ABI outlines alternatives to enforced subject access requests

The Association of British Insurers (ABI) has published a note (2-page / 208KB PDF) warning insurers about changes to UK law made earlier this year that prohibits the use of enforced SARs.

People have a right, under the UK's Data Protection Act (DPA), to obtain a copy of the personal data organisations hold on them upon filing a request for that information. Those requests are called data subject access requests (SARs) and must generally be complied with, although there are exceptions to that requirement.

However, under section 56 (s.56) of the DPA it is a criminal offence to require a person to make a SAR and reveal the result. That provision was brought into force on 10 March this year.

Earlier this summer the UK's Information Commissioner's Office (ICO) said it had seen an "emerging practice" of insurers "obtaining medical records by using patients’ subject access rights". It warned insurers that it is "inappropriate" and "an abuse" of privacy rights to seek medical information about prospective policy holders by exploiting the SARs regime.

The ABI has now advised insurers against giving customers or prospective customers "the option to complete a SAR" without first taking legal advice to ensure that activity does not breach s.56 of the DPA.

"While there exist limited defences to committing a s.56 offence, such as the request being ‘in the public interest’, the DPA makes it clear that a request is not in the public interest simply because it is for the prevention or detection of crime," the ABI said. It said insurers wishing to "verify the criminal conviction history of a policyholder or potential policyholder" can use Disclosure Scotland's "basic disclosure service" to find the information they are looking for. The Disclosure Scotland service covers disclosures across the UK.

"A basic disclosure certificate either contains information about every unspent conviction of an applicant or states that there are no convictions, although the exact content will differ according to whether the application is processed under legislation pertaining to England and Wales or to Scotland," the ABI said. "Convictions, even for some serious offences, can become spent relatively quickly so the scope of the information returned may be more limited than under the former SAR process."

Insurers are also free to analyse media reports or conduct online searches for information about customers' "undisclosed convictions or criminal activities", it said.

"Whether or not the insurer chooses to make an application for basic disclosure, the advent of s.56 does not alter the position that should undisclosed convictions or criminal activities get discovered through other means – such as news reports or internet-based research – the insurer could seek to use and rely on them in evidence," the ABI said.

"It is important for insurance staff to be properly trained so that they are aware of the consequences of breaching s.56 DPA and the legitimate avenues that remain open for the disclosure of unspent criminal convictions," it said.