Do insurers need consent to use customers' health data?

Health and life insurance application forms usually ask about past treatment, chronic conditions and hospital stays. That is health data under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), which may be collected only with explicit consent or under one of the exceptions Section 26 lists.

The Office of Insurance Commission (OIC), Thailand's insurance supervisor, told the Personal Data Protection Committee that the insurance sector had run into problems complying with the PDPA on several fronts. It sent six questions through the Office of the Personal Data Protection Committee (PDPC Office).

The answers came from the PDPC's advisory subcommittee on consultations. An advisory opinion is not legislation, but it shows how the body that oversees the PDPA reads these provisions. In our view, much of it carries over to any business that holds sensitive customer data.

What did the OIC ask, and who is affected by each answer?

Six questions. The first three hit insurers directly. The other three concern the OIC's own work, but any company with a large customer database should read them too: state agencies and customers' relatives can bring the same requests to a private business.

Before answering, the subcommittee set out one ground rule. The OIC is a state agency under Section 17, paragraph one, of the 2007 Act on the Commission for Supervision and Promotion of the Insurance Business, as cited in the opinion, so it must also follow the Official Information Act of 1997. The PDPA applies on top of that under Section 3(1).

For questions that turn on the Official Information Act, the subcommittee suggested the OIC ask the Official Information Commission directly. This article covers the PDPA answers only.

Do insurers need consent to use health data for underwriting?

Yes, unless another exception in Section 26(1) to (5) applies. The OIC asked whether insurers could rely on Section 26(4), the legal-claims exception. The PDPC Office said no: underwriting, premium calculation and claims payment are not the establishment or exercise of a legal claim in the sense of that provision.

The subcommittee split an insurer's work into two stages. Underwriting is the insurer's own judgement before the contract, about whether it is satisfied with and willing to accept the applicant's risk. Premium calculation and claims are performance of the contract with the data subject, and for those the basis is Section 24(3).

Here is where insurers slip. Section 24(3) is a basis for ordinary personal data. Once the data is health data or another Section 26 category, the PDPC Office says explicit consent is needed under Section 26 read with Section 27, paragraph one, unless another exception in Section 26(1) to (5) applies.

The opinion also restates purpose limitation. Data collected for a stated purpose and on a stated basis must be used or disclosed for that same purpose and basis under Section 21. A new purpose needs notice and prior consent, or a law that allows it.

Why the UK's substantial public interest approach does not carry over

The OIC pointed to the UK Data Protection Act 2018, which treats insurance as a purpose of substantial public interest for GDPR purposes, and asked whether Thailand could read Section 26(5)(e) the same way.

The PDPC Office replied that neither the PDPA nor any other Thai law defines substantial public interest in that way. To use Section 26(5)(e), a legal provision must first empower insurers or place a duty on them. The wording of Section 26(5) itself starts from compliance with a law.

The opening the PDPC Office left is this: the OIC Board or the OIC has the power to issue rules that require insurers to collect, use or disclose data in the public interest of supervising the industry and protecting policyholders. Once such a rule exists, insurers complying with it can rely on Section 26(5)(e) read with Section 27, paragraph one.

Group cover for staff: who collects the consent?

Under group cover, the insurer does not deal with each employee. The PDPC Office once answered Company K, which an insurer had asked to sign a certificate stating that it had already obtained its employees' consent. That opinion draws a clear line between such a certificate and consent under the PDPA. The passage is quoted below in the original Thai.

In plain terms, the certificate is a juristic act under the Civil and Commercial Code, not a request for or grant of consent under the PDPA. Read with the OIC answer, our reading is that explicit consent for health data must come from each employee. The employer can coordinate and keep the evidence for the insurer, but its certificate cannot stand in for the employees' consent. HR teams can read more in medical claims for staff and families.

What must an application form say when the insurer checks existing policies?

It must say clearly that the insurer needs to check the applicant's policy data and what happens if the applicant does not provide it. The PDPC Office suggested the OIC require insurers to put this condition in the application form and in the Section 23 privacy notice.

The reason given is the principle of utmost good faith. A policyholder must disclose true information to the insurer, without concealment or false statements. That makes this a case where the data subject must provide data in order to enter into the contract under Section 23(2), and the insurer must explain the consequences of not doing so.

Our suggestion: take the application form and privacy notice you use today and check that they answer these four questions. For writing a notice customers actually understand, see the privacy notice guide.

1. Which policy records of the applicant will the insurer check, from which source, and for what decision?
2. Which information must the applicant provide to enter the contract, and how will the insurer proceed if it is not provided?
3. Which health questions rely on explicit consent, and is the consent request set apart from the rest of the form?
4. Who may the data be disclosed to, such as brokers, hospitals or the OIC?

Can insurers set up their own fraud database?

Not without consent, unless a law backs it. The PDPC Office drew a sharp line between two set-ups: a database run and disclosed by the OIC, and a central data pool insurers build among themselves. The answers for the two are almost opposite.

In the first set-up, the OIC is the data controller and has the power to supervise, promote and develop the insurance business under Section 20(2) of the law establishing the commission, as the opinion cites. If the database falls within that power, the OIC may collect fraud-related data without consent under Section 24(4), 24(6) or 26(5)(e), as the case may be.

The subcommittee's reasoning: preventing and dealing with insurance fraud is part of supervising a financial business that affects both the economy and policyholders as consumers. Effective supervision is therefore a purpose of substantial public interest.

A system that answers only hit or no hit

Even where the OIC may share fraud data, the subcommittee noted that it should share only what is necessary under Section 22.

The design it suggested is a query system. An insurer asks whether a customer has a fraud history. The system routes the query to the responsible staff at the OIC, who check and reply through the system with hit or no hit and only the details needed, with access rights kept as narrow as possible.

Such a system needs security measures under Section 37(1) and clause 4(2) of the 2022 PDPC Notification on security measures of data controllers: organisational and technical measures, plus physical measures where needed, scaled to the risk.

In our view the same hit-or-no-hit idea suits other watch lists, such as a list of suspended customers that several departments need to check. The person asking rarely needs the full file, only the result they will act on.

When does suspected fraud become a criminal record?

When a competent state agency uses the data in a criminal investigation, prosecution or punishment. Before that, it is not. The PDPC Office applied the definition in clause 3 of the 2023 notification on criminal record data.

The definition has two conditions. The data must relate to investigation, prosecution or punishment, and it must be official or certified by a competent state agency. The opinion gives examples such as records from the Criminal Records Division of the Royal Thai Police or from the Department of Corrections.

Conduct that insurers report on the forms set by the Registrar's 2021 notifications, for life and for non-life business, is only conduct giving reasonable grounds for suspicion. The PDPC Office therefore treats it as not yet a criminal record, until the OIC or a competent agency takes criminal action on it. That action need not have reached a final outcome.

1. An insurer spots suspicious conduct
   It reports on the Registrar's form to the OIC. The data is personal data, but not a criminal record.Section 22 · 37(1)
2. The OIC keeps the report in its database
   Still not a criminal record, because no competent agency has taken criminal action.Clause 3, criminal record notification
3. A competent agency opens an investigation or prosecution
   The data becomes official state data and a criminal record under Section 26, even if the case is not final.Section 26
4. At every stage
   Collect, use and disclose only what is necessary, with security scaled to the risk, because the data affects the person's chances of entering contracts.Section 22 · 37(1)

The closing observation applies to every business. Even before such data becomes a criminal record, the subcommittee warned, it can affect the data subject's rights, for example the chance to enter into a contract. That is why we would not let an internal list of suspicious customers sit open to anyone, as if it were ordinary data.

For criminal records in recruitment, see how far criminal record checks on applicants can go.

Another agency wants a link to the policy database: what should be checked?

First, whether disclosure is a legal duty or just a request for cooperation. If a law requires the OIC to disclose, the disclosure is compliance with law under Section 24(6) or 26(5), read with Section 27, paragraph one.

If it is only a non-binding request, the OIC must decide for itself whether disclosure is necessary for the requesting agency's public-interest task or official authority. If so, Section 24(4) or 26(5) is available. A request that cites a broad purpose without naming the provision that grants the power is a factor to weigh with care.

• The receiving agency may use only what is necessary within its own powers, under Section 22.
• The receiving agency must not use or disclose the data for any purpose other than the one stated in its request, under Section 27, paragraph two.
• The receiving agency needs security measures under Section 37(1) and the 2022 notification.
• The OIC must take steps, as far as it can, to stop the recipient using or disclosing the data unlawfully, under Section 37(2).

Can heirs find out where a deceased relative was insured?

The PDPA is no obstacle, because a deceased person's information is not personal data under the Section 6 definition. The OIC is a state agency, though, so it must still apply the Official Information Act of 1997 and any other relevant law.

The PDPC Office noted that a deceased policyholder's records remain personal information under Section 4 of the Official Information Act. Under Section 25, paragraph five, of that Act, unless the deceased left a will saying otherwise, heirs or persons named in a ministerial regulation may act on the deceased's behalf.

The other case is a living policyholder whose beneficiary, or a third party with a claim under the policy, wants to know which company holds the policy. The data is still personal data, and the PDPC Office set out three bases in order.

1. If a law requires the OIC to disclose, use Section 24(6) or 26(5) read with Section 27, paragraph one.
2. If not, but disclosure is necessary for supervising, promoting and developing the insurance business within the OIC's powers, use Section 24(4) or 26(5).
3. If neither applies, but disclosure is necessary for the requester's legitimate interest and that interest is not outweighed by the policyholder's rights, use Section 24(5) read with Section 27, paragraph one, disclosing only what is needed.

This opinion speaks only to the OIC; it does not answer for private insurers. Still, we think an insurer asked the same question by a beneficiary can follow the third step, provided it does the full balancing and records the disclosure in its Section 39 record as Section 27, paragraph three requires. For the balancing itself, see the three questions behind legitimate interest.

What should insurers, brokers and hospitals do next?

Our suggestions below are grouped by role. Each one comes from the PDPC Office's answers above; the selection and order are ours.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)