Privacy Commissioner Supports Use Of Credit Scores, But Has Concerns About Transparency

The use of credit scores has been banned in Ontario personal auto but continues to polarize the industry, politicians and consumers.  As a result there is considerable interest in a recent Report of Findings released by the Office of the Privacy Commissioner of Canada.

The complainants are husband and wife, and were joint applicants on a property insurance policy with an Ontario insurer.  In 2009, they were surprised when their insurance renewal premium had increased considerably over the previous year’s premium. The company had been their insurer for six years and the complainants were claims free. When the complainants looked into the matter, they learned that the company had requested and received from a credit reporting agency access to their personal credit information. In their view, the company had done so without justification and without their knowledge and consent. They were also concerned about other purposes to which the company would use this information.

The insurer's position was that it had obtained express consent from the couple and its other customers for the collection of credit information at the time they apply for insurance. In the company’s view, the complainants consented when they signed their original application.  The company uses the standard Centre for Studies in Insurance Operations (“CSIO”) application form, which includes the following consent provision:

The Applicants agree that reports containing personal, credit, factual record, premium payment or claims history information may be sought or exchanged in connection with this application for insurance or renewal, extension, variation or cancellation thereof.

 In addition, the company also pointed to its website privacy statement which advises individuals that the company may collect their personal information from third parties for the purpose of administering insurance policies, as well as for other purposes.  Since 2003, the company has sent to all its Ontario policyholders a two-page notice on its policy on the collection and use of personal information at the time of their first policy renewal.  It includes an explanation that it may use the statistical score (an underwriting tool that rank-orders risk for underwriting and predicts the likelihood of delinquency over 12 months) from the consumer's credit file as one of many rating factors to determine eligibility for personal property insurance and premiums.

 Research on the issue conducted by the Office of the Privacy Commissioner of Canada revealed the following:

• There are studies supporting the claim that credit-based insurance scoring information is a valid predictor of risk of a future loss.
•  Despite the finding of industry studies, not all insurance companies in Canada are using credit scores for risk assessment.
• Many Ontario consumers were not aware that their credit scores were being used to determine how much they pay for their home insurance premiums.

In the end the privacy commissioner did not object to the use of credit information for purposes of assessing insurance risk.  It was noted that section 8 of Ontario’s Consumer Reporting Act confirms that credit information may be disclosed for the purpose of underwriting insurance.  In addition, while the Ontario government has banned the use of credit information in auto insurance, it made a public policy decision to allow the disclosure of individuals’ credit information for purposes of assessing insurance risk for home insurance.

It was also acknowledged that  assessing risk is a fundamental component of the insurance business model. Therefore, underwriting tools are necessary to analyse and predict risk in order for insurance companies to be able to provide insurance products at the appropriate price.  It was also acknowledged that the statistical score is an aggregate number, which may be less intrusive than accessing an individual’s entire credit report.

However the privacy commissioner did express some concerns.  The privacy commissioner noted that there is no obvious link between credit information and insurance premiums. While the majority of risk assessment tools that insurance companies use have apparent links to the product being purchased by the consumer (claims history, for example), credit history does not. As well, how credit score is determined is closely guarded and most consumers have no way of knowing whether or how their credit information may factor into their insurance premiums. 

The privacy commissioner concluded that the company did obtained the complainants’ consent to use their credit information or the statistical score.  The language used in the consent provision on the insurance application form was found to be too general in nature. Further, it is not reasonable to expect a consumer to understand that their credit score will be used to determine the probability of them later filing an insurance claim.

Previously I had written on a report from a working group from the  Canadian Council of Insurance Regulators (CCIR) which failed to reach any conclusion on the issue, stating that it was a government issue and to reach any definitive solution would require work beyond its own scope. 

The two reports reinforce the use of credit scoring in rating home insurance policies as long as government does not introduce a prohibition similar to the one the exists in auto insurance.  However, insurers need to ensure the proper consent is obtained and that their policyholders understand how their credit information will be used.  Relying on standard industry forms and consent language may not comply with PIPEDA.

PIPEDA Report of Findings #2015-005