Legal Update Insurance Privacy & Security Hong Kong 19 December 2012 Complying with the Personal Data (Privacy) Ordinance (Cap. 486) in the insurance industry Abstract Last month, the Privacy Commissioner for Personal Data (PCPD) issued a Guidance Note on the Proper Handling of Customers Personal Data for the Insurance Industry ( Guidance Note ). The Guidance Note is intended to assist insurers and insurance intermediaries in complying with the requirements under the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) by providing practical guidelines and tips. Content During the course of their operations, insurers and insurance intermediaries will collect and use customers personal data for a range of reasons. Customers personal data may be used for arranging and issuing insurance policies, assessing insurance claims and marketing products, among other things. As with all data users, insurance institutions must comply with the requirements under the PDPO including the six Data Protection Principles (DPPs) set out in Schedule 1 to the PDPO. The Guidance Note is a practical guide on how to comply with the requirements of the PDPO, with particular focus on situations specific to the insurance industry. DPPs The Guidance Note first sets out an overview of the six DPPs and provides practical applications: DPP1 - Purpose and manner of collection of personal data: Personal data should only be collected for a lawful purpose related to a function or activity of the data user and if necessary for or directly related to that purpose. Only an adequate (and not an excessive) amount of data may be collected. The means of collection must be lawful and fair. The data user must inform the data subject before or at the time of collecting their personal data the purposes for its collection and the classes of persons to whom their data may be transferred (among other things). Application: Insurers should provide customers with a Personal Information Collection Statement (PICS) stating, among other things, the purposes for the collection of personal data, the classes of persons to whom the data may be transferred and the customer s rights to access and correct the data. DPP2 - Accuracy and duration of retention of personal data: Data users are required to take all reasonably practicable steps to ensure accuracy of personal data and to erase personal data that is no longer required for the purposes for which it is to be used. Further, data users must adopt contractual or other means to prevent any personal data transferred to a data processor (e.g., an IT service provider appointed by an insurer to process and collate customer data on its behalf) from being kept longer than is necessary. Application: Before sending documents to a customer, an insurer should ensure that the customer s address is accurate and up-todate. An insurer should also formulate policies and practices to specify the period of retention
of customers personal data. An insurer who appoints a data processor is required to enter into a suitable service agreement to specify, among other things, the obligations of the service provider (including the obligations to use the data for the designated purposes only, and to return or destroy the data upon termination of the service agreement), and the rights (including the right to conduct an audit) and remedies of the insurer against the service provider. DPP3 - Use of personal data: Unless prescribed consent has been obtained from the data subject, personal data should not be used (including disclosed or transferred) for a new purpose (i.e., any purpose other than the purpose for which the data was to be used at the time of collection of the data, or a directly related purpose). Application: An insurer should obtain the express consent voluntarily given by customers before using their personal data for a purpose other than the purposes set out in the PICS or purposes within the reasonable contemplation of the customers at the time that their data was collected (e.g., sale of their data by the insurer to another person in return for money). DPP4 - Security of personal data: Data users must take all reasonably practicable steps to ensure personal data held by them is protected against unauthorised or accidental access, processing, erasure or other use. Data users must also adopt contractual or other means to prevent unauthorised or accidental access, processing, erasure, loss or use of data transferred to a data processor for processing. Application: There should be adequate security and controls over documents and computer systems containing customers personal data. An insurer who appoints a data processor is required to enter into a service agreement with suitable provisions to require the data processor to safeguard the security of data transferred by the insurer. DPP5 - Information to be generally available: Data users must take all reasonably practicable steps to ensure openness and transparency about their policies and practices in relation to personal data, including the kinds of personal data they hold and the main purposes for which the data is used. Application: An insurer should formulate and make available to customers its Privacy Policy Statement upon request, or display it on its website or at the business premises accessible to the customers. DPP6 - Access to and correction of personal data: Data subjects have the right to access their data held by a data user and to rectify incorrect data. Application: Customers can seek access to their personal data, such as insurance application forms, medical reports, risk assessment questionnaires or claim forms. In a normal case, the insurance institution should provide a copy of the data to any customer making a valid data access request within 40 days of receiving the request. Use of personal data in direct marketing The Guidance Note also refers to section 34 of the PDPO which provides that when a data user uses personal data for direct marketing purposes for the first time, it must inform the data subject of their right to opt out of such use by the data user. If the data subject opts out, the data user must cease to so use the data in direct marketing. Application: During marketing calls, customers should be informed of their opt-out rights. Insurers and insurance intermediaries should ensure that the names of customers who have opted out are removed from their direct marketing call lists. The Personal Data (Privacy) (Amendment) Ordinance prescribes heightened requirements on use of personal data in direct marketing. These requirements will come in force, tentatively, on 1 April 2013. The PCPD is presently drafting a guidance note on how the heightened requirements will be implemented in practice. In the meantime, please refer to our previous legal update entitled Personal Data (Privacy) (Amendment) 2012. 2 Mayer Brown JSM Complying with the Personal Data (Privacy) Ordinance (Cap. 486) in the insurance industry
Practical tips The Guidance Note also provides practical tips to assist insurance practitioners to deal with specific situations. The Guidance Note draws references from decisions made by the Administrative Appeals Board and determinations of the PCPD on complaint cases. These practical tips include: A written PICS containing the prescribed information should be provided where practicable. This may be done by attaching the PICS to the application form soliciting personal data or giving the PICS to an individual before collecting his/her data. When collecting customers medical data, insurers should only collect that which is necessary and should not collect an excessive amount of data. Insurers and insurance intermediaries should not collect Hong Kong Identity Card (HKIC) numbers or copies of HKICs unless authorised by law or specifically permitted by the Code on Personal Identifiers issued by the PCPD. An example of the latter is the collection of the HKIC number to enable the correct identification of an individual for the advancement of their interests (e.g., to ensure that a payout from an insurance claim is made to the right person). Copies of HKICs may be collected by an insurer in compliance with the customer due diligence requirements under the Anti-Money Laundering and Counter-Terrorist Financing (Financial Institutions) Ordinance (Cap. 615). In employing the services of private investigators to investigate suspicious claims, an insurer should take measures, including putting in place both contractual control and practical safeguards, to ensure that the private investigators collect only adequate (and not excessive) amounts of personal data and by lawful and fair means. Insurers and insurance intermediaries should ensure that use of personal data in direct marketing is within the original purpose of use of the data or within the reasonable contemplation of the customer at the time of data collection. If that is not the case, prescribed consent of the customers must be obtained before using their data in direct marketing. When using personal data extracted from publicly available sources (e.g., public directories), insurance institutions should ensure that direct marketing is within the permitted use. Insurance institutions should also be aware of the heightened requirements in relation to direct marketing scheduled to come in force, tentatively, on 1 April 2013. Insurance institutions should devise and implement clear privacy policies and practices in relation to the retention of customers personal data. Generally speaking, an insurance institution may retain personal data of a customer for not more than seven years after the termination of the business relationship between the insurance institution and the customer. When using real cases for internal training, personal data of the customers should be redacted in order not to reveal the identity of the customers. Where possible, fictional persons and made-up scenarios should be used. Insurance institutions should take reasonably practicable measures to ensure that staff and agents including insurance agents having access to customers personal data are trained to handle personal data in compliance with internal policies and procedures and the applicable requirements under the PDPO. If third parties such as IT contractors and waste disposal contractors are entrusted to handle or destroy customers personal data, insurance institutions should ensure safe handling and erasure by adopting contractual or other means. For example, they should ensure personal data is not released to the contractor unless absolutely necessary, and have contractual provisions prohibiting the contractor to use or disclose customers personal data for any purpose not specified in the service contract. An insurance institution remains liable under the PDPO for the acts and practices of its staff and agents. In proceedings brought under the PDPO against an employer in respect of its 3 Mayer Brown JSM Complying with the Personal Data (Privacy) Ordinance (Cap. 486) in the insurance industry
employee s act or practice, it shall be a defence for the employer to prove that it took reasonably practicable steps to prevent the employee from committing the offending act or practice. Insurance institutions should take appropriate measures to protect customers personal data against unauthorised or accidental access, processing or erasure. These include allowing only authorised staff or insurance agents or representatives to access customers personal data on a need-to-know basis. Given insurance agents and representatives often take documents or policies containing customers personal data away from the office for working at home or other places, insurance institutions should provide clear policies and guidelines on handling customers personal data outside the workplace. In handling data access requests, an insurer may not refuse to comply with a customer s data access request of their personal data on the ground that the document containing the data contains another individual s personal data. The insurer may redact the other individual s personal data so as to conceal their identity before supplying a copy of the document to the customer. No excessive fee should be charged for complying with a data access request. In complying with the PDPO, there are issues specific to the insurance industry, such as the collecting and retention of data to assess insurance claims and for subsequent renewals, and using customers personal data collected for insurance purpose for direct marketing. The Guidance Note sets out a useful and practical guide to assist insurers and insurance intermediaries in complying with the requirements under the PDPO, and in dealing with situations specific to the insurance industry. 4 Mayer Brown JSM Complying with the Personal Data (Privacy) Ordinance (Cap. 486) in the insurance industry
Contact Us For inquiries related to this Legal Update, please contact the following persons or your usual contacts with our firm. Tow Lu Lim Partner T: +852 2843 4490 E: tl.lim@mayerbrownjsm.com Sara Or Partner T: +852 2843 2268 E: sara.or@mayerbrownjsm.com Jenny Yu Registered Foreign Lawyer T: +852 2843 4445 E: jenny.yu@mayerbrownjsm.com Mayer Brown JSM is part of Mayer Brown, a global legal services organisation advising clients across the Americas, Asia and Europe. Our presence in the world s leading markets enables us to offer clients access to local market knowledge combined with global reach. We are noted for our commitment to client service and our ability to assist clients with their most complex and demanding legal and business challenges worldwide. We serve many of the world s largest companies, including a significant proportion of the Fortune 100, FTSE 100, DAX and Hang Seng Index companies and more than half of the world s largest banks. We provide legal services in areas such as banking and finance; corporate and securities; litigation and dispute resolution; antitrust and competition; employment and benefits; environmental; financial services regulatory & enforcement; government and global trade; intellectual property; real estate; tax; restructuring, bankruptcy and insolvency; and wealth management. OFFICE LOCATIONS AMERICAS: Charlotte, Chicago, Houston, Los Angeles, New York, Palo Alto, Washington DC ASIA: Bangkok, Beijing, Guangzhou, Hanoi, Ho Chi Minh City, Hong Kong, Shanghai, Singapore EUROPE: Brussels, Düsseldorf, Frankfurt, London, Paris TAUIL& CHEQUER ADVOGADOS in association with Mayer Brown LLP: São Paulo, Rio de Janeiro ALLIANCE LAW FIRM: Spain (Ramón y Cajal Abogados) Please visit www.mayerbrownjsm.com for comprehensive contact information for all Mayer Brown offices. This publication provides information and comments on legal issues and developments of interest to our clients and friends. The foregoing is intended to provide a general guide to the subject matter and is not intended to provide legal advice or be a substitute for specific advice concerning individual situations. Readers should seek legal advice before taking any action with respect to the matters discussed herein. Please also read the Mayer Brown JSM legal publications Disclaimer. Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the Mayer Brown Practices ). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. Mayer Brown and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions. 2012. The Mayer Brown Practices. All rights reserved. 1212