Privacy rules that shape how insurers can use customer data

2. Is it legal to use it for this specific purpose, pricing or underwriting? (insurance law)

A data point can pass test 1 and fail test 2, or vice versa. That is why insurers run separate privacy and underwriting-fairness reviews.

GDPR: the European baseline

GDPR (General Data Protection Regulation, EU law effective 2018) sets the ground rules for any company processing personal data of EU residents, insurers included. Key mechanisms relevant to underwriting:

• Lawful basis requirement. Insurers need a legal justification (consent, contract necessity, or legitimate interest) to process any personal data. For health data, GDPR classifies it as a "special category" requiring explicit consent or a specific legal exemption, not just a general terms-of-service click.
• Article 22: automated decision-making. If a pricing or claims decision is made "solely by automated means" with legal or similarly significant effect, the customer has a right to human review and an explanation. This directly constrains fully automated underwriting algorithms in Europe.
• Data minimization. Insurers can only collect data that is necessary for the stated purpose. Scraping a customer's full social media history to price a health policy would likely fail this test.

Regulators enforcing this include national Data Protection Authorities (DPAs), such as France's CNIL or Germany's BfDI. Fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.Voir la définition complète → 4% of global annual revenue for the most serious violations.

Practical effect: a European insurer wanting to use step-count data from a health app must get explicit, specific consent, explain how the data affects pricing, and let the customer opt out without losing the base product.

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.: US health data, narrower than people think

HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. (Health Insurance Portability and Accountability Act, 1996, US federal law) is often misunderstood. It does not broadly regulate "health data." It regulates Protected Health Information (PHI) held by specific "covered entities": health plans, healthcare providers, and their business associates.

Key implication for insurers:

• A health insurer's claims data (diagnoses, treatments, billing) is PHI and tightly restricted: sharing it for marketing or underwriting purposes outside the health plan itself generally requires authorization.
• But data from a consumer health app (Fitbit, Apple Health, MyFitnessPal) is usually not covered by HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. if the app itself isn't a covered entity. That data sits in a regulatory gray zone, governed instead by the Federal Trade Commission (FTC) under general consumer protection law, and by state privacy statutes.

This is exactly why the step-count example in the hook is interesting: the same data point (steps per day) can be HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.-protected if it flows through a health plan's wellness program, or essentially unregulated at the federal level if it comes from a wearable app the insurer purchased datapurchased dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.Voir la définition complète → access to via a third-party broker.

For a plain-English breakdown, the HHS HIPAA guidance page is the primary source of truth.

US state insurance codes: the underwriting-specific layer

Because the US has no single federal insurance regulator (insurance is regulated state by state under the McCarran-Ferguson Act of 1945), each state's insurance department sets its own rules on what factors insurers can use in underwriting and pricing.

Two mechanisms matter most:

• Unfair discrimination statutes. Most states prohibit rating based on race, and increasingly restrict credit-based insurance scores, genetic information (reinforced federally by GINA, the Genetic Information Nondiscrimination Act of 2008), and in some states, gender.
• NAIC model laws. The National Association of Insurance Commissioners (NAIC) drafts model legislation that states adopt in whole or in part. The 2023 NAIC Model Bulletin on the use of AI specifically requires insurers using algorithms or third-party datathird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.Voir la définition complète → (including alternative dataalternative dataDonnées non-traditionnelles utilisées pour l'analyse d'investissement ou le renseignement concurrentiel : images satellites, transactions bancaires, géolocalisation, scraping web, mentions sociales. like wearables or social media) to be able to explain and justify their models to regulators, and to test for disparate impact on protected classes.
• State-specific bans. Colorado's SB21-169 (effective 2023) is the most concrete example: it requires insurers to test any external data source or algorithm used in underwriting for unfair discrimination based on race, and empowers the state insurance division to require corrective action. California generally restricts credit scoring in auto and property insurance far more than most other states.

Practical effect: a credit score might be a perfectly legal rating factor for auto insurance in Texas, restricted in California, and banned outright in Massachusetts for certain lines. A national insurer needs a state-by-state rules engine, not one national policy.

The practical checks a data team runs

Before any new data source goes live in an underwriting model, a mature insurance data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → function runs a checklist like this:

1. Data lineage and consent audit

Where did this data come from? Was consent captured, and does it cover this specific use case (pricing, not just service delivery)?

2. Purpose-limitation test

Was the data collected for this purpose, or a different one? Using health app data collected for a wellness rewards program to silently adjust life insurance pricing typically fails GDPR's purpose limitation principle and many US state disclosure rules.

3. Disparate impact testing

Even a "neutral" variable (zip code, credit score, app usage patterns) can act as a proxy for race or income. Regulators increasingly require insurers to statistically test rating factors for this. A simplified version of this check:

# Simplified disparate impact ratio check
# Rule of thumb from EEOC's "four-fifths rule", adapted for insurance rate testing

approval_rate_group_a = approved_a / applicants_a   # e.g. majority group
approval_rate_group_b = approved_b / applicants_b   # e.g. protected class

impact_ratio = approval_rate_group_b / approval_rate_group_a

if impact_ratio < 0.80:
    print("Potential disparate impact: flag for fairness review")

This is a starting screen, not a legal conclusion. Real audits use more rigorous statistical models and legal review.

4. Explainability check

Can the underwriting decision be explained to a regulator and to the customer in plain language? Under GDPR Article 22 and NAIC's AI bulletin, "the model said so" is not an acceptable answer.

5. Vendor and third-party data audit

Where data brokers supply credit scores, wearable data, or social data, insurers must audit the vendor's own consent and collection practices. The insurer is generally still liable even if the violation originated upstream.

Key Takeaways

• Two-layer test: any new data source in underwriting must pass both privacy law (GDPR, HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation., state privacy statutes) and insurance-specific unfair discrimination law. Passing one does not mean passing both.
• HIPAA is narrower than assumed: it covers health plans and providers, not most consumer wearable or fitness app data, which instead falls under FTC oversight and state law.
• GDPR gives EU customers a right to explanation for automated underwriting decisions (Article 22), pushing insurers toward explainable models rather than pure black-box AI.
• US insurance regulation is state-by-state: the same variable (credit score, zip code) can be a legal rating factor in one state and banned in another, driven by NAIC model laws and state statutes like Colorado's SB21-169.
• Governance is a process, not a one-time approval: lineage checks, purpose-limitation review, disparate impact testing, explainability review, and vendor audits need to run every time a new data source or model update touches pricing or underwriting.