Article Preview
TopThe Need For Gdpr In The Insurance Sector
GDPR has been discussed widely in recent bibliography through different approaches due to the nature of its content. Some reports have focused only on ethic, others on legal or technical points of view without presenting the effect of combining all sides into the real business world. The combined view is of considerable importance for the insurance sector, as it needs to address all these challenges. Insurance seems to be the most exposed sector in dealing with personal and sensitive data (European Commission, 2012), not just for its existing customers but also for the data of potential customers.
The new regulation establishes a set of rules regarding individual rights such as those for insurers, employees and customers, by defining the responsibilities and obligations for the data controllers, as well as the shared responsibility of the data processors (either internal or external) who have been chosen to do data processing on behalf of the controllers.
The insurance sector is especially exposed to the risks described by GDPR, since all insurance companies collect, maintain and store both private and special category data (previously known as sensitive data) not only for serving their customers, but also the potential gain this data can return to the company. For example, it is a common practice for insurance companies and their business partners to exchange personal data for their customers, even as regularly as on a daily basis. For example, an insurer may exchange data with hospitals, car garages, claims management companies, fraud detection services, sales networks such as agencies and brokers, external contact centers for road assistance or legal protection, e-shops for marketing activities etc. From now on, for all such partnerships, the partners’ GDPR “maturity level” will be a deciding factor for continuing with the partnership. In case the partner is not evaluated as mature, the insurance company is expected to terminate the collaboration and look for new partnerships that meet the requirements. Such scenarios are reliable indicators that GDPR certification is expected to be established very soon.
The regulation strengthens privacy protection by adding extra categories such as genetic data, biometric data, sexual orientation, political opinions, religious, geolocation data, IP addresses, social media URLs etc.; these are classified as personal or special data categories (previously known as “sensitive”) (Wikipedia, 2018a).