Insurance companies

What happened

GBA found that the use of personal data obtained from the national data-bank of vehicles by insurance companies for the purpose of creating personalized price offers constitutes violation of Articles 5, 6, 12, 13 and 14 of GDPR. The agency that maintains this data base, the Federal Public Service Mobility and Transportation, was ordered to bring its data processing in compliance with Articles 5 and 6 within 6 months and Articles 12, 13 and 14 within 3 months. GBA has also issued a reprimand for the violation of Articles 12-14. No fines were issued because the predecessor of GBA had reviewed and issued conditions under which this processing could be approved back in 2017 under the previous data protection law.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(b)Read →
• Art. 6Lawfulness of processing6(1)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subjectRead →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 14Information to be provided where personal data have not been obtained from the data subjectRead →

• Data principles
• Transparency
• Unlawful processing