The office of Canada’s privacy commissioner says it is “monitoring” a proposed U.S. class-action lawsuit in which some auto insurers are facing allegations of misusing driver data collected via smartphones and other technology.
The case poses questions of whether insurance companies are taking consumer data collection too far, and if Canadians should be concerned about how that data is being used.
According to a Chicago district court decision on March 3, drivers can try with a lawsuit claiming Allstate Insurance violated the Federal Wiretap Act by monitoring their travel locations, trip distances, speed, acceleration, braking, phone usage and attention to the road, and tried to monetize that data to boost profit.
The claims also allege that Allstate’s data analytics unit, Arity, violated the federal Fair Credit Reporting Act by inaccurately reporting their driving behaviour, including when they rode as passengers.
Allstate argued that drivers never alleged it actually captured their data, or that their insurance rates went up. It also said its privacy policies disclosed the possibility of data collection.
Allstate said in a statement on March 4: “Consumers who choose to share driving data through Arity-powered apps can access emergency assistance, track fuel efficiency and unlock personalized insurance rates after a clear notice and explicit opt-in process.”
Global News sent a request to the Office of the Privacy Commissioner of Canada (OPC) to see if similar action could be taken in Canada, and if drivers have filed similar complaints.
“The OPC is aware of the reports about the class action lawsuit in the United States and is monitoring the matter,” the OPC said in a statement, adding that it has not received any similar complaints.
The OPC also referred to the Personal Information Protection and Electronic Documents Act (PIPEDA), which requires that businesses receive consent from clients before collecting or sharing any data.
In Canada, many auto insurance companies use similar technologies for their clients.
Usage-based insurance (UBI), also known as telematics, began rolling out in Canada in 2012 and 2013, and refers to any way insurance companies can monitor a driver’s actions in real time to determine a policy rate that more accurately reflects a customer’s risk profile.
Get breaking National news
Get breaking Canada news delivered to your inbox as it happens so you won’t miss a trending story.
A driver who’s seen as driving more aggressively or is often distracted may see higher premiums, while more cautious drivers could save money on their policy.
For example, if a driver agrees to have their mileage monitored by an insurance provider on a regular basis, that would give the company a better idea of how much that person drives.
Other methods include tracking a vehicle’s speed to see if a driver tends to drive more aggressively or more cautiously, or even monitoring cellphone use.
“We have programs, such as CAA MyPace, a pay-as-you-go auto insurance program that tracks kilometres driven and charges the policyholder based on usage without requiring a cell phone,” CAA said in a statement.
“All our Usage-Based Insurance programs require the insured’s explicit consent before enrollment. CAA Insurance does not sell or share personal driving data with third parties.”
The OPC states specific principles and guidelines for businesses when they are collecting and sharing data and other personal information. It also provides examples of an “inappropriate” use of collected user information or data, including unfairly or unethically profiling an individual contrary to human rights law, any means that could cause significant harm to an individual, or conducting surveillance on an individual by using their device’s audio or video functions.
“At Intact Insurance, myDrive is an optional, consent‑based feature available to customers through the Intact Insurance App,” Intact Insurance said in a statement.
“Protecting customer information is a top priority; we do not share myDrive data with third parties other than our trusted service provider which supports the technology behind the program under strict contractual and privacy safeguards.”
Some companies share the user data collected with third parties, which the OPC says is allowed, but a user must not only be given consent, they must also be made aware of how their data may be shared.
Aviva said it uses a combination of vehicle and cellphone monitoring systems to gauge a driver’s habits.
“The data collected is used to tailor a customer’s insurance premium to their driving habits and in accordance with our privacy policy and the laws,” Aviva said in a statement.
“Our telematics program monitors acceleration, speeding, braking, cornering and distracted driving. Drivers with good scores are eligible to receive premium discount at renewal. We do not use the data to make coverage decisions.”
Aviva’s privacy policy lists dozens of potential third parties that it may share data with, including autobody shops, roadside assistance providers, home restoration providers, health-care professionals, claims handlers, legal professionals, accountants, vehicle theft tracking and recovery services, financial institutions, auditors, professional service firms, experts and private investigators.
“Since a person’s driving behaviour would be considered their personal information, privacy compliance must be considered and all jurisdictions in Canada require the insured’s expressed consent for the insurer to use telematics for underwriting,” the Insurance Bureau of Canada said in a statement.
“Accordingly, the disclosure of driving behaviour by the auto manufacturer to an insurer (or conversely the collection of this information by the insurer) for the purpose of underwriting without the individual’s expressed consent would not be permitted in Canada.”
Retail analyst Bruce Winder says the case and the questions it poses for consumers and companies are “interesting.”
“If consumers can see that there’s an actual benefit to them financially, and the company is very open and there’s large open opt-ins and people are well-educated about it, they might not have a problem with it,” he says.
“Some consumers may have a problem with that, so it’s quite a fascinating case to watch.”
If drivers know their data is being collected and shared with third parties, they may be able to justify the lack of privacy if it means cost savings.
“Consumers generally have accepted the social and legal contract in terms and conditions, and I’m talking mostly about social media, that your data is sort of up for grabs. That’s the way that society has run for the last little while,” Winder says.
“They’re OK with that because they feel that the company is rewarding them for driving well and that they don’t want to pay for bad drivers’ behaviour in their rates.”
For consumers who may not want their data tracked and who value their privacy very highly, it might be worth potentially paying higher premiums.
Winder says the issue is that some companies may not be as transparent as others in clearly stating what users are giving consent to in the first place.
“The issue is it has to go above and beyond the fine print because no one reads the fine print,” Winder says.
“It’s mostly on the consumer to be aware, but I just think that companies generally shouldn’t deceive anyone. You should try to be as transparent with your consumers and your customers as you can, because that leads to greater satisfaction.”
