance folks, I get panicked questions about whether the law diminishes their ability to send out private investigators to snoop on claimants or plaintiffs.
Investigators are routinely used to check out whether a plaintiff or policy claimant is malingering. Often, the suspicions of the claims examiner or the lawyer are borne out by evidence that the actual disability is significantly lower than that claimed. (My personal favourite was a video of person who was claiming near-total disability but was caught carrying a canoe over an 800m portage in a national park.) There can be little doubt that being followed through the woods by a PI or surveilled from a van with tinted windows is invasive of privacy. So what is the impact of PIPEDA on this practice? Are PIs out of business?
Not quite out of business, but it is no longer business as usual.
Part of the impact of PIPEDA will be determined by whether you are dealing with first-party or third-party insurance. First-party insurers, such as under a disability policy, have a contractual relationship with the claimant, coupled with reciprocal duties of honest and good faith. Third-party insurers seldom have any pre-existing relationship with the claimant. The differing impact is a consequence of the supremely important "consent principle".
Among the fundamental tenets of PIPEDA is consent. This is taken from Principle 3 of the CSA Model Code, which is Schedule I to PIPEDA:
4.3 Principle 3 -- Consent
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
Video Surveillance With Explicit Consent
It is clear that video taping someone is a "collection ... of personal information" for which knowledge and consent are ordinarily required. When an adjuster suspects that a claimant is malingering or is exaggerating, that is not the time to try to get consent. First-party insurers, unlike others, have the advantage of being able to seek consent to investigations well in advance, when the policy is being underwritten. Prudent insurers will, for the avoidance of doubt, place language in their policies and claim forms that provide consent for all collection, use and disclosure of personal information that is reasonably necessary to investigate and verify all claims advanced under the policy. Policy language and claim forms need to be very carefully drafted with assistance of legal counsel experienced with privacy issues in order to cover all anticipated circumstances.
Video Surveillance With Implied Consent
Consent under PIPEDA may take many forms. The commentary to the consent principle contains the following:
4.3.4
The form of the consent sought by the organization may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, organizations shall take into account the sensitivity of the information. Although some information (for example, medical records and income records) is almost always considered to be sensitive, any information can be sensitive, depending on the context. For example, the names and addresses of subscribers to a newsmagazine would generally not be considered sensitive information. However, the names and addresses of subscribers to some special-interest magazines might be considered sensitive.
4.3.5
In obtaining consent, the reasonable expectations of the individual are also relevant. For example, an individual buying a subscription to a magazine should reasonably expect that the organization, in addition to using the individual's name and address for mailing and billing purposes, would also contact the person to solicit the renewal of the subscription. In this case, the organization can assume that the individual's request constitutes consent for specific purposes. On the other hand, an individual would not reasonably expect that personal information given to a health-care professional would be given to a company selling health-care products, unless consent were obtained. Consent shall not be obtained through deception.
4.3.6
The way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive. Implied consent would generally be appropriate when the information is less sensitive. Consent can also be given by an authorized representative (such as a legal guardian or a person having power of attorney).
Some insurers take the position that, even in the third-party context, they have implied consent to carry out video surveillance on claimants. While nobody has said "I give you consent to covertly videotape my activities", the basis for this position is that by advancing a claim, the individual is consenting to the investigation and verification of the claim. Nobody can reasonably expect that an insurer will write a cheque without investigating the entirety of the claim. The "reasonable expectations" of the parties accord with this position.
If this becomes the norm, I would anticipate that counsel for claimants will send letters to insurers saying that they withdraw any implied consent and explicitly do not consent to the collection of personal information via video surveillance. (I have already seen correspondence from counsel for a plaintiff saying that an independent medical examination to verify injuries is an unreasonable collection of personal information that is prohibited by PIPEDA and for which the plaintiff refuses to consent. This is notwithstanding the explicit agreement to an IME which is contained in the policy.) In discussions with the Office of the Privacy Commissioner, it would appear that this position, if adopted by plaintiffs, would not garner much sympathy from them. PIPEDA was not designed to give compensation to individuals who are not entitled to it and insurers should be entitled to refuse to pay any claims that they are not able to thoroughly investigate. Insurers will need to be very careful when dealing with a situation like this, paticularly for their own insured where a duty of utmost good faith exists.
Video Surveillance Without Consent
Among those who do not have explicit consent, some take comfort from the "except where inappropriate" part of principle 3, but this vague expression has been replaced by the laundry list of consent exceptions contained in Section 7 of the Act. (A word of warning: Section 7 is a nightmare to follow.) From Subsection 7(1), an organization is able to collect personal information without knowledge or consent in the following circumstances:
7. (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if
(a) the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;
(b) it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
(c) the collection is solely for journalistic, artistic or literary purposes; or
(d) the information is publicly available and is specified by the regulations.
Usually, in the context of video surveillance, paragraph 7(1)(b) is seen as the most applicable. But it may not be applicable in all cases where video surveillance is commonly used. That paragraph of PIPEDA requires all of the following to be present, which is not always the case:
- it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information;
- the collection is reasonable; and
- the collection is for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.
Cases of suspected fraud would arguably be "for purposes related to investigating ... a contravention of the laws of Canada or a province", but the collection would still need to be reasonable and it would be reasonable to suspect that getting consent would compromise the information. A recent decision from the labour arbitration context has applied this principle in relation to video surveillance. In Ross v. Rosedale Transport Ltd., [2003] C.L.A.D. No. 237, 2003 CarswellNat 3620 (Ont. Arb.), the employee in question was fired from his employment for misrepresenting his injuries to his employer. In February, the employee sustained a low-back injury when moving a pallet from a truck. He was off work and was then put on reduced duties to accommodate his back injury. After some months of reduced duties, during when the employee's physician opined he may be permanently disabled, the employee went on vacation. On the day before commencing his leave, the employee told his supervisor that he would be moving with his family. The employer hired an investigator who conducted video surveillance of the employee while he carried furniture. The employee was fired for fraud.
The arbitrator, surprisingly, found that the video evidence was not admissible because its collection violated section 7(1)(b) of PIPEDA:
¶ In the instant case, there was absolutely no evidence that Ross had
ever been anything other than an honest employee. He had no disciplinary record.
He had never submitted a false or fraudulent claim for insurance or other benefits.
There were a number of other means that were available to the employer to test
the true extent of Ross' restrictions and the bona fides of his recovery as of
April 6, 2002. As late as March 21, 2002, Rosedale had in its possession, a statement
from Ross' physician that he was only fit for clerical duties and that a prognosis
for full recovery was questionable. If the employer really thought that Ross was
malingering or pretending that he was not yet fully able to resume the duties
of a driver/associate, it was open for Rosedale to ask for an independent medical
examination a matter that was conceded by Topping. His failure to do so was left
unexplained. This is a case, where an employer, without any evidence that the
employee was malingering or had made misrepresentations or spread disinformation
as to his physical abilities, orders a surreptitious video surveillance in the
hope of trapping the unsuspecting employee during the course of moving furniture
at his place of residence at a time and place that he had voluntarily disclosed
to his employer. In this respect, the words of Arbitrator M. G. Picher in Canadian
Pacific Ltd. and Brotherhood of Maintenance of Way Employees, (supra), are very
appropriate:
'as
a general rule, (the employer's interests) does not justify resort to random video
surveillance in the form of an electronic web, cast like a net, to see what it
might catch. Surveillance is an extraordinary step which can only be resorted
to where there is, beforehand, reasonable and probable cause to justify it. What
constitutes such cause is a matter to be determined on the facts of each case'.
¶ In my opinion, this is exactly what Topping attempted to do, namely,
to cast an electronic web to see whether he could catch Ross while moving his
family on April 6, 2002. In my view, the collection of this personal information
in the form of the video surveillance tape was not reasonable for any purpose
related to the investigation of a breach of the employment agreement. Its collection
without the knowledge and consent of Ross violated Section 7(1)(b) of the Act.
It was for these reasons that I ruled on the first day of the hearings that the
videotape was not admissible in evidence.
Notwithstanding that the employer had a basis for suspicion and that the employee had committed fraud with respect to the employment contract, the arbitrator found the dismissal to be unjustified. There was no doubt that this related to an investigation of a breach of an agreement (the employment contract), but it failed because the arbitrator found it to be unreasonable in the circumstances. The lesson of Ross v. Rosedale Transport Ltd. for insurers is that, if they wish to rely on Section 7(1)(b) of PIPEDA, their basis for ordering surveillance must be reasonable. A mere desire to catch the claimant in a lie is probably not enough of a basis to order intrusive surveillance.
Conclusion
It is clear that the advent of PIPEDA will not end the relatively common practice of using private investigators to determine whether a claim is legitimate. But PIPEDA does usher in a new era of sensitivity to individual privacy. Insurers can expect that video surveillance will be challenged, both in court and before the office of the Privacy Commissioner. Since the law came into force in the provincially regulated private sector, plaintiff's counsel are increasingly trying to use PIPEDA to place roadblocks in the way of insurers. In many cases their incantations are baseless, but surveillance may be an area where plaintiff's counsel might prevail. At least during this period of uncertainty, insurers need to tread carefully and take steps to increase the likelihood that their use of surveillance will survive challenges. All claims staff must know the new rules and, when the rules are unclear, should seek specific advice from counsel who are well-versed in both insurance and privacy law.
The author, David T.S. Fraser, is a Canadian privacy lawyer and chair of the privacy law practice group of McInnes Cooper, Atlantic Canada's largest single law partnership. He is regularly called upon to advise on matters related to Canadian privacy law and insurance. David's full contact information is available here.
This publication contains a general discussion of certain legal and related developments and is not intended to provide legal or other professional advice. Readers should not act on the information contained in this publication without seeking specific advice on the particular matter with which they are concerned. If you require legal advice, we would be pleased to discuss the issues in this document with you in the context of your particular circumstances.
