[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	Irish Data Protection Commission Case Studies
You are here: BAILII >> Databases >> Irish Data Protection Commission Case Studies >> F - Complaint about information on central registry [2006] IEDPC 13 URL: http://www.bailii.org/ie/cases/IEDPC/2006/13.html Cite as: [2006] IEDPC 13

[New search] [Contents list] [Printable RTF version] [Help]

F - Complaint about information on central registry [2006] IEDPC 13 (31 December 2006)

My Office received a complaint from an individual regarding the refusal F to delete information from its central registry. The individual concerned had requested that F remove the details relating to her from the F central registry as she believed the information to be incorrect. Under Section 6 of the Data Protection Acts, 1988 and 2003, an individual can request a data controller, who keeps personal data relating to him/her, to have that data corrected or deleted if the information held is inaccurate.

My Office contacted the F. We established that, if an applicant for life assurance is declined or is offered insurance on special terms, then this fact will be noted on the central registry administered by the F. The entry in the Registry comprises the first three letters of the applicant's surname, the first five letters of the first name, the date of birth, together with the date and codes for the relevant insurer and the type of policy. The Registry does not contain medical information. (If an applicant is given life assurance without any special conditions he/she would not be entered in the Registry). If an individual applies again for some form of cover, the insurance company to which the individual applies may seek a copy of any medical evidence obtained from the insurer to which the individual had previously applied in order to ensure that it is consistent with the new application.

F informed my Office that the information on its central registry in relation to the data subject concerned was correct as a life assurance company had refused her a life assurance policy and the entry on the central registry reflected that fact. In addition, evidence was submitted to my Office to show that the data subject was made aware by the life assurance company at the time of her application for a policy that, in the event that she was declined life assurance or offered it with an increased premium, this information would be shared with the F central registry and with other insurance companies as a safeguard against nondisclosure or fraudulent claims. While I might have wished that this information would be more prominently positioned, it was nevertheless provided to the data subject.

Following an investigation of the issues involved in this case, my Office contacted the complainant and explained that the information contained on the F central registry was factually correct and that she was not entitled to have the information deleted under Section 6 of the Data Protection Acts, 1988 and 2003.

I am grateful to the complainant for bringing this matter to my attention. In investigating her complaint, my Office became aware of the practice of the sharing of medical reports amongst life assurance companies in cases where cover was declined or offered on special terms. While I can see that this practice serves life assurance companies well as a safeguard against non-disclosure or fraudulent claims, I have to consider it in terms of the disclosure of sensitive personal data in the form of medical reports.

From a data protection perspective, there is a strong argument that the disclosure of medical records should be undertaken only with explicit consent and the applicant for insurance should have a right to withhold their consent but (one would assume) on the basis that it may mean a subsequent application to another company not progressing.