DPA case 7285/183/18 – Complaint Upheld (Finland, 2022)

An insurance company (the controller) asked data subjects who applied for life or health insurance to sign a general written consent form authorising the controller to obtain personal health information directly from their healthcare providers. The controller needed this data to determine the risk insurance at the application stage and to determine its liability when data subjects later claimed compensation. In some instances, the controller used that authorisation to request the entire medical record of the data subject for a specified period. The controller relied on the following grounds to process data subjects' health data: 1) the contractual necessity under Article 6(1)(b) GDPR; 2) a power of attorney granted in the authorisation form to request personal data on behalf of the data subject under Article 15 GDPR; and 3) [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Article 6(1)(1) of the Finnish Data Protection Act (Tietosuojalaki)] which allows insurance companies to process the health data of the insured persons and claimants to determine the insurance company's liability. Upon a complaint from the healthcare provider, the Finnish DPA investigated this practice of the controller related to collecting the health information directly from medical units. The DPA held that the controller could not rely on the contractual necessity under Article 6(1)(b) GDPR because the health data belonged to special categories of personal data regulated by Article 9 GDPR, which does not contain contractual necessity as a sufficient legal basis. Further, the controller could not rely on a power of attorney either because the purpose of the right of access under Article 15 GDPR is, among other things, to check the legality of processing and the accuracy of data. Therefore, processing the data obtained under the right of access to determine the insurance company's own risk and liability would be contrary to the principle of purpose limitation under Article 5(1)(b) GDP