Insurance, credit scores and privacy

The OPC report dealt with a complaint that arose after a couple’s home insurance premium rose substantially from the year before, despite the fact they had been insured by the same company for six years with no claims.

The couple found out the insurance company had requested and received access to their credit information from a credit-reporting agency, which revealed the couple had co-signed a loan that had three defaulted payments. The company indicated that it uses underwriting tools, including the statistical credit score, to assess risk and set premiums.

The couple complained to the insurance company, alleging that its policy of basing premiums on customers’ credit information was unjustified and unreasonable. They subsequently brought a complaint to the OPC, which acknowledged that credit information may be disclosed for the purpose of underwriting insurance in Ontario under the province’s Consumer Reporting Act. Companies can “collect and use statistical scores as a tool to underwrite insurance policies and set premiums for its customers in Ontario,” the OPC report concluded.

But OPC also found that the insurance company did not obtain adequate consent for the use of the credit information. Insurers must be transparent with their clients about the use of credit scores, and giving them notice after the fact does not mean the consent is meaningful, says Banks: “You must explain to your clients why you’re collecting the information and how you’re going to use it.” This can be done verbally or in writing, but he recommends doing both. “You should draw it to their attention. Part of being transparent is that you can’t bury it in a privacy policy on page 15.”

The OPC report found, Banks notes, “that the insurance industry’s own surveys had indicated that people do not understand how credit scores are used in the setting of insurance premiums. As a result, it was incumbent upon the insurer to explain this to the insured.”

Adds Banks: “The insurer had an obligation to bring it to the potential insured’s attention and not rely on consent given years ago.”

According to the OPC report, the insurance company did not follow the guidance provided by the Insurance Bureau of Canada in its Code of Conduct for Insurers’ Use of Credit Information. While the OPC report notes that this code is voluntary, it also says: “Our view is that its presence indicates that special considerations are warranted for the use of credit information.”

The OPC report also found that the notice the company sends to policyholders noting that it “may” check credit scores is misleading because the company acknowledged it obtains credit scores upon the first renewal of all policyholders in Ontario.

If a negative decision is made as a result of using a credit score, the insurer must be able to articulate the reasons behind it, says Banks, adding that companies may not hide the fact that they are using a negative score to increase premiums.

A 2011 Canadian Council of Insurance Regulators (CCIR) report on the use of credit scoring in the property insurance sector made reference to unreliable credit data but didn’t provide statistics on the frequency of inaccuracies or omissions, says Izabel Scovino, senior manager of the insurance and deposit institutions policy with the Financial Services Commission of Ontario (FSCO). “There is an obligation, however, on credit-reporting agencies,” she says, “to correct errors and notify all people who have supplied that information in a credit report.”

The CCIR report identified three practices insurers should follow when using credit score information, says Scovino: “The insurer should ask consumers for their permission; consumers should know and understand the type of information the insurer is seeking; and consumers should know and understand how the insurer uses that information.”

FSCO encourages companies, says Scovino, to review their policies, practices and procedures continually. “And,” she adds, “it shouldn’t be a one-time thing. It should be a continuous process.”

When using any kind of scoring tool, says Banks, the onus is on the insurance company to ensure that it complies with privacy legislation and that the inferences being drawn based on that score are scientifically justifiable.

“[Financial advisors] need to do due diligence,” Banks notes, “to make sure that the data broker can demonstrate to you that it has obtained this aggregated consumer information about your client in a lawful way” that is compliant with privacy legislation.

Although the OPC found that the insurance company had not contravened the privacy legislation, the OPC will continue to monitor the corrective actions the insurer is undertaking.

© 2013 Investment Executive. All rights reserved.