Data Protection Bill [HL] — House of Lords, 2017-11-13
Topic: Domestic Commerce
Charles Hay (Crossbench, Unknown): My Lords, I will speak also to Amendments 46A, 47A, 48A and 50A. We move to a series of probing amendments relating to insurance. I am concerned about many practical things in the Bill, and what I see as unnecessary and unwise obstacles for insurance in general, and for motor insurance and employer liability insurance in particular. I declare my interests as set out in the register of the House and, in particular, those in respect of the insurance industry I thank the noble Lord, Lord Clement-Jones, for his support for these amendments—indeed, he was emailing me late last night—and I thank the Minister for a generous slice of his time last week. I also thank the Association of British Insurers and the Lloyds Market Association for their help in preparing my remarks. They, in turn, have had input from the four other major insurance market associations and other bodies The insurance industry delivers products in the public interest. Indeed, some of the major classes, such as motor insurance and employer liability insurance, are compulsory. It is greatly to society’s benefit that there is a wide choice of good products available at a reasonable price. It is less well understood in the wider world what an important part reinsurance plays in supporting insurers by protecting insurance companies from large unexpected losses and providing temporary extra capital when it is needed. In other words, insurers, too, need a wide choice of good products available at a reasonable price. It is a complex ecosystem, and unintended consequences tend almost invariably to hurt the man in the street The impact assessment called for the setting of new standards in accordance with the GDPR, "whilst preserving the existing tailored exemptions from the Data Protection Act" Later on in the same page of the impact assessment there is a call for, "exercising the derogations in the best interest of the UK" In fact, the impact assessment has several references to business and insurance business which make it plain that the Government do not intend to place an undue extra burden on business. I am grateful to the Government and the Bill team for having gone some way to alleviating the problems—but I fear that we need to go a lot further Sensitive personal data under the current Data Protection Act 1998 has become special category personal data in the GDPR. The treatment of special category personal data looks similar under the GDPR and the DPA, with consent as the applicable legal ground under which data can be processed in most cases. However, what has changed is the definition of consent, with the threshold for valid consent under GDPR now being much higher For insurers and reinsurers, the two most common types of special category personal data are information relating to health and information relating to criminal convictions. Being able to consider health and criminal conviction data is hugely important for insurers uniformly and throughout the world. The ABI estimates that the ability to process these types of data helped in detecting around £1.3 billion in fraudulent claims in 2015 alone, and I fear that the Bill unamended would therefore potentially increase costs for millions of motor insurance policyholders. To get an idea of the size of the market where health data is required for underwriting and claims purposes, the LMA has advised me that it identifies annual Lloyd’s market premiums alone of at least £2.3 billion a year Processing special-category data, including health data, is fundamental to calculating levels of risk and underwriting the majority of retail insurance products. ICO draft guidance infer that consent as a precondition of accessing a service, as would be the case for a proposal for an insurance contract, would not be a legitimate basis for processing special-category personal data. Let us take the example of a daily smoker who at retirement age tries to buy an annuity. They would be asked to provide their medical details. This health data would establish that the individual has a below-average life expectancy. The insurer is therefore able to offer an enhanced annuity that pays the individual a higher percentage of income every year Under the Bill and its associated draft ICO guidance, insurers would not be able to access the individual’s medical records as consent is a precondition of accessing the enhanced annuity market and therefore such consent cannot be freely given. Insurers would be unable to offer an enhanced annuity and the individual would be treated as a consumer with average life expectancy and receive a lower income from their annuity. This would be a highly undesirable state of affairs Take the situation where an insurer has a direct relationship with the insured—a personal motor policy, let us assume. It would seem relatively easy for them to obtain a consent for all processing. However, it is not. More than half the motor insurers in the UK make use of the Motor Insurance Bureau’s MyLicence anti-fraud facility. This third-party service, available to all insurers, allows them at the quote stage to understand a driver’s record using DVLA data. Express consent is not possible and nor, for the same ICO reasoning as my annuity example, would any consent anyway be valid. If the Bill is unamended, this would be bound to drive up premiums for motor insurers, as a principal defence against fraud would cease to exist.