In the Matter of The FINANCIAL INSTITUTIONS ACT (RSBC 1996, c.141) (the "Act")
and The INSURANCE COUNCIL OF BRITISH COLUMBIA ("Council")
and KRISTEN MICHELLE BURR (the "Licensee")
ORDER As Council made an intended decision on September 16,2014, pursuant to sections 231,236, and 241.1 of the Act; and
As Council, in accordance with section 23 7 of the Act, provided the Licensee with written reasons and notice of the intended decision dated September 29, 2014; and
As the Licensee has not requested a hearing of Council's intended decision within the time period provided by the Act;
Under authority of sections 231, 23 6, and 241.1 of the Act, Council orders: 1. The Licensee's general insurance licence is suspended for a period of six months. 2. The Licensee is assessed Council's investigative costs of $875.00. 3. A condition is imposed on the Licensee's general insurance licence that requires her to pay the above-ordered investigative costs no later than January 21,2015. If the Licensee does not pay the ordered investigative costs in full by this date, the Licensee will not be permitted to complete any annual filing until such time as the ordered investigative costs are paid in full. If they remain unpaid as of May 4, 2015, the Licensee's general insurance licence will remain suspended until the ordered investigative costs are paid in full.
The Licensee's suspension will begin on November 5, 2014, and end on May 4, 2015 at midnight.
.. ./2
Order Kristen Michelle Burr 183657-11495 October 21, 2014 Page 2 of2
This order takes effect on the 21st day of October, 2014.
of the INSURANCE COUNCIL OF ("Council")
respecting KRISTEN MICHELLE (the "Licensee")
INTRODUCTION Pursuant to section 232 of the Financial Institutions Act (the "Act"), Council conducted an investigation to determine whether the Licensee acted in compliance with the requirements of the Act.
An investigation report regarding the allegation that the Licensee accessed an Insurance Corporation of British Columbia ("ICBC") database for an improper purpose was distributed to the Licensee for review, and the Licensee was provided an opportunity to clarify the information contained therein and make further submissions.
The investigation report was considered by Council at its September 16, 2014 meeting. At the conclusion of its meeting, Council determined the matter should be disposed of in the manner set out below.
PROCESS Pursuant to section 23 7 of the Act, Council must provide written notice to the Licensee of the action it intends to take under sections 231,236, and 241.1 of the Act before taking any such action. The Licensee may then accept Council's decision or request a formal hearing. This intended decision operates as written notice of the action Council intends to take against the Licensee.
FACTS On August 29} 2013, while on a lunch break at work at an insurance agency (the "Agency"), the Licensee was in her vehicle in the Agency's parking lot when another vehicle backed into her vehicle. The Licensee was shaken from the accident.
... /2
Intended Decision Kristen Michelle Burr 183657-Il495 September 29, 2014 Page 2 of5
The other driver (the "Driver") left the scene in his vehicle, but the Licensee was able to obtain the vehicle's licence plate information. She immediately returned to the Agency's office and spoke to a coworker who indicated the Driver may have been an Agency client who just left the office. When they looked at the coworker's computer screen, it showed some of the Driver's information in the Agency's client management system, including the Driver's name which the Licensee subsequently used to conduct a query in an ICBC database.
In particular, the Licensee went to her own computer station, entered the Driver's last name and licence plate number in ICBC's Broker Query System ("BQS"), and obtained information about the Driver. The Licensee then called ICBC's claims department to report the hit and run on her vehicle. With the ICBC BQS inquiry screen visible on her monitor, she gave the ICBC claims representative the licence plate of the Driver's vehicle, the vehicle make and model, the Driver's name, and his driver's licence number. The Driver's telephone number, which the Licensee had taken from the Agency's client management system, was also provided to the ICBC claims representative.
In the normal course of her employment at the Agency, the Licensee regularly accesses information from the ICBC BQS for clients, and has information visible on her monitor when she contacts the ICBC Broker Inquiry Unit or other underwriting departments during insurance transactions. In this instance, the Licensee stated she was more in the ((at work, job frame of mind" rather than recognizing she was telephoning ICBC for her own personal claim, and she was trying to be helpful to the ICBC claims representative.
The information she read from her monitor was not shared with anyone other than the ICBC claims representative. In retrospect, the Licensee advised that she knew she only needed the Driver's licence plate number to report the claim to ICBC, and that her privacy training should have prevented her from accessing the Driver's information.
The Licensee's manager at the Agency advised that the Licensee is an excellent and honest employee. The Licensee was cooperative throughout the Agency's internal investigation of this incident as well as Council's investigation, and she has since reviewed the Agency's confidentiality and privacy rules, and intends to take ICBC' s Information Security and Privacy Course.
ANALYSIS Council determined that the Licensee breached a consumer's confidentiality and ICBC's privacy policy when she accessed an ICBC database to obtain information about the consumer, and when she used the consumer's information for purposes unrelated to an insurance transaction, unbeknownst to the consumer.
Intended Decision Kristen Michelle Burr 183657-Il495 September 29, 2014 Page 3 of5
Council accepted that the Licensee was shaken from the accident and did not set out to breach a consumer's privacy or act in an unauthorized manner. There was also no evidence that she shared the consumer's information other than during her conversation with ICBC. To Council, this was a situation of a licensee, who had previous training on privacy, exercising poor judgment following an accident.
In determining· an appropriate disposition, Council sought to find a balance between addressing its concerns that a consumer's confidentiality was breached and ICBC's privacy policy was not adhered to, and acknowledging the mitigating factors present in this case as described above. Council also gave consideration to the fact the Licensee was forthright at the onset of the investigation.
Council considered a range of decisions regarding privacy breaches and improper access of the ICBC database.
InK Styles, the licensee accessed an acquaintance's information on an ICBC database without his permission because she was curious about how much of a discount the acquaintance received on his vehicle insurance and had hoped to assist him with a better discount. Council determined that a suspension of one year was required, but reduced the suspension to eight months to take into account that the licensee had already been unemployed for four months as a result of the misconduct. Council also assessed investigative costs.
In C. Potter, the licensee accessed an ICBC database without client knowledge or authorization in order to place coverage for clients and increase her business. In determining that a suspension of six months and a period of supervision was appropriate to address the privacy breaches and related issues, Council took into consideration the fact that the licensee had been unemployed as a result of her conduct for nine months.
In 1: Li, the licensee improperly accessed an ICBC database and provided an ICBC policyholder's telephone number to a client who wanted to contact the policyholder to resolve a claim. Council concluded the licensee unintentionally acted contrary to the requirements surrounding confidentiality in a misguided attempt to assist the client in a claim matter. In particular, the licensee had no personal relationship with the client and, as it was apparent to her that the client and the policyholder had voluntarily exchanged some personal information, she assumed that accessing the policyholder's telephone number in ICBC's database and sharing this information with the client was acceptable. Council determined that a fine of$1,000.00, 12 month supervision, and a requirement to complete ICBC's Privacy Please tutorial were appropriate penalties in the circumstances. Council also assessed investigative costs.
In this case, Council determined it is necessary to suspend the Licensee's licence for a period of time that vvill sufficiently admonish her misconduct and also demonstrate to other licensees that even seemingly innocuous breaches of confidentiality are a serious matter.
Intended Decision Kristen Michelle Burr 183657-11495 September 29, 2014 Page 4 of5
DECISION Pursuant to sections 231,236, and 241.1 of the Act, Council made an intended decision to: 1. Suspend the Licensee's general insurance licence for a period of six months. 2. Assess the Licensee Council's investigative costs of $875.00. The Licensee is advised that should the intended decision become final, the investigative costs will be due and payable within 90 days of the date of the order. If the ordered investigative costs are still outstanding after the 90 days, the Licensee will not be permitted to complete any annual filing until such time as the costs are paid in full. If the ordered investigative costs are still outstanding once the licence suspension is served, the Licensee's licence will remain suspended until such time as the costs are paid in full.
The Licensee's suspension will begin on November 5, 2014, and end on May 4, 2015 at midnight.
The intended decision will take effect on October 21,2014, subject to the Licensee's right to request a hearing before Council pursuant to section 23 7 of the Act.
RIGHT TO A HEARING If the Licensee wishes to dispute Council's findings or its intended decision, the Licensee may have legal representation and present a case at a hearing before Council. Pursuant to section 237(3) of the Act, to require Council to hold a hearing, the Licensee must give notice to Council by delivering to its office written notice of this intention by October 20,2014. A hearing will then be scheduled for a date within a reasonable period of time from receipt of the notice. Please direct written notice to the attention of the Executive Director.
If the Licensee does not request a hearing by October 20,2014, the intended decision of Council will take effect.
Intended Decision Kristen Michelle Burr 183657-I1495 September 29, 2014 Page 5 of5
Even if this decision is accepted by the Licensee, pursuant to section 242(3) of the Act, the Financial Institutions Commission still has a right to appeal this decision of Council to the Financial Services Tribunal ("FST"). The Financial Institutions Commission has 30 days to file a Notice of Appeal, once Council's decision takes effect. For more information respecting appeals to the FST, please visit their website at fst.gov.bc.ca or contact them directly at:
Financial Services Tribunal PO Box 9425 Stn Prov Govt Victoria, British Columbia V8W9Vl
Reception: 250-387-3464 Fax: 250-356-9923 Email: FinancialServicesTribunal@gov. bc.ca
Dated in Vancouver, British Columbia, on the 29th day of September, 2014. For the Insurance Council of British Columbia
Gerald D. Matier Executive Director
GM/ig