Privacy rules that shape how insurers can use customer data

# Privacy rules that shape how insurers can use customer data

A life insurer's underwriting team wants to use an applicant's Fitbit step count to price a policy. A health insurer wants to buy credit scores to predict claims risk. Both moves are legal in some jurisdictions, restricted in others, and outright banned in a few. The difference is not the data itself. It is the regulatory wrapper around it, and getting that wrapper wrong can mean fines, voided contracts, or regulatory bans on a whole underwriting model.

This lesson walks through the three regulatory layers that govern insurance data use (GDPR, HIPAA, and US state insurance codes), then gives you the practical checks a data or compliance team runs before a new data source goes into production.

Why insurance is a special case for data regulation

Insurance runs on discrimination, in the statistical sense: charging different people different prices based on risk. That is the business model. But laws in most developed markets say insurers cannot discriminate on certain axes (race, in most cases genetics, sometimes health status) even if that data would improve pricing accuracy.

So every new data source an insurer wants to use (wearables, credit data, social media, geolocation) has to pass two tests:

1. Is it legal to collect and use this data at all? (privacy law)

2. Is it legal to use it for this specific purpose, pricing or underwriting? (insurance law)

A data point can pass test 1 and fail test 2, or vice versa. That is why insurers run separate privacy and underwriting-fairness reviews.

GDPR: the European baseline

GDPR (General Data Protection Regulation, EU law effective 2018) sets the ground rules for any company processing personal data of EU residents, insurers included. Key mechanisms relevant to underwriting:

• Lawful basis requirement. Insurers need a legal justification (consent, contract necessity, or legitimate interest) to process any personal data. For health data, GDPR classifies it as a "special category" requiring explicit consent or a specific legal exemption, not just a general terms-of-service click.
• Article 22: automated decision-making. If a pricing or claims decision is made "solely by automated means" with legal or similarly significant effect, the customer has a right to human review and an explanation. This directly constrains fully automated underwriting algorithms in Europe.
• Data minimization. Insurers can only collect data that is necessary for the stated purpose. Scraping a customer's full social media history to price a health policy would likely fail this test.

Regulators enforcing this include national Data Protection Authorities (DPAs), such as France's CNIL or Germany's BfDI. Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → 4% of global annual revenue for the most serious violations.

Practical effect: a European insurer wanting to use step-count data from a health app must get explicit, specific consent, explain how the data affects pricing, and let the customer opt out without losing the base product.

HIPAA: US health data, narrower than people think

HIPAA (Health Insurance Portability and Accountability Act, 1996, US federal law) is often misunderstood. It does not broadly regulate "health data." It regulates Protected Health Information (PHI) held by specific "covered entities": health plans, healthcare providers, and their business associates.

Key implication for insurers:

• A health insurer's claims data (diagnoses, treatments, billing) is PHI and tightly restricted: sharing it for marketing or underwriting purposes outside the health plan itself generally requires authorization.
• But data from a consumer health app (Fitbit, Apple Health, MyFitnessPal) is usually not covered by HIPAA if the app itself isn't a covered entity. That data sits in a regulatory gray zone, governed instead by the Federal Trade Commission (FTC) under general consumer protection law, and by state privacy statutes.

This is exactly why the step-count example in the hook is interesting: the same data point (steps per day) can be HIPAA-protected if it flows through a health plan's wellness program, or essentially unregulated at the federal level if it comes from a wearable app the insurer purchased datapurchased dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.View full definition → access to via a third-party broker.

For a plain-English breakdown, the HHS HIPAA guidance page is the primary source of truth.

US state insurance codes: the underwriting-specific layer

Because the US has no single federal insurance regulator (insurance is regulated state by state under the McCarran-Ferguson Act of 1945), each state's insurance department sets its own rules on what factors insurers can use in underwriting and pricing.

Two mechanisms matter most:

• Unfair discrimination statutes. Most states prohibit rating based on race, and increasingly restrict credit-based insurance scores, genetic information (reinforced federally by GINA, the Genetic Information Nondiscrimination Act of 2008), and in some states, gender.
• NAIC model laws. The National Association of Insurance Commissioners (NAIC) drafts model legislation that states adopt in whole or in part. The 2023 NAIC Model Bulletin on the use of AI specifically requires insurers using algorithms or third-party datathird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.View full definition → (including alternative data like wearables or social media) to be able to explain and justify their models to regulators, and to test for disparate impact on protected classes.
• State-specific bans. Colorado's SB21-169 (effective 2023) is the most concrete example: it requires insurers to test any external data source or algorithm used in underwriting for unfair discrimination based on race, and empowers the state insurance division to require corrective action. California generally restricts credit scoring in auto and property insurance far more than most other states.

Practical effect: a credit score might be a perfectly legal rating factor for auto insurance in Texas, restricted in California, and banned outright in Massachusetts for certain lines. A national insurer needs a state-by-state rules engine, not one national policy.

The practical checks a data team runs

Before any new data source goes live in an underwriting model, a mature insurance data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → function runs a checklist like this:

1. Data lineage and consent audit

Where did this data come from? Was consent captured, and does it cover this specific use case (pricing, not just service delivery)?

2. Purpose-limitation test

Was the data collected for this purpose, or a different one? Using health app data collected for a wellness rewards program to silently adjust life insurance pricing typically fails GDPR's purpose limitation principle and many US state disclosure rules.

3. Disparate impact testing

Even a "neutral" variable (zip code, credit score, app usage patterns) can act as a proxy for race or income. Regulators increasingly require insurers to statistically test rating factors for this. A simplified version of this check:

# Simplified disparate impact ratio check
# Rule of thumb from EEOC's "four-fifths rule", adapted for insurance rate testing

approval_rate_group_a = approved_a / applicants_a   # e.g. majority group
approval_rate_group_b = approved_b / applicants_b   # e.g. protected class

impact_ratio = approval_rate_group_b / approval_rate_group_a

if impact_ratio < 0.80:
    print("Potential disparate impact: flag for fairness review")