5

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply?

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service.

The only other one that slightly fits is condition h) in "the provision of health or social care or treatment or the management of health or social care systems"

But its a bit of a stretch. Are they likely to make consent a pre-condition of service anyway, or is there a more appropriate way?

4

How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply?

As far as I see, Article 9 (a) ("explicit consent") would apply. So the insurer would have to ask the customer for consent.

My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service.

Yes, that is often noted, but that is only partially true. The GDPR actually says (Article 7, emphasis mine):

  1. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

So making consent a precondition of service can be ok, provided that the data is "necessary for the performance of that contract". Whether knowing about preexisting conditions is "necessary" for an insurance provider is something a court would have to decide, but on the face it does not seem unreasonable.

Source: General Data Protection Regulation

2

I think your basis would be to rely on a combination of Article 6 (1) b) ... for the performance of a contract to which the data subject is party ... and Article 9 (2) a) the data subject has given explicit consent.

There are some draft notes from the ICO that infer consent may be a precondition if it is necessary for the delivery of a service.

https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf

Caveat... am no legal expert, have just spent a fair bit of time trawling the regulation and the ICO guidance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.