The Finnish Motor Insurers' Centre – Court Ruling (Finland, 2023)

Court Ruling
DPA Tietosuojavaltuutetu2 October 2023Finland
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The Finnish Motor Insurers' Centre appealed a fine for asking for unnecessary patient information from healthcare providers. The court ruled that some health data might be necessary to settle claims, meaning the insurers could request it. This decision clarifies what information insurance companies can legally ask for during claims processing.

What happened

The Finnish Motor Insurers' Centre sought to overturn a fine for processing unnecessary patient information.

Who was affected

Individuals whose health data was requested by the Finnish Motor Insurers' Centre during insurance claims.

What the authority found

The court decided that some health-related information is necessary for settling claims, allowing the insurer to request it.

Why this matters

This ruling helps define the boundaries of what health information insurance companies can request, guiding both insurers and healthcare providers on their responsibilities.

GDPR Articles Cited

Art. 5(1)(a) GDPR
Art. 5(1)(c) GDPR
Art. 25(2) GDPR

National Law Articles

§ 82 Motor Liability Insurance Act
Decision AuthorityHelsingin hallinto-oikeus
Reviewed AuthorityTietosuojavaltuutetun toimisto (Finland)
Full Legal Summary
Detailed

The Finnish Motor Insurers' Centre (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had been fined €52,000 for processing and requesting unnecessary patient information from healthcare providers. The controller filed the appeal claiming that it could not determine in advance whether certain information was necessary to settle a claim. The controller considered that under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act], various information could be considered necessary, and therefore it had to process information other than that directly related to the traffic accident. The controller argued that it must evaluate both facts in favour of liability for damages and facts directly or indirectly against it, as well as other information necessary to assess the credibility of the evidence. In the controller's view, healthcare professionals would not ultimately be in a position to assess the legal question of what information is necessary to settle a claim. The Court noted that much of the injured party's health data may be necessary to assess the contribution of another injury to the occurrence of the relevant injury. Consequently, other health-related information necessary to settle a claim may sometimes be needed long before the traffic accident. In this respect, the Court considered that the information relating to healthcare appointments must, in principle, be considered as information necessary to establish the causation of the injury in order to settle a claim. Thus, the tasks related to the assessment of the claim belong to the core tasks of the insurance company and cannot be transferred, even partially, to the responsibility of the healthcare provider. The Court stated that the investigation carried out by the DPA could not be considered sufficient to prove that the controller had systematically

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Details

Ruling Date

2 October 2023

Authority

DPA Tietosuojavaltuutetu

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. The Finnish Motor Insurers' Centre - Finland (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: