The recently published act to transpose the General Data Protection Regulation into Portuguese law was expected to provide specific grounds for the processing of health data for insurance purposes. However, the act was approved without any exemptions or provisions regarding the legitimate basis on which insurers can process health data (or any other special category of data) for insurance purposes. This article examines the implications of the new law for the insurance industry.
A recent Portuguese Supreme Administrative Court jurisprudence uniformising decision held that the statute of limitation period of an insurer's subrogated right had started only when it had paid the damages incurred by the insured due to a motor accident. The decision is a relevant milestone in administrative jurisprudence, as there are divergent opinions in this regard.
The Portuguese insurance regulator recently entered into an agreement with Portugal Fintech – a network focused on start-ups that connects fintech founders, investors, academics, consultants and legal advisers – to establish Portugal Finlab. From an insurance regulatory perspective, Portugal Finlab will be a useful tool to ensure an appropriate balance between innovation and consumer protection in the insurance sector.
A number of amendments were recently made to the Insurance Supervision Act in the context of transposing the EU Markets in Financial Instruments Directive. The main amendments concern the protection of communications to the Portuguese insurance regulator regarding violations, the imposition of fines on insurers that violate the EU Benchmarking Regulation and the rules applicable to insurers' marketing of insurance products linked to investment funds.
Under the General Data Protection Regulation, the processing of health data for insurance purposes requires the data subject's 'explicit consent', which poses enormous challenges for the insurance industry. Portugal has no specific legislation concerning the processing of health data for insurance purposes. However, it is hoped that the anticipated Data Protection Act will provide specific grounds for the processing of such data in this context.