Data Protection Bill Insurance Condition

In the second part of MIB's focus on GDPR, the issue of consent regarding data is discussed.

The EU General Data Protection Regulations (GDPR) come into effect on 25 May 2018. Whilst these new Regulations will be effective in the UK, the Government is also introducing the Data Protection Bill to compliment the GDPR. In the meantime, insurers and MIB are grappling with the new rules to ensure that essential services can still be provided and they remain compliant in this important respect.

Legal basis for processing                                

The draft Data Protection Bill has raised challenges relating to the ‘legal basis’ which can be relied upon to process special category (e.g. racial, political, health data etc.) and conviction data. This is because the exemptions within the GDPR, do not naturally allow the insurance industry to continue to process such data.

The problem with consent 

Without an exemption, it was likely that the industry would be required to request ‘explicit consent’ from individuals in order to process such data. However, the new GDPR regime requires consent to be ‘freely given’. This is an issue in relation to compulsory classes of insurance, such as Motor insurance, which does not give individuals a choice but to consent to the processing of their data. Issues also arise for underwriting and claims processes where individuals refuse or withdraw consent.

MIB’s processing

MIB performs roles to compensate victims of uninsured or untraced drivers. We consider claims for vehicle and property damage as well as injury. This requires us to process special category data (such as medical reports) and conviction data.

MIB’s Data Services provide data which enables stakeholders to achieve accurate pricing, provide a better customer experience and to combat fraud. Services such as CUE and MyLicence process special category and conviction data.

Although MIB rely on consent for some processing, it is not practical to rely on explicit consent for certain types of processing, such as for details of the uninsured driver or anti-fraud processing.

Insurance condition                                           

The House of Lords recognised the challenges faced by the industry and has allowed a general insurance condition within the Bill for the processing of special category and conviction data. The condition includes insurance within the “substantial public interest” and removes the need for explicit consent in some instances. It is clear from the amendment to the Bill that insurers can continue to process data to carry out day to day activity including handling claims.

The Data Protection Bill is now back in the House of Commons where further amendments could be made. MIB are reviewing the current wording of the new general insurance condition, as it is in the interests of the insurance industry, government and the public, to ensure that MIB can continue to provide the valuable services it does. 

We are working hard with the ABI and Government departments to try and ensure clarity in the Bill for MIB, but it is a race against time as the new law needs to be in force in a matter of weeks to coincide with the GDPR.