Personal Data and Life Insurance: Privacy Issues

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Buying life insurance requires you to share sensitive data, and protecting that information has become one of the greatest legal challenges facing Brazil’s insurance industry.

The Flow of Personal Data When You Buy Life Insurance

When people decide to buy life insurance, they rarely imagine how much personal information will be collected, stored, and processed over the entire life of the contract. From the moment the initial application is filled out until a claim is eventually paid, the policyholder’s data travels a long path that involves brokers, insurers, reinsurers, laboratories, hospitals, and, in many cases, outsourced technology companies. We understand that this flow, although necessary to assess risk and set the premium properly, raises serious questions about the limits on how this information is collected and handled.

During underwriting, insurers request identifying data (name, CPF (Brazil’s individual taxpayer ID number), address, marital status), financial data (income, assets, bank transactions), and, above all, health data (medical history, lab tests, preexisting conditions, and habits such as smoking and alcohol use). Brazil’s General Data Protection Law (LGPD) classifies this health data as sensitive personal data, a category that receives heightened legal protection precisely because of its potential for discrimination. We have observed that many insurers still handle this information as casually as they did before the data protection law took effect, which poses a considerable legal risk.

Another point that deserves attention is the practice of sharing data among companies in the same corporate group. It is not unusual for information provided to buy life insurance to end up being used to offer other financial products, such as private pension plans, consórcios (group purchasing pools), or loans. When the policyholder is not clearly told about this secondary purpose, it amounts to misuse of the data for a purpose other than the one originally stated, and it can be challenged in court. Our analysis is that transparency on this point is still lacking in most policies sold on the Brazilian market.

Legal Bases and Limits on Processing Sensitive Data

The LGPD provides that sensitive personal data may be processed only in specific situations, set out in its Article 11. In the insurance context, insurers frequently rely on two legal bases: the data subject’s consent and the need to perform the contract. However, these legal bases are not always applied properly. To be valid, consent must be free, informed, unambiguous, and specific to each purpose of the processing. Standard-form contracts with generic clauses authorizing “data processing for all necessary purposes” will rarely meet these requirements.

The issue becomes even more complex when we consider the role of the Superintendência de Seguros Privados (SUSEP), Brazil’s private insurance regulator, in overseeing the industry. SUSEP requires insurers to keep detailed records of the risks they underwrite, which naturally means holding personal and sensitive data for long periods. Here we see a tension between the regulatory duty to keep information and the necessity principle in the LGPD, which requires that data be processed only for as long as strictly necessary to achieve the purpose for which it was collected. Reconciling these requirements is a challenge the insurance market is still learning to meet.

Algorithmic profiling also deserves mention. Insurers increasingly use algorithms and statistical models to assess risk, calculate premiums, and even decide whether to accept or reject applications. When these automated processes rely on sensitive health data, they can result in indirect discrimination. Under Article 20 of the LGPD, data subjects have the right to request a review of decisions made solely on the basis of automated processing. We believe this right is particularly relevant in the insurance sector, where a denial of coverage can have serious consequences for the policyholder and the family.

Protecting personal data in the insurance market is not merely a legal requirement. It is an essential condition for preserving the trust on which the entire insurance relationship rests.

Consent involving minors and people with intellectual disabilities also calls for extra care. When life insurance is bought for the benefit of minor children or people under curatela (court-supervised guardianship), the processing of their sensitive data must follow the best-interest principle, which appears in the LGPD as well as in the Child and Adolescent Statute and the Statute of Persons with Disabilities. We have found that many insurers have no specific protocols for handling the data of these vulnerable groups.

Data Due Diligence in the Insurance Sector

The concept of data due diligence is becoming increasingly important in the insurance market. It is a systematic process of reviewing and evaluating an organization’s personal data practices in order to identify risks, compliance gaps, and opportunities for improvement. In life insurance, this review must cover the entire chain of processing, from initial collection by the broker through storage in the insurer’s systems and any eventual sharing with reinsurers and service providers.

We have observed that data due diligence in the insurance sector must take into account aspects that do not apply to other industries. One is checking whether the health questionnaires used during underwriting are appropriate. These questionnaires often ask for information that goes beyond what is strictly necessary to assess risk, such as sexual orientation, family history of disease, or use of controlled medications. Excessive data collection not only violates the data minimization principle in the LGPD but also exposes the insurer to significant reputational and regulatory-sanction risks.

Another key aspect of due diligence is reviewing the contracts with third parties that have access to policyholders’ data. Laboratories that perform pre-enrollment exams, telemedicine companies that conduct health interviews, digital platforms that store policyholders’ documents: all of these must be treated as data processors under the LGPD and, as such, must be bound by contract clauses that ensure the information is handled properly. We have found that many of these contracts still lack specific clauses on data protection, purpose limitation, and procedures to follow after a security incident.

Retaining data after an insurance contract ends is another critical point. Some insurers keep former policyholders’ health information indefinitely, arguing that it may be needed in future lawsuits. Although keeping data to defend against legal claims is a legitimate reason for retention, it must be proportionate and limited to the applicable limitation periods. In our assessment, adopting a clear data retention and disposal policy is one of the most urgent steps for the industry.

Security Incidents and Insurer Liability

A leak of personal data in the life insurance sector can have especially serious consequences. Unlike ordinary identifying data, the health information insurers collect can reveal medical conditions that the data subject prefers to keep confidential, such as psychiatric illnesses, cancer diagnoses, or genetic conditions. Exposing this information can cause significant non-economic damages (danos morais), as well as potential professional and social harm to the data subject.

The LGPD requires that the Autoridade Nacional de Proteção de Dados (ANPD), Brazil’s national data protection authority, be notified of security incidents that may create a significant risk or harm to data subjects. When health data is involved, we believe that virtually any incident reaches the level of significance that requires notification. Besides notifying the ANPD, the insurer must inform the affected data subjects clearly and promptly, stating which data was compromised, what measures are being taken, and what steps the data subject can take for self-protection.

Under the LGPD, an insurer’s civil liability for data security incidents is joint and several with that of its processors (third parties that process data on its behalf). This means the insurer answers to the data subject even when the leak occurs in the systems of a contracted service provider. This joint and several liability underscores the importance of due diligence when selecting vendors and of drafting contracts that provide for indemnification rights against them.

The sanctions the ANPD can impose include warnings, fines of up to 2% of the company’s revenue (capped at R$ 50 milhões per violation), and blocking or deletion of data that was processed unlawfully. For insurers that handle large volumes of sensitive data, the financial and reputational impact of an administrative sanction can be devastating. We believe that investing in information security and data governance programs is not merely a legal obligation but a strategic business decision.

Policyholders’ Rights and Protection Mechanisms

Policyholders have a broad set of rights regarding their personal data, and it is essential that they know and exercise those rights. The LGPD gives data subjects the right to access their data, request corrections, ask for the deletion of unnecessary information, withdraw consent, and obtain information about whether their data has been shared with third parties. Our analysis is that, in practice, many insurers still lack effective channels for handling these requests, which is itself a separate violation of the law.

The right to data portability deserves special attention in the insurance context. When policyholders decide to switch from one insurer to another, they have the right to ask that their data be transferred to the new provider in a structured, interoperable format. This portability can significantly simplify the process of buying new coverage by sparing the policyholder from having to go through medical exams and lengthy health questionnaires all over again. We believe that detailed regulation of this right by the ANPD, together with SUSEP, is a pressing need for the industry.

Policyholders who believe their data protection rights have been violated have several remedies available. Besides filing a complaint directly with the ANPD, they can seek compensation for damages through an individual or class action. The Public Prosecutor’s Office (Ministério Público) and consumer protection agencies (Procons) also have standing to investigate and penalize abusive data processing practices. Policyholders should document all their interactions with the insurer concerning the processing of their data, including access requests, correction requests, and any refusals, because this record can be essential if a dispute arises.

Under the LGPD, the insurer must appoint a Data Protection Officer (DPO). This professional serves as the channel of communication among the company, data subjects, and the ANPD, and is responsible for receiving complaints, providing clarifications, and taking action. The DPO’s identity and contact information must be posted clearly and accessibly on the insurer’s website, making it easier for policyholders to exercise their rights.

This topic is directly related to health data and telemedicine, which we cover in a separate article.

This topic is directly related to personal data in court cases, which we cover in a separate article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.