How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply?
My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service.
The only other one that slightly fits is condition h) in "the provision of health or social care or treatment or the management of health or social care systems"
But its a bit of a stretch. Are they likely to make consent a pre-condition of service anyway, or is there a more appropriate way?