General Data Protection Regulation 2018 (GDPR) (7) – Processing special categories of personal data

We do not want to set any hares running, at this stage, but thought we should keep you updated on one key issue arising from GDPR which is the requirement that processing special categories of personal data (including health) and criminal conviction data may only take place with explicit consent

As identified by the British Insurance Brokers Association (BIBA), “For any form of consent to be valid, it must not be conditional. By its nature any consent to processing to arrange insurance cover will be conditional and so would be invalid.”

Therefore, after lobbying from the insurance industry, the House of Lords has inserted a new condition for processing certain special category personal data (including health data) and criminal conviction data ‘if the processing is necessary for an insurance purpose’.

·          ‘Insurance purpose’ is defined as including advising, arranging, underwriting, administering, administering a claim, exercising a right or complying with an obligation under, an insurance contract.

·          It has been confirmed that ‘insurance’ includes ‘reinsurance’.

·          There are a number of safeguards.

·          The most important is that the processing must be ‘necessary’ for the insurance process.

The Data Protection Bill is working its way through the various stages in Parliament that are required before a Bill becomes an Act. We are therefore unable to be certain that the insurance industry will benefit from the freedom provided by the amendment until the bill is passed in to law by Parliament.

As we understand the situation, the software houses are enabling facilities to record consent should this become necessary.

We will update client firms as things happen.