DPA case 07121-1/2020/693 – Order (Slovenia, 2020)

The IP was informed that an individual had filed a claim for compensation for damage caused by a car accident. The insurer now requires the injured party to have a photocopy of the medical record five years ago. You are wondering if the request is justified and in line with existing personal data protection legislation, especially since the insurance company does not explain why it requires that information. It merely states that they will not resolve the case until the required information has been received. According to Article 268(6),(8) and (11) ZZavar-1. The insurer is entitled to obtain relevant medical records (including the entire medical records card) relating to the insured or beneficiary of the insurance, if such documentation is necessary for different insurance purposes. The IP found that the insurance company is entitled to ask for the documentation necessary to decide on the insurance claim. However, the IP, when issuing an opinion, cannot address the question of whether it is necessary and proportionate for an insurer to request information for five years back. The IP also found that the the insurance company is bound by the information obligation of Article 13 GDPR.