IN THE MATTER OF THE FINANCIAL INSTITUTIONS ACT (RSBC 1996, c.141) (the “Act”)
and the INSURANCE COUNCIL OF BRITISH COLUMBIA (“Council”)
and PRESTIGE INSURANCE SERVICES LTD. DBA PERPETUAL INSURANCE SERVICES (the “Agency”)
and ALEXANDER HAMILTON CHEUNG HIN NAM (the “Nominee”)
ORDER As Council made an intended decision on March 10, 2020, pursuant to sections 231, 236, and 241.1 of the Act; and
As Council, in accordance with section 237 of the Act, provided the Agency and the Nominee with written reasons and notice of the intended decision dated April 3, 2020; and
As the Agency and the Nominee have not requested a hearing of Council’s intended decision within the time period provided by the Act;
Under authority of sections 231, 236 and 241.1 of the Act, Council orders that: 1. The Agency is reprimanded; 2. The Nominee is required to complete the Council Rules Course by no later than August 10, 2020; 3. The Nominee is required to complete a privacy course, subject to Council’s approval of the course, by no later than August 10, 2020;
4. The Agency is assessed investigative costs of $1,000, due and payable no later than August 10, 2020;
5. A condition is imposed on the Nominee’s general insurance licence and life and accident and sickness insurance licence that failure to complete the required courses by August 10, 2020 will result in the automatic suspension of those licences, and the Nominee will not be permitted to complete the 2021 annual filing until such time as the Nominee has completed the course requirements; and
Order Prestige Insurance Services Ltd. DBA Perpetual Insurance Services, and Alexander Hamilton Cheung Hin Nam LIC-153136C90197R1, LIC-47033B747162R2, LIC-47033C66097R1, COM-2019-00073 May 11, 2020 Page 2 of 2
6. A condition is imposed on the Agency’s general insurance licence that failure to pay the investigative costs by August 10, 2020 will result in the automatic suspension of the Agency’s licence, and the Agency will not be permitted to complete the 2021 annual filing until such time as the Agency has paid the investigative costs in full.
This order takes effect on the 11 th day of May, 2020. ___________________________________ Janet Sinclair Executive Director, Insurance Council of British Columbia
INTENDED DECISION of the INSURANCE COUNCIL OF BRITISH COLUMBIA (“Council”)
respecting PRESTIGE INSURANCE SERVICES LTD. DBA PERPETUAL INSURANCE SERVICES (the “Agency”)
and ALEXANDER HAMILTON CHEUNG HIN NAM (the “Nominee”)
1. Pursuant to section 232 of the Financial Institutions Act (the “Act”), Council conducted an investigation to determine whether the Agency and/or the Nominee acted in compliance with the requirements of the Act, Council Rules, and Code of Conduct, and in particular whether the Agency and/or the Nominee breached sections 5 (“Competence”) or 7 (“Usual Practice: Dealing with Clients”) of the Code of Conduct in relation to a privacy breach that occurred between late February and early May of 2019.
2. As part of Council’s investigation, on February 4, 2020, a Review Committee (the “Committee”) met to discuss the investigation. The Nominee, as well as an Agency manager (the “Manager”), met with the Committee. Prior to the meeting, a report prepared by Council staff was distributed to the Committee for review and to the Agency and Nominee for review and response. A discussion of the report and submissions provided by the Agency and Nominee took place at the meeting. Having reviewed all the relevant materials and discussed the matter, the Committee prepared a recommendation for Council.
3. The Committee’s recommendation, along with the aforementioned report prepared by Council staff, were reviewed by Council at its March 10, 2020 meeting, where it was determined the matter should be disposed of in the manner set out below.
PROCESS 4. Pursuant to section 237 of the Act, Council must provide written notice to the Agency and Nominee of the action it intends to take under sections 231, 236, and 241.1 of the
Intended Decision Prestige Insurance Services Ltd. DBA Perpetual Insurance Services, and Alexander Hamilton Cheung Hin Nam LIC-153136C90197R1, LIC-47033B747162R2, LIC-47033C66097R1, COM-2019-00073 April 3, 2020 Page 2 of 5
Act before taking any such action. The Agency and Nominee may then accept Council’s decision or request a formal hearing. This intended decision operates as written notice of the action Council intends to take against the Agency and Nominee.
FACTS 5. The Nominee has held a general insurance licence since 1986 and a life and accident and sickness insurance (“Life Agent”) licence since 1998. He has been the Agency’s nominee since 2013, and is currently the nominee for five agencies. The Agency was first licensed with Council in June 2002, with its trade name being added to its licence in December 2002.
6. The Agency’s office is located in Metropolis at Metrotown (“Metrotown”). Due to renovations required by Metrotown, the Agency temporarily occupied a different retail unit (the “Unit”) at Metrotown between January 12, 2019 and February 20, 2019.
7. On May 2, 2019, prospective new commercial occupants of the Unit discovered that the Agency had left behind three boxes of documents (the “Documents”) relating to insurance business. They proceeded to contact the Insurance Corporation of British Columbia (“ICBC”) about the matter, and the Agency’s ICBC broker account representative (the “ICBC Representative”) removed the Documents on May 3, 2019. The Documents, which related to ICBC business, were subsequently shredded by ICBC.
8. The Manager communicated with the ICBC Representative following the discovery of the Documents and their subsequent removal. Following the ICBC Representative’s advice, the Manager reported what had occurred to the Office of the Information and Privacy Commissioner (“OIPC”) on May 17, 2019. After concluding their review, the OIPC wrote to the Manager on July 4, 2019, stating that, given the totality of the circumstances, the risk of harm resulting from the privacy breach was low. The Agency was advised by the OIPC that it was not necessary for the Agency to contact every individual whose information may have been amongst the documents, due to the media’s coverage of the incident, the quick containment of the information, and the low risk of harm. The OIPC considered the Agency’s response to the incident satisfactory and closed their file.
9. In approximately late May 2019, the Agency posted a notice on its website in which the incident was described. According to the Manager, no customers contacted them with concerns about their privacy following the incident.
Intended Decision Prestige Insurance Services Ltd. DBA Perpetual Insurance Services, and Alexander Hamilton Cheung Hin Nam LIC-153136C90197R1, LIC-47033B747162R2, LIC-47033C66097R1, COM-2019-00073 April 3, 2020 Page 3 of 5
10. The Nominee and the Manager, in their discussion with the Committee, described the Documents being left behind in the Unit as a one-time incident that had been the result of human error. They explained that the Unit was designed in such a way that it served awkwardly as an insurance agency’s office, with document storage options limited to the use of deep cupboards. Paperwork intended for shredding was stored in the cupboards in order to keep it out of public view. However, when the paperwork was collected for shredding, the three boxes containing the Documents were accidently missed by Agency staff, who had failed to double-check every cupboard. During the time that the Documents had been left unattended in the Unit, the Unit had been locked and was accessible only by Metrotown staff.
11. Both the Nominee and the Manager described the Manager as having taken prompt action to address the incident. The Manager stated that he heard about the Documents being found in the Unit on the radio on the morning of May 3, 2019, and immediately called another Agency employee, instructing them to go to the Unit to collect the Documents. However, the prospective new occupants of the Unit would not allow the Agency to retrieve the Documents. The Manager further explained that he had proactively contacted ICBC to inform them of the incident.
12. The Nominee and the Manager also described to the Committee the steps that the Agency has taken since the incident to improve its document storage and destruction processes, which are now better organized and more comprehensive than they had been previously.
ANALYSIS 13. Council’s opinion is that the Nominee and the Agency had immediately realized the seriousness of the privacy breach caused by the Documents being left in the Unit and had reacted promptly and reasonably in response. The Agency’s response to the error including making immediate efforts to retrieve the documents, cooperating fully with ICBC, self-reporting the incident to the OIPC, posting a notice on the Agency’s website, and implementing improved document storage and destruction processes. Given the Agency’s response, and the fact that no public harm resulted from the incident, Council concludes that it is not necessary to fine either the Agency or the Nominee.
14. Prior to making its decision, Council took a precedent file into consideration. 15. Gilbert Gowl-Chuen Yeung (December 2010) concerned a licensee with a Level 2 general insurance licence who placed a garbage bag full of ICBC documents into a recycling bin outside of his apartment complex. The documents contained vehicle registrations,
Intended Decision Prestige Insurance Services Ltd. DBA Perpetual Insurance Services, and Alexander Hamilton Cheung Hin Nam LIC-153136C90197R1, LIC-47033B747162R2, LIC-47033C66097R1, COM-2019-00073 April 3, 2020 Page 4 of 5
copies of customers’ identification, credit card slips, and banking information. The licensee explained that he had intended to shred the insurance documents, but had mixed up the bag containing the documents with a bag full of personal documents that he had intended to recycle. The licensee stated that he had contacted the recycling depot to which the documents would be brought, but had been told that the insurance documents could not be retrieved. Council fined the licensee $1,000 and assessed him investigative costs of $1,031.25.
16. Council considers the privacy breach caused by the Agency to be less egregious than what had occurred in the Yeung precedent and, as such, requires a lesser penalty. Nevertheless, Council concludes that the Agency and Nominee had put client information at risk by failing to ensure that all paperwork had been removed from the Unit. Although it was an isolated and unintentional incident, such behavior is unacceptable to Council. Council deems it appropriate that the Agency be reprimanded and that the Nominee be required to take both the Council Rules Course and a privacy course. Council believes that this disposition balances the necessity of communicating to the industry and public the importance of protecting the privacy of client information, with the need to take into account the several relevant mitigating factors.
INTENDED DECISION 17. Pursuant to sections 231, 236 and 241.1 of the Act, Council made an intended decision to:
i. Reprimand the Agency; ii. Require the Nominee to complete the Council Rules Course within 90 days of Council’s order;
iii. Require the Nominee to complete a privacy course, subject to Council’s approval of the course, within 90 days of Council’s order;
iv. Assess investigative costs of $1,000 to the Agency, to be paid within 90 days of Council’s order;
v. Impose a condition on the Nominee’s general insurance licence and Life Agent licence that failure to complete the required courses within 90 days of Council’s order will result in the automatic suspension of those licences, and the Nominee will not be permitted to complete annual filing until such time as the Nominee has completed the course requirements; and
Intended Decision Prestige Insurance Services Ltd. DBA Perpetual Insurance Services, and Alexander Hamilton Cheung Hin Nam LIC-153136C90197R1, LIC-47033B747162R2, LIC-47033C66097R1, COM-2019-00073 April 3, 2020 Page 5 of 5
vi. Impose a condition on the Agency’s general insurance licence that failure to pay the investigative costs within 90 days of Council’s order will result in the automatic suspension of the Agency’s licence, and the Agency will not be permitted to complete annual filing until such time as the Agency has paid the fine in full.
18. Subject to the right of the Agency and Nominee to request a hearing before Council pursuant to section 237 of the Act, the intended decision will take effect after the expiry of the hearing period.
RIGHT TO A HEARING 19. If the Agency or Nominee wishes to dispute Council’s findings or its intended decision, the Agency or Nominee may have legal representation and present a case at a hearing before Council. Pursuant to section 237(3) of the Act, to require Council to hold a hearing, the Agency or Nominee must give notice to Council by delivering to its office written notice of this intention within fourteen (14) days of receiving this intended decision. A hearing will then be scheduled for a date within a reasonable period of time from receipt of the notice. Please direct written notice to the attention of the Executive Director. If the Agency or Nominee does not request a hearing within fourteen (14) days of receiving this intended decision, the intended decision of Council will take effect.
20. Even if this decision is accepted by the Agency and Nominee, pursuant to section 242(3) of the Act, the British Columbia Financial Services Authority (“BCFSA”) still has a right to appeal this decision of Council to the Financial Services Tribunal (“FST”). The BCFSA has 30 days to file a Notice of Appeal, once Council’s decision takes effect. For more information regarding appeals, contact the FST directly at 250-387-3464 or view their appeal guide at www.fst.gov.bc.ca/pdf/guides/ICGuide.pdf.
Dated in Vancouver, British Columbia, on the 3 rd day of April, 2020. For the Insurance Council of British Columbia
___________________________ Janet Sinclair Executive Director