Code of Conduct for Insurers’ Use of Credit Information

10 guidelines for insurer’s use of credit information

• 1. Comply with provincial laws

  The insurer must be aware of and fully comply with any federal and provincial laws and regulations (including but not limited to Privacy Legislation and Consumer Reporting Acts) affecting their use and/or management of credit information.

• 2. Ensure credit information used is current and accurate

  1. The insurer must use up to date credit information:

     • The insurer shall not use credit information that is not current

     • The insurer shall update any customer credit information used, at the customer’s request

  2. Ensure accurate credit information is used:

     • When informed by a consumer reporting agency of a correction, supplement or deletion to an individual’s credit file, the insurer must immediately make the necessary adjustments to the file and shall re-underwrite and re-rate the consumer as soon as practical

     • After re-underwriting or re-rating the insured, the insurer shall make any further adjustments that are consistent with its underwriting and rating practices

     • If an insurer determines that the insured has overpaid premium it shall comply with pertinent regulations relating to refunding of overpayments

     • At the request of the consumer, the insurer shall inform the consumer of the source/supplier of the credit information used (i.e. identifying the specific consumer reporting agency that supplied the credit information)

     • The customer/applicant for insurance is responsible for contacting the consumer reporting agency to verify his/her file and, if applicable, request that it be corrected

• 3. Gathering prior consent to collect and use credit information (written or verbal)

  The insurer must secure prior consent to collect and use credit information from the consumer in accordance with the following principles and procedures:

  1. Consent must be informed. The following are characteristics of informed consent:

     • Customers must not feel obliged to give consent

     • Customers must understand the nature and scope of the request. The request for consent must be clear and understandable to ensure that customers know specifically what they are consenting to and how that consent will be used

     • Consent must be specific and the insurer must not presume consent will be given. Consent may be given verbally, in writing or via an e-medium. E-medium consent should be a field that the policyholder can click on directly in order to give consent

     Prior to an agent or broker collecting credit information, the customer consent field (agent’s or broker’s screen) must be clear and explicit for the user. The field must not default to yes.

  2. No one can give consent for another person. Consent must be obtained directly from each individual in the household if their credit information is to be used. Any applicant or co-applicant about whom credit information will be collected and used must either provide a signed consent form or provide verbal consent directly to the agent or broker.

  3. Consent retention. The insurer must maintain the trail or proof of consent in the customer file (paper, e-medium or other). The retention period for the customer file is the minimum period required by law.

  4. Duration of consent. The consent is valid for the duration that the policy is in effect. Unless withdrawn by the policyholder, consent is valid for as long as the policyholder has a continuous business relationship with the insurer, the policy is in force until cancelled. Under these circumstances, the insurer can request the insured’s credit record or credit information from the consumer reporting agency, by relying on the initial consent.

  Wording of consent question (verbal or written)

  Key elements to be included in the consent request:

  • Authorization to collect information from consumer reporting agencies

  • Nature of the information sought (e.g. credit information)

  • Use made by the insurer of the credit information (what will it be used for)

  • Consent use period (validity)

  • Right to withdraw and consequences (an insured may withdraw consent at any time in writing; however, he or she might not benefit from the insurer’s best quote)

• 4. Keeping customers’ credit information confidential and private

  The insurer must respect the confidential nature of personal credit information. The only persons who should have access to the information are those who require it to do their job.

  Relevant Canadian consumer and privacy protection laws are to be fully complied with. Among these is PIPEDA (Personal Information Protection and Electronic Documents Act), the federal privacy law that sets out rules around how private sector organizations may collect, use or disclose personal information. For example:

  Personal Information Protection and Electronic Documents Act (PIPEDA)

  Consent is required for the collection of personal information and the subsequent use or disclosure of this information. Privacy legislation applies at the time that personal information is collected or in cases where the information has already been collected, prior to it being used for a purpose not previously identified. (PIPEDA, Principle 4.3.1)

  Personal information is not to be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information is to be retained only as long as necessary for the fulfillment of those purposes. (PIPEDA, Principle 4.5)

• 5. Use of credit as a sole variable

  The insurer must not refuse to quote or base an insured’s renewal rates, or deny, cancel or non-renew a policy of personal insurance solely on the basis of credit information without consideration of other non-credit underwriting or rating variables.

• 6. Legitimate uses of credit information – pricing, underwriting or financing of premiums – modeling

  An individual’s credit information must not be double counted in rating an individual’s premium, consistent with established actuarial practice.

  The insurer must seek assurance from suppliers of credit information that the following are not used as a negative factor in any credit scoring models:

  1. Inquiries by the consumer for his or her own credit information

  2. Inquiries relating to insurance

  3. Income, gender, address, ethnic group, religion, marital status, or nationality of the consumer

  4. Multiple lender inquiries, if coded by the consumer reporting agency on the consumer’s credit information as being from the home mortgage industry and made within 30 days of one another, unless only one inquiry is considered

  5. Multiple lender inquiries, if coded by the consumer reporting agency on the consumer’s credit information as being from the automobile lending industry and made within 30 days of one another, unless only one inquiry is considered

  6. Factors used in establishing an individual’s credit information must not include factors expressly prohibited in provincial insurance regulations or bulletins, which may vary by province

• 7. Handling of consumer disputes

  Consumer complaints about the insurer’s use of a customer’s credit information are to be addressed by the insurer in accordance with the complaint procedure provisions as required under federal (i.e. Financial Consumer Agency of Canada) and provincial law.

• 8. Taking adverse action as a result of credit information

  1. The Insurer must treat consumers fairly when they have no record of credit information or they are unable to create a credit score. In particular, this means:

     • customers with an absence of credit information shall not be denied coverage, cancelled or non-renewed a policy of personal insurance without consideration of any other applicable underwriting factors

     • in the absence of credit information, underwriting and rating decisions will be based upon the relevant information which is available to the insurer

  2. The insurer must disclose to the consumer adverse action taken only as a result of credit information. Notification should be provided to the consumer explaining the reason for the adverse action and in accordance with applicable Consumer Reporting Legislation laws.

• 9. Refusal of consent

  The insurer shall not refuse to provide an insurance quote to the customer, nor refuse to insure a customer, nor terminate or refuse to renew a policy because the customer refuses to give consent to use their credit information. In this situation the customer will be offered a competitive rate but may not qualify for related discounts or the insurers’ best quote.

  An insurer shall not refuse to provide an insurance quote to a customer, nor terminate or refuse to renew a policy solely because of unfavourable credit information.

• 10. Extraordinary life circumstances

  If a customer believes that his or her credit information resulted in an adverse action by their insurer and that their credit has been adversely impacted by an extraordinary life event, the customer could elect to provide a written request detailing the extraordinary event to their insurer. The insurer would then review the decision to use credit information as a rating and underwriting tool for this customer. The request must provide appropriate supporting documentation verifying how and why their credit history was adversely influenced and why it should be reconsidered. If an exception is approved by the insurer, the customer would be re-rated accordingly.

  Provided that there is sufficient evidence, extraordinary events may be considered by the insurer for the granting of reasonable exemptions. An “extraordinary life event” could be, for example, an identity theft or a catastrophic event as declared by provincial authorities.

  If deemed necessary at the discretion of the insurer, consumers shall be provided a notice that reasonable exceptions are available and information about how the consumer may inquire further.