The Data Protection Authority (DPA) has approved a draft act that would prohibit life and health insurers from processing data from policyholders' health trackers. With this act, the legislature wants to prevent insurers from providing discounts to 'healthy' customers, even with policyholders' consent. This is due to concerns that such processing could lead to privacy infringements and unlawful discrimination.
Technology developments have led to an abundance of new devices and tools, such as smart watches and health and lifestyle-related apps that track:
- sports activities;
- nutrition;
- weight loss;
- specific risk factors (eg, diabetes); and
- sleep quality.
Life and health insurers have expressed an interest in processing this data. Outside Belgium, some insurers are proposing discounts or other advantages for policyholders who use health trackers and are willing to share the data with their insurer.(1) In Belgium, such a system already exists with the 'pay as you drive' car insurance scheme. To benefit from the scheme, a driver must consent to the installation of a device in their car which collects information about their driving. If the driver drives carefully, they might benefit from a more favourable insurance premium.
In October 2018 some members of parliament introduced a draft act to restrict the use of data from health trackers in the provision of specific health or life insurance.(2) However, 'restriction' may not be the most accurate word, as the draft act provides for a full ban on using any such data.
The draft act's goal is to avoid "hyper individualisation of the risk and the hyper accountability of the individual". Hence, such personal accountability would change the paradigm of the current health insurance system, which is based on the sharing of health-related risks.
Therefore, according to the draft act, any difference in access to health or life insurance, its pricing or the extent of coverage based on data collected from an individual's health tracker would be unacceptable. The acquisition of such data could result in unlawful discrimination and enhance social inequalities because underprivileged people generally have poorer health and will be reluctant to share such data with their insurer for fear that they will have to pay more.
Prohibition on use of health tracker data
For these reasons, the draft act prohibits life and health insurers from:
- making any segmentation relating to access to insurance, its pricing or the extent of coverage based on:
- a requirement that the insured agree to buy and/or use a health tracker;
- the insured agreeing to share the data from a health tracker; and
- the use of data collected by a health tracker by the insurer; and
- processing data collected by a health tracker which relates to the lifestyle or health of an insured.
The legal basis for this prohibition is Article 9(4) of the EU General Data Protection Regulation, which authorises member states to "maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health". The DPA confirmed this position in its opinion of 17 January 2020.(3)
The DPA stated that Article 9(2)(a) of the GDPR could also serve as a justification for the prohibition. This article permits member states to lift the exemption concerning the processing of sensitive data based on the data subject's explicit consent (ie, a member state can forbid a certain processing operation from taking place even if the data subject agrees to it).
Given the current political paralysis in Belgium, this draft act may not pass any time soon. Nonetheless, it clearly shows some political parties' position towards the use of health data for certain purposes.
Data collected via health trackers or apps cannot be used to provide tailor-made health or life insurance, even with the data subject's consent. An indirect effect could be a reduction in the manufacturers of health trackers or apps sharing such data with interested insurers, as the latter would no longer be allowed to use this data.
Notably, data from health trackers and apps can still be used for any other insurance that does not qualify as life or health insurance. However, in its advice, the DPA appears to acknowledge that all data coming from health trackers and lifestyle-related apps is likely to be considered health data.
Endnotes
(1) For example, in 2015 US-based insurer Discovery Insurance launched a policy that incorporated the sports activities and nutrition habits of its clients. By demonstrating 'good behaviour', clients could obtain discounted risk premiums or receive gifts or vouchers.
(2) Chamber of Parliament, 20 June 2019, draft Act amending the 4 April 2014 Act on Insurance with a View to Establishing a Restriction on the Use of Personal Data from Connected Objects in the Field of Health and Life Insurance, p 6.
(3) DPA, Opinion 02/2020.
