Source: https://www.jdsupra.com/legalnews/digitization-opportunities-and-data-67245/
Timestamp: 2019-07-23 03:47:42
Document Index: 523769114

Matched Legal Cases: ['Art. 4', 'Art. 22', 'Art. 22', 'Art. 22', 'Art. 22', 'Art. 22', 'Art. 4', 'Art. 29']

Digitization - opportunities and data protection challenges arising from automated decisions in the insurance sector | Dentons - JDSupra
Digitization - opportunities and data protection challenges arising from automated decisions in the insurance sector
Even in Germany’s relatively “traditional” consumer market, digital disruptors and new entrants have moved the “established” insurance industry to embrace insurtechs, both as part of new business distribution channels but equally as a way of engaging more generally with their clients. Direct sales in Germany accounted for 15%3 of new business in property and casualty insurance and 7.3%4 in 2018. Direct health and life insurance sales accounted for 2.2% of new business, showing no increase5. German-based consumers increasingly switch to simpler, more user-friendly products, even if that means changing providers. Part of that optimization has meant moving to automated decision-making, artificial intelligence and machine learning as part of the value and client engagement chain.
To ensure compliant contribution to insurance value, including by using automated decisions in a highly regulated industry, all providers must ensure their data is properly collected and evaluated. Collectors and data controllers must act in line with the EU’s General Data Protection Regulation (GDPR)7. When insurers collaborate with insurtechs, the role of the controller as per Art. 4 No. 7 GDPR does not have to be assigned to the insurer from the outset. Rather, this will depend on the concrete design of how the parties document and operationalize their collaboration.
If a data controller, be it an incumbent insurer or an insurtech, uses a machine in a decision making process, the issue arises whether such a decision, including its underlying data flows, actually qualifies as automated individual decision making (AIDM) according to Art. 22 (1) GDPR. The GDPR stipulates that AIDM is only permissible for the purposes of concluding or administering a contract (Art. 22 (2) lit. a) GDPR) and may require the customer’s explicit prior consent in some cases (Art. 22 (4) GDPR).
Automated decision making often involves profiling, but it does not have to. Profiling analyses aspects of an individual’s personality, behavior, interests and habits to make predictions or decisions. Although many people think of marketing as being the most common reason for profiling, this is not the only application. Profiling and automated decision making can be very useful for organizations and benefit individuals in many sectors, including healthcare, education, financial services and marketing. They can lead to quicker and more consistent decisions, particularly in cases where companies must analyze a very large volume of data and decisions very quickly.
If a system evaluates personal data without the involvement of a person, the question becomes when such an evaluation has legal effect. Such legal effect requires that a person’s legal status or legal rights actually change. For example, there is no legal effect when only undoubted legal powers are exercised, e.g. when conducting access control on employees by means of chip cards when they enter a company’s premises. The same applies to the service of documents when instituting court proceedings or judicial default action. Although these decisions are implemented automatically, rights are not changed, nor fundamental rights infringed without justification. Hence, not every automated process is an AIDM from the outset and thereby subject to specific GDPR requirements.Rather, automated processes must achieve the following in order to qualify as AIDM. They must:
evaluate someone’s personality traits beyond a mere “if-then decision”,
This justification derives from Art. 22 (2) lit a) as the AIDM is necessary for entering into (underwriting) or performing the insurance contract (claims handling). However, the insurer or the insurtech, depending on who is the data controller, must implement suitable measures to safeguard the applicant’s rights, freedoms and legitimate interests. The least that the data controller must provide for is the right to obtain human intervention, to express an opposing point of view and to contest the AIDM. In practice, this will require an efficient on-line process to have the AIDM reviewed by a senior underwriter or claims manager in case the insurer rejects cover or the payment of a claim. Thus, in the area of property and liability insurance, the GDPR protects the rights of customers by granting a right to control the AIDM in hindsight.
However, when underwriting risks through tools or deciding on claims based on a certain algorithm, the insurer assesses a customer’s personal circumstances and thereby changes his legal position pursuant to Art. 22(1) GDPR. Thereby, automated underwriting and claims handling decisions also qualify as AIDM and require specific justifications for life and health insurance.
Contrary to non-life policies, AIDM requires the customer’s express and prior consent. Insurers and insurtechs should seek required consents through sophisticated websites to document those through their login files. This documentation will safeguard their position in case of future disputes with customers or regulators. Just like non-life insurance, the data controller must provide for an appropriate process ensuring that a senior underwriter or claims manager checks the AIDM.
According to the GDPR, health data is personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person, such as facial images or dactyloscopic (fingerprint) data (see Art. 4 No. 15 GDPR). This also includes further personal information about a customer, e.g. a number, symbol or particular assigned to uniquely identify him for health purposes9. Fitness apps are an important use case for this definition. The Art. 29 Working Party Group, i.e. the predecessor of today’s European Data Protection Board, was of the view that a distinction should be made between raw data (e.g. number of steps on a treadmill) and analytical data (e.g. the conclusions to be drawn). This position should still be valid, provided the data controller does not use the data to incentivize benefits of the insurance product and the data is sufficiently anonymous to ensure the data controller can only draw conclusions about the user of the app with extreme effort. This effort should be measured by the costs spent on the identification, the time required for such identification and the technology and technological developments available at the time of processing. In contrast, the purely hypothetical possibility of carrying out an analysis of health data should not be sufficient.
For future market players this may mean assessing existing policies and processes, but also developing new documented ones that support and explain the “tech” in AIDM, both to regulators and consumers, while at the same time ensuring such changes do not limit the user-friendliness and the advantages provided by digital distribution. The unstoppable digitalization opens up new opportunities and possibilities for the insurance industry − but platform providers should not underestimate the requirements for legitimate automated decisions and the data processing associated with it.
See Insurance Europe’s Report on European Insurance in Figures 2017 Data here.↩
Life +5.0%, health +4% and P&C +4.4%.↩
Increase from 13.9% to 15.0% - German Insurance Association statistical handbook of the insurance industry 2018 p. 13.↩
Increase from 6.7% to 7.3%, supra↩
Stays constant between 2.2% and 2.3%, supra↩
https://www.lemonade.com/de/schadensabwicklung↩
See Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”), in force since 28.05.2018 here.↩
EuGH C-210/16 dated 5.08.2018 („Facebook“); EuGH C-25/17 dated 10.07.2018 („Zeugen Jehovas“); case decided before GDPR.↩
Recital 35 GDPR.↩