The daily Post

Bill C-86, entitled “A second Act to implement certain provisions of the budget tabled in Parliament on February 27, 2018 and other measures” (“Bill C-86”), was introduced in the House of Commons on October 29, 2018, and passed second reading with referral to committee on November 6, 2018. Bill C-86 was referred to the Standing Committee on Finance which proposed certain amendments, and the Standing Senate Committees will submit their final reports by December 4, 2018.

Once Bill C-86 comes into force, it will amend certain sections of the Insurance Companies Act (the “ICA”), as well as amend other financial institutions legislation such as the Bank Act and the Trust and Loan Companies Act. Read the text of the latest publication of Bill C-86 here.

If passed, the proposed amendments will, among other things: (i) create new thresholds below which the acquisition of control of, or the acquisition or increase of a substantial investment in, certain entities, including provincially incorporated trust, loan or insurance corporations, provincially incorporated cooperative credit societies, securities dealers, financial intermediaries, and specialized financing entities, will not require the approval of the superintendent of financial institutions (the “Superintendent”), (ii) permit minority investments in the new business growth fund, (iii) permit customers to consent electronically to the receipt of electronic documents, and (iv) clarify that disclosure of privileged information to the Superintendent will not constitute a waiver of privilege.

Control thresholds

Under the current version of the ICA, subject to certain exceptions, companies (as such term is defined in the ICA) must obtain the approval of the Superintendent in order to acquire control of, or acquire or increase a substantial investment in, the permitted entities described above.

Bill C-86 proposes to add to the existing exceptions by creating new thresholds for determining control, and the acquisition or increase of a substantial investment without taking control, of the entities described above, under which the Superintendent’s approval would no longer be required. The new thresholds for control would provide an exception for acquisitions where the target entity’s consolidated assets would constitute less than one percent of the acquiring company’s total consolidated assets in the case of an acquiring company with equity of 12 billion dollars or more, and two percent of the acquiring company’s total consolidated assets in the case of any other acquiring company.

The new thresholds for acquisition or increase of a substantial investment would provide an exception for acquisitions where the value of the shares, or ownership interests in, the target entity to be acquired, directly or indirectly, or acquired within the prior 12 months, by the acquiring company or a subsidiary of the company would constitute less than half a percent of the acquiring company’s total consolidated assets in the case of a company with equity of 12 billion dollars or more, and one percent of the acquiring company’s total consolidated assets in the case of any other company.

Business growth fund

Bill C-86 would permit a company, or a fraternal benefit society, and its subsidiaries to invest a maximum of 200 million dollars in the new Canadian Business Growth Fund (GP) Inc., a CBCA company (defined as the “business growth fund” in Bill C-86). The Advisory Council on Economic Growth recommended the creation of a private sector led growth fund in its report titled “Unlocking Innovation to Drive Scale and Growth”. Read the report here. According to the report, the business growth fund will be led and financed by financial institutions and is expected to address the gap in growth financing for small to medium-sized firms through the purchase of minority stakes or unsecured debt for approved growth and expansion projects. The proposed amendments set limits on the amount of ownership companies can acquire in the business growth fund.

Consent may be given electronically

Under the existing language of section 1037 of the ICA, receipt of an electronic notice or document is not valid unless the addressee has consented to receive documents and notices in electronic format. Bill C-86 proposes to add to section 1037 by providing that a customer may give consent electronically to the receipt of documents or notices in electronic form. If passed, we expect that this amendment would make it easier for insurance companies to comply with the consent requirements relating to the transmission of electronic documents.

No waiver of privilege

Although the ICA currently prohibits supervisory information from being used as evidence in any civil proceedings, Bill C-86 would provide greater certainty that disclosure by a company of any information that is subject to privilege would not constitute a waiver of privilege. The proposed amendment would also prohibit the Superintendent from disclosing any privileged information to any person whose functions include the investigation or prosecution of offences under any act of Parliament or of the legislature of a province. Corresponding changes have been made to section 37 of the Office of the Superintendent of Financial Institutions Act.

We will keep you informed on the progress of Bill C-86 and its effect on the ICA.

On September 18, 2018 the Office of the Superintendent of Financial Institutions (OSFI) published the final updated version of its Corporate Governance Guideline (“2018 CG Guideline“). The 2018 CG Guideline is more principles-based and sets out OSFI’s expectations for boards of directors (the “Board”) of federally regulated financial institutions, focusing particularly on Board effectiveness.

The 2018 CG Guideline’s main updates include:

1. providing Boards with more discretion to meet the principles of the guideline, considering their organizations’ size, complexity and risk profile;
2. clarifying the delineation between Board and senior management responsibilities; and
3. consolidating Board duties previously set out in numerous OSFI guidelines and advisories.

OSFI has said it will conduct information seminars for directors and corporate secretaries of federally regulated financial institutions in fall 2018.

Please note that the 2018 CG Guideline does not apply to the Canadian branch operations of foreign financial institutions. However, OSFI plans to review and amend guidelines E-4A Role of the Chief Agent & Record Keeping Requirements and E-4B Role of the Principal Officer & Record Keeping Requirements in the near future.

On November 1^st, the new Breach of Security Safeguards Regulations  (the “Breach Regulations“) under the Personal Information and Protection and Electronic Documents Act (“PIPEDA“) came into force. See the link to the Breach Regulations here.

Under the Breach Regulations, both small and large organizations now have an obligation to:

1. Report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner (the “OPC“) where there is a real risk of significant harm.
2. Notify affected individuals and notify appropriate government organizations.
3. Keep a record of every breach of security safeguards.

The OPC has published guidance related to the Breach Regulations, titled “What you need to know about mandatory reporting of breaches of security safeguards”. See the link here.

Reporting A Breach of Security Safeguards

PIPEDA defines a “breach of security safeguards” as “the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards that are referred to in clause 4.7 of Schedule 1 [of PIPEDA] or from a failure to establish those safeguards”. The definition contemplates that even the loss of a USB key or a laptop would constitute a “breach of security safeguards”.

The reporting obligations do not require that an organization report all breaches to the OPC. The reporting obligations apply where the breach involves personal information that is under organization’s control, and when it is reasonable to believe that the breach creates a “real risk of significant harm”.

Determining whether there is a “real risk of significant harm” requires, among other things, an analysis of the sensitivity of the personal information involved and the probability that the personal information will be misused. According to the OPC, “significant harm” includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Neither PIPEDA nor the new Breach Regulations define “sensitivity”. However, Principal 4.3.4 of PIPEDA provides the names and addresses of subscribers to some special-interest magazines as an example of personal information that would likely be considered sensitive.

Under the Breach Regulations, an organization is also responsible for reporting a breach of security safeguards where there is a real risk of significant harm by a third-party service provider. The OPC expects that, in such an event, both the service provider and the organization will submit reports to the OPC.

Organizations may report certain information to the extent that it is available at the time of reporting and an organization may update the report at a later date.

Notifying Affected Individuals and Organizations

The Breach Regulations require that organizations notify affected individuals as soon as feasible in the event of a breach where there is a real risk of significant harm, and that organizations notify affected individuals directly. Depending on the sensitivity of the personal information and the real risk of significant harm, the organization may need to, in some cases, notify affected individuals prior to submitting its report to the OPC.

The Breach Regulations provide that the notification to affected individuals must include information sufficient to allow the affected individuals to understand the significance of the breach and to take any available steps to reduce the risk of harm that may result from the breach.

The Breach Regulations further provide that there are limited circumstances where direct notification may not be required, and an organization may provide indirect notification. Indirect notification may be given in circumstances where direct notification may cause further harm to the individuals, direct notification would cause undue hardship for the organization, or the organization does not have contact information for the affected individual.

In addition to the requirement to notify affected individuals, organizations are required to notify any other government organizations or institutions that the organization believes may be able to reduce the risk of harm to individuals.

Record Keeping

Although the reporting requirements under the Breach Regulations apply to breaches where there is a real risk of significant harm, the record keeping requirements apply to every breach, regardless of the risk of harm. Records of breaches must contain enough information to allow the OPC to confirm compliance with the Breach Regulations and PIPEDA, including an explanation of why, in cases where a breach was not reported, the breach was determined not to pose a real risk of significant harm. Breach records must be kept for two years, or longer as may be required in accordance with applicable law or related internal record-keeping requirements.

On September 28, 2018, the Financial Services Commission of Ontario (FSCO) released its Treating Financial Services Consumers Fairly Guideline.

The Guideline applies to those licensed or registered by FSCO in the insurance, credit union/caisse populaire, loan and trust and mortgage brokering sectors. The purpose of the Guideline is “to ensure there is common understanding between FSCO and its Licensees as to what it means to treat consumers fairly.”

The Guideline contains a list of eight principal expectations, which FSCO says are intended not to be a prescriptive or exhaustive list, but rather to be used as guidance as part of a principles-based approach. The expectations listed by FSCO are:

1. FSCO expects that a core component of a Licensee’s business governance and culture is fair treatment of consumers.

2. FSCO expects Licensees to act with due skill, care and diligence at all times, but especially when dealing with consumers or designing financial services or products for consumers.

3. FSCO expects Licensees to promote financial services and products in a manner that is clear, fair and not misleading or false.

4. FSCO expects Licensees to recommend products that are suitable, taking into account the consumer’s disclosed personal circumstances and financial condition.

5. FSCO expects Licensees to disclose and manage any potential or actual conflicts of interest.

6. FSCO expects Licensees to provide continuing service and keep consumers appropriately informed, through to the point at which all obligations to the financial services consumer have been satisfied, including claims handling or the diligent provision of benefits.

7. FSCO expects Licensees to have policies and procedures in place to handle complaints in a timely and fair manner.

8. FSCO expects Licensees to protect the private information of financial services consumer and inform them of any privacy breach.

The full text of the Guideline can be viewed here.

FSCO has also published a related document to address anticipated questions, which is available here.

Insurance Brokers who own their own book of business and are contemplating moving to a new agency should be aware of a recent order dated April 27, 2018 from the Insurance Council of B.C. (“Council”) in which Council ordered the broker to pay a $2,500 fine as a result of transferring a client list without the express consent of both old and new agencies and of the clients. The client list contained personal information and included client names, policy numbers, and policy effective dates. See the Council’s order here.

In B.C., Council Rule 7(1) provides that licensees “must hold in strict confidence all information acquired in the course of the professional relationship concerning the personal and business affairs of a client” and prohibits licensees from using or disclosing such information without express authorization by the client. In this case, prior to becoming a representative of the agency, the broker had made a verbal agreement with the agency’s nominee that the clients would remain his. After joining the new agency, the broker had also called each client when their policies were up for renewal to advise them of his move to the new agency. However, the broker had not obtained the express consent of his clients to transfer their personal information to the new agency, nor did he obtain the consent of the old and new brokerages to the transfer of the clients’ information, and therefore the broker was in contravention of Council Rule 7(1).

Under Council Notice ICN 17-004 Reminder of Licensee Responsibilities Related to Disclosure or Transfer of Client Information (“Notice 17-004“), if a general insurance agent leaves one agency to represent another, such agent must not have any client information in their possession, and may not transfer client information from the former agency to the new agency without the consent of both agencies and express authority from the client to transfer their personal information.

Although Council Rule 7(1) and Notice 17-004 are only applicable in B.C., brokers in all provinces and territories must comply with the federal Personal Information Protection and Electronic Documents Act (or their province’s substantially similar legislation) which requires individuals to have knowledge of, and consent to, the use and disclosure of their personal information, with certain exceptions for business transactions.

Brokers who work within a corporate agency who intend to own their own books of business are therefore advised to obtain an express consent from each client which permits not only the corporate agency, but also the broker personally, to collect, use and disclose the client’s personal information and permits such information to be transferred to another corporate agency in the event that the broker decides to switch agencies.

On April 12, 2018, Quebec’s insurance regulator, the Autorite des marches financiers (the “AMF”) announced that it had entered into agreements with three separate Canadian-licensed insurers, and had imposed administrative penalties which in the aggregate equal $2,100,000, related to unauthorized sales practices used to offer insurance products to the credit card customers of at least two separate retailers.

Each of the three insurers, The Canada Life Assurance Company, Chubb Life Insurance Company of Canada and The Manufacturers Life Insurance Company, reportedly acknowledged that they did not follow sound business practices in relation to the distribution of the products, and had failed to comply with certain provisions of Quebec’s insurance legislation.

In each case it was reported that the insurers offered the products through employees of telemarketing firms, who were persons not certified by the AMF for this purpose, and that certified persons who were involved did not fulfill their required roles in relation to the distribution of the products in question.

Each of the insurers confirmed that the unauthorized sales practices were no longer being used, and each have committed to notify all policyholders who are still holders of the products concerned, that a certified representative will be available to answer any question related to the products.

Further details are available on the AMF’s website.

The Registered Insurance Brokers of Ontario (RIBO), the self-regulatory organization for insurance brokers in Ontario, has submitted proposed amendments to the Registered Insurance Brokers Act (RIBA) and its regulations, to the Ontario Ministry of Finance (collectively, the “Proposed Amendments”). The Proposed Amendments are intended to demonstrate RIBO’s alignment with the Ontario Government’s stated objective of increasing consumer protection related to financial services in Ontario.

RIBO says that the Proposed Amendments were made with a view to increasing transparency, addressing the provision of insurance advice through diverse digital platforms, and reflecting the increasing importance of consumer protection.

The Proposed Amendments include, among other things:

1. Opening hearings of RIBO’s discipline committee.
2. Enhancing enforcement powers by giving RIBO the ability to levy administrative penalties.
3. Giving RIBO the ability to characterize a broker’s failure to cooperate with RIBO as misconduct.
4. Imposing a duty on principal brokers to report certain suspected acts of misconduct.
5. Bringing fines and penalties that are available to RIBO’s discipline committee up to date.
6. Updating minimum errors & omissions limits.

The Proposed Amendments also include updates to brokers’ continuing education and professional development requirements, which would become effective in 2018. Although no additional hours would be required as part of the amendments to the education and professional development, a new ethical skills category would be created, as well as minimum requirements for technical skills, and a cap on the number of hours allowed for “personal skills”. The amendments related to continuing education are part of RIBO’s broad public protection mandate and are aimed at enhancing broker professionalism.

According to Tracy McLean, President of RIBO, the Proposed Amendments would the most comprehensive yet. In RIBO’s Fall 2017 Bulletin (here: https://www.ribo.com/index.php?option=com_content&view=article&id=39&Itemid=115), Tracy McLean reported that, after a meeting with the Ministry of Finance, RIBO’s Proposed Amendments were well received. The Proposed Amendments have not yet gone to the Legislative Assembly for first reading.

We will keep you updated with respect to the progress of the Proposed Amendments.