IN SHORT

• Insurers need to assess their risk in light of data privacy reform in Australia and other countries across the Asia Pacific. 
• In particular, the way the data of vulnerable customers is treated may require closer attention. 
• Insurers operating across international borders need to be aware of the nuances of privacy laws in different countries and adopt one standard that meets the strictest provisions.

Australia’s move to reform its Privacy Act more in line with the European Union’s General Data Protection Regulation (GDPR) is expected to see insurers do more heavy lifting around de-identified data and data that is deemed sensitive. 

The 116 flagged changes could see de-identified data captured under the Act and additional safeguards around the data of vulnerable persons put in place. 

Clyde & Co’s privacy and data protection expert Alec Christie says the proposed reforms come down to the view that there is almost no such thing as de-identified data.

“If there’s any way that personal and anonymous data can be linked, then it’s not de-identified data, it’s always personal information,” he says. 

In response to the new laws, Christie says insurers will need to put a “wall” in place between personal data and anonymous data used for actuarial activities, to meet de-identified data and anti-discrimination provisions. Such a wall might take the form of an information barrier, or some physical or digital separation between the de-identified data and identified personal data, and anything that could re-identify the de-identified data. 

Premium

You need to login to access this

Login

What are CIP Points? About ANZIIF Membership