LähiTapiola Keskinäinen Henkivakuutusyhtiö – Court Ruling (Finland, 2024)

The controller (LähiTapiola Keskinäinen Henkivakuutusyhtiö, a life insurance company) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the health data of life insurance applicants and it processed the data unnecessarily. The controller filed the appeal claiming that it must be able to process health data, because the health status of the insured party and the risks associated with it are at the centre of the risk assessment related to the granting of the insurance. The controller considered that insurance applicants must also be considered insured parties in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Data Protection Act], according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to determine the liability of the insurance institution. The controller also stated that the order issued by the DPA, on the basis of which it should assess the time period for which it is necessary to request health data, is vague and unspecified. The controller considered that it must be able to process all health data in order to assess which precise information is ultimately relevant. The Court noted that neither the Finnish Data Protection Act nor its preparatory material have defined what is meant by the insured party in connection with the application of the Act. However, in the Court's view, the preparatory material of the Act does not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant an insurance before the conclusion of an insurance contract. In this respect, the Court also stated that the "insured party" is defined in [https://www.finlex.fi/fi/laki/ajantasa/1994/19940543#L1P2 Section 2(1)(5) of the Finni