Page 20 - BIPAR Annual Report 2020_EN

General Data Protection
Regulation (GDPR)
The General Data Protection EU Regulation (the “GDPR”) was adopted in April 2016. It applied in all EU
Member States from 25 May 2018. The GDPR is binding in its entirety and directly applicable. The GDPR
repealed the Data Protection Directive that provided the previous EU data protection rules.
The GDPR only covers the processing of personal data: this is information that relates to a living
identified or identifiable person (a data subject). Special categories of data, such as health data, are
subject to additional protection and such data will only be processed with express consent from the
data subject. Derogations are possible. Data processing covers most activities involving personal
data: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment
or combination, restriction, erasure and destruction. Therefore, any private company coming into
contact with personal data is likely to be considered as processing such data.
The GDPR is a cross-sectoral legislation. It applies to the insurance distribution sector but is not specific
to it. Consequently, compliance with the Regulation has been challenging for intermediaries in some
respects.
The GDPR takes the form of a Regulation, i.e. it is “binding in its entirety and directly applicable in all
Member States.” However, the GDPR makes provision for secondary legislation by way of Delegated
and Implementing Acts to be adopted by the European Commission in various areas. The GDPR is also
supplemented by guidelines issued by the European Data Protection Board (EDPB). Lastly, whilst the
GDPR has the status of a Regulation, it includes some 50 provisions that permit EU Member States to
retain national legislation. For example, the GDPR provides for Member States to maintain or introduce
further conditions, including limitations with regard to the processing of health data. This may offer a
means of addressing some of the challenges specifically faced by insurance intermediaries (see below).
The GDPR and insurance intermediaries
Controllers or Processors or Joint Controllers?
Insurance intermediaries, whether large firms or small offices, are confronted daily with the processing of data and
are, therefore, directly affected by the GDPR. The data that insurance intermediaries process is necessary to provide
quotations, arrange insurance cover, manage claims and for client relationship management, etc.
insurance intermediaries will process personal data on their own account and will act as data controllers. In some others,
intermediaries will act under clear processing instructions from a data controller (example: an insurer) and will be data
processors. Intermediaries could also be joint controllers. The GDPR requires joint controllers to reach an arrangement to
determine their respective responsibilities for compliance with the obligations under the GDPR.
20
 Legal basis for processing sensitive data version of its 2018 guidelines on consent under the GDPR
A significant GDPR challenge for insurance intermediaries (link) providing further clarifications on the fact that consent
is the processing of sensitive and mainly health data. Under obtained through cookie walls and scrolling through a
the GDPR, as a matter of principle, it is prohibited to process webpage are not legally valid.
sensitive data. Exceptions are provided to this general
prohibition in the circumstances exhaustively described in In February 2019 the EDPB Board adopted its two-year
Article 9 §2. work programme for 2019-2020 and announced the future
However, the processing of health data by insurance adoption of additional Guidelines, such as the Guidelines
intermediaries does not readily fall in one of the exceptions on the notion of legitimate interest of the data controller
to the general prohibition of the processing of personal (Update of the Article 29 Working Party –“WP29”- Opinion)
data. It should consequently be verified whether the and the Guidelines on concepts of controller and processor
processing of health data by insurance intermediaries can (Update of the WP29 Opinion). These are key issues for
be covered under one of the derogations. The stakes are BIPAR and its members.
high: if the processing of sensitive data in the course of the
intermediaries’ operations does not fall within the provisions EDPB workshop on data rights under GDPR
of Article 9§2, then the general principle applies and such On 4th November, the EDPB organised a stakeholders’
processing is prohibited. Moreover, the data subject could workshop in Brussels on the topic of Data Subjects Rights.
require the intermediary to erase the sensitive data on The right of access to personal data, the right to rectification
the grounds that they are unlawfully processed. There and right to erasure, the right to restrict processing and right
are today divergences of approaches between Member to object, as introduced by the GDPR and implemented by
States on the legal basis for processing health data in an EU Member States were discussed during the workshop.
insurance context: In some countries, using the legal basis
of Article 9(2)(g), legislation has been introduced allowing BIPAR was represented at this event and conveyed BIPAR’s
the processing of sensitive data without explicit permission observations on the impact of the implementation of these
to underwrite insurance contracts and to manage claims. rights on the insurance distribution sector and its clients:
In some others the legal basis used is Article 9(2)(h) of
the GDPR. In some other countries there are currently no BIPAR participated and intervened during that even along
special exceptions for the processing of sensitive data by the following lines:
the insurance sector. - The insurance distribution sector uses data to
improve the products and services offered to insureds and
EDPB Guidelines to rate risks more accurately.
The GDPR is supplemented by guidance issued by the - Data is used by the sector to prevent financial
European Data Protection Board (EDPB). The EDPB crime and money laundering. Digital identity can help
contributes to the consistent application of data protection address financial crime and safeguard customers.
rules throughout the European Union and promotes - Effective use of data by our sector is enabling a
cooperation between the EU’s data protection authorities. better understanding by business of their risks and the role
The EDPB is composed of representatives of the national data of insurance in mitigating those risks.
protection authorities, and the European Data Protection - There is a challenge in getting individuals to
Supervisor (EDPS). The EDPB has different main tasks, such understand how the insurance and wider financial services
as issuing opinions, guidelines, recommendations and sector uses personal data and getting insureds to read
best practices to promote a common understanding of the even very good privacy policies.
GDPR. - There is a lack of awareness and sometimes
In most cases, misunderstanding of the scope of data subject rights.
Over the last year, the EDPB published different Guidelines - Data Subject Access Requests are regularly used as
such as the ones on the connected vehicles on processing a pre-litigation tool rather than for their intended purpose
personal data in the context of connected vehicles and to protect the rights of individuals.
mobility related applications (link), a slightly updated - There is sometimes a misunderstanding by
21