Confidentiality, Privacy and Information Handling
The confidentiality duty
Client information is confidential. Agents may collect, use and disclose personal information only for purposes a reasonable person would consider appropriate and only with the client's knowledge and consent, consistent with privacy law such as PIPEDA and provincial privacy statutes. Consent may be express or implied depending on sensitivity, but sensitive information such as health data generally requires express consent. Collection must be limited to what is necessary, retained only as long as needed, and protected with reasonable safeguards.
Sharing information
Information may be shared with the insurer to underwrite and administer the policy, and with third parties only with consent or as required by law. Agents must be careful with email, mobile devices, shared offices and social media: a photograph of a document or a conversation in a public place can be a privacy breach. Access must be role-based; staff should see only what they need.
Traps to watch
- Assuming that because an insurer is involved, sharing is automatically permitted.
- Treating consent as permanent when the purpose has changed.
- Discussing a client's health or finances with a spouse or family member without authority.
- Retaining client files indefinitely after the relationship ends.
Rule of thumb
Before sharing any client information, ask: what is the purpose, who needs it, and what consent covers it? If any of the three is unclear, stop and verify.