Data Protection Bill [HL]

Earl of Kinnoull Excerpts

Committee: 3rd sitting (Hansard): House of Lords
Monday 13th November 2017 Lords Chamber

Moved by

[The Earl of Kinnoull]

45B: Schedule 1, page 116, line 35, leave out paragraphs 14 and 15 and insert—
“(1) This condition is met if the processing—(a) is necessary for the purposes listed in sub-paragraph (2), and(b) is necessary for reasons of substantial public interest.(2) The purposes mentioned in sub-paragraph (1)(a) are—(a) the arrangement, underwriting, performance or administration (or assisting in the arrangement, underwriting, performance or administration) of a contract of insurance or reinsurance;(b) the handling or administration (or assisting in the handling or administration) of a claim made under a contract of insurance or reinsurance.”

[The Earl of Kinnoull (CB)]

My Lords, I will speak also to Amendments 46A, 47A, 48A and 50A. We move to a series of probing amendments relating to insurance. I am concerned about many practical things in the Bill, and what I see as unnecessary and unwise obstacles for insurance in general, and for motor insurance and employer liability insurance in particular. I declare my interests as set out in the register of the House and, in particular, those in respect of the insurance industry.

I thank the noble Lord, Lord Clement-Jones, for his support for these amendments—indeed, he was emailing me late last night—and I thank the Minister for a generous slice of his time last week. I also thank the Association of British Insurers and the Lloyds Market Association for their help in preparing my remarks. They, in turn, have had input from the four other major insurance market associations and other bodies.

The insurance industry delivers products in the public interest. Indeed, some of the major classes, such as motor insurance and employer liability insurance, are compulsory. It is greatly to society’s benefit that there is a wide choice of good products available at a reasonable price. It is less well understood in the wider world what an important part reinsurance plays in supporting insurers by protecting insurance companies from large unexpected losses and providing temporary extra capital when it is needed. In other words, insurers, too, need a wide choice of good products available at a reasonable price. It is a complex ecosystem, and unintended consequences tend almost invariably to hurt the man in the street.

The impact assessment called for the setting of new standards in accordance with the GDPR,

“whilst preserving the existing tailored exemptions from the Data Protection Act”.

Later on in the same page of the impact assessment there is a call for,

“exercising the derogations in the best interest of the UK”.

In fact, the impact assessment has several references to business and insurance business which make it plain that the Government do not intend to place an undue extra burden on business. I am grateful to the Government and the Bill team for having gone some way to alleviating the problems—but I fear that we need to go a lot further.

Sensitive personal data under the current Data Protection Act 1998 has become special category personal data in the GDPR. The treatment of special category personal data looks similar under the GDPR and the DPA, with consent as the applicable legal ground under which data can be processed in most cases. However, what has changed is the definition of consent, with the threshold for valid consent under GDPR now being much higher.

For insurers and reinsurers, the two most common types of special category personal data are information relating to health and information relating to criminal convictions. Being able to consider health and criminal conviction data is hugely important for insurers uniformly and throughout the world. The ABI estimates that the ability to process these types of data helped in detecting around £1.3 billion in fraudulent claims in 2015 alone, and I fear that the Bill unamended would therefore potentially increase costs for millions of motor insurance policyholders. To get an idea of the size of the market where health data is required for underwriting and claims purposes, the LMA has advised me that it identifies annual Lloyd’s market premiums alone of at least £2.3 billion a year.

Processing special-category data, including health data, is fundamental to calculating levels of risk and underwriting the majority of retail insurance products. ICO draft guidance infer that consent as a precondition of accessing a service, as would be the case for a proposal for an insurance contract, would not be a legitimate basis for processing special-category personal data.

Let us take the example of a daily smoker who at retirement age tries to buy an annuity. They would be asked to provide their medical details. This health data would establish that the individual has a below-average life expectancy. The insurer is therefore able to offer an enhanced annuity that pays the individual a higher percentage of income every year.

Under the Bill and its associated draft ICO guidance, insurers would not be able to access the individual’s medical records as consent is a precondition of accessing the enhanced annuity market and therefore such consent cannot be freely given. Insurers would be unable to offer an enhanced annuity and the individual would be treated as a consumer with average life expectancy and receive a lower income from their annuity. This would be a highly undesirable state of affairs.

Take the situation where an insurer has a direct relationship with the insured—a personal motor policy, let us assume. It would seem relatively easy for them to obtain a consent for all processing. However, it is not. More than half the motor insurers in the UK make use of the Motor Insurance Bureau’s MyLicence anti-fraud facility. This third-party service, available to all insurers, allows them at the quote stage to understand a driver’s record using DVLA data. Express consent is not possible and nor, for the same ICO reasoning as my annuity example, would any consent anyway be valid. If the Bill is unamended, this would be bound to drive up premiums for motor insurers, as a principal defence against fraud would cease to exist.

--- Later in debate ---

[Lord Ashton of Hyde]

Of course, it is not for us to tell the Information Commissioner what guidance to issue. The guidance that has been issued is not in all respects completely helpful to the insurance industry.

[The Earl of Kinnoull]

Following up the noble Lord’s point, I would like to say a couple of things. First, I sort of understand where the Information Commissioner’s Office is coming from. I have article 7 in my hands, which contains the definition of consent from the GDPR, and article 9(2)(a). My concern is that even if the Government are very nice to an Information Commissioner and persuade them to change the guidance, it could change at any time. It is important to ensure that the Bill will work for the ordinary man in the street. As for compulsory classes, it is not about looking after the insurers but every small business in Britain and every small person who wants to get motor insurance, especially those who have problems with either criminal convictions or their health.

[Lord Ashton of Hyde]

I agree; I think I mentioned compulsory classes before. Going back to the guidance, we are having discussions. We have already had constructive discussions with the noble Earl, and we will have more discussions on this subject with the insurance industry, in which he has indicated that he would like to take part. I am grateful to him for coming to see me last week.

--- Later in debate ---

[Lord Ashton of Hyde]

I agree, which is why I mentioned the guidance that the Information Commissioner has already given. I am certainly willing to talk to her but it is not our place to order her into the room. However, we are constantly talking to her, and there is absolutely no reason why we would not do so on this important matter.

[The Earl of Kinnoull]

I thank all noble Lords who have taken part in this short but interesting debate. Of course, the Information Commissioner reports to Parliament, so if we held a meeting here, we probably could ask her, quite properly, to come. That might be quite helpful in this complex area. As I said, when you mess around in these areas, the person who suffers is the man in the street, not the insurance companies. The noble Lord, Lord Stevenson of Balmacara, in particular made a number of interesting points in speaking to his amendment, which need to go into the mix as regards how we sort through this difficult area.

I am very grateful to the Minister for confirming that we will continue discussions in this area. I do not think for a moment that I necessarily have all the right answers, but we have started on the journey and will continue. We will certainly be talking about the same issues again in different formats on Report and I look forward to that very much. On that basis, I beg leave to withdraw the amendment.

Amendment 45B withdrawn.