Insurance company inadvertently discloses personal information to complainant’s employer

In PIPEDA Report of Findings # 2012-009, the Office of the Privacy Commissioner of Canada considered a complaint brought by an individual against an insurance company for the disclosure of personal information to the complainant’s employer without her consent. The complainant was employed at a hair salon and was contemplating leaving her employer to set up a competing business. The complainant contacted an insurance company to obtain quotes on insurance for the new business and specifically requested that the company not call her back at her current workplace. Notwithstanding this direction, the company did and left a voice mail in the employer’s general inbox. The contents of a voice mail message were heard by the complainant’s employer, who terminated the complainant’s employment.

The Assistant Commissioner found that there had been a disclosure of personal without her consent, so the complaint was “well founded”. The Assistant Commissioner made specific recommendations to the insurance company, and it ultimately agreed to 1) implement a new procedure that minimizes the amount of information that employees leave in client telephone messages, and 2) amend existing procedures to ensure client contact information and messaging preferences are updated regularly to maintain accuracy. The insurance company also agreed to implement these procedures, so the complaint was also found to be “resolved”.