F2 Data protectionLike all other bu

F2 Data protection
Like all other businesses in the UK, insurers are subject to the provisions of the Data Protection Act 1998 (DPA), but it is of central importance to them, as the collection of data about the people and risks they insure is a core activity.

The DPA creates rules over the obtaining, processing and retention of personal information:
• Personal information is any set of data that relates to a living individual who can be identified, either directly from the data, or from the data plus other information that the processor of the data has in their possession.
• Processing is not limited to electronic processing of data, but also covers other forms of structured data filing and organization.

All processors of data, (in practice just about anyone who collects information on members of the public as part of their normal business activities) must be registered with the Information Commissioner and, as part of the organization, must specify the data that they plan to obtain and process, and the specific use to which it will be put. The Information Commissioner monitors and enforces the DPA on behalf of the Government and individuals.

The DPA establishes certain principles to ensure that personal information is handled properly. In summary, data must be:
• Fairly and lawfully obtained and processed;
• Processed for the limited purposes specified at the time the data was collected, and for which the data holder has been authorized;
• Adequate, relevant and not excessive for its intended purpose;
• Accurate;
• Not kept for longer than is necessary;
• Processed in line with the individual’s rights;
• Secure; and
• Not transferred to other countries without adequate protection.

All companies within the UK have to comply with these principles by law, unless specifically exempted. Under the DPA, individuals have a legal right to:
• Find out what information is held about them by a firm;
• Have that information corrected or deleted if it is found to be in contravention of any of the principles;
• Enforce restriction of its use to the limited purposes specified at the time the data was obtained; and
• Obtain compensation for any significant misuse of that information.

These rules pose obvious challenges to insurers, including but not limited to the following:
• Insurers collect a huge amount of personal data, particularly at the point of sale. Can the need for all of the data collected be demonstrated as being necessary for the assessment of the risk (or might some of it merely be data acquisition for future marketing purposes)?
• Life insurers hold personal data on all their insurers, sometimes for decades, as policies can last that length of time. Can it be demonstrated that all of the personal data obtained at inception is still relevant to the effective administration of the contract some years later?
• What about personal data relating to policies that are no longer in force? Does the insurer have the right to retain old data and process it in the future, for example for direct marketing purposes?
• Insurers are increasingly looking to outsource certain aspects of their routine functions, sometimes to overseas locations such as India or China. Can personal data be legally and securely transferred to offshore locations?

F3 Bribery
The law on bribery and corruption was generally regarded as fragmented, over-complex and no longer applicable to the modern world. In order to address this issue, the Bribery Act received Royal assent in April 2010 immediately before the general election. It had been designed to provide a comprehensive scheme of offences that would enable the courts and prosecutors to respond more effectively to bribery whether in the UK or abroad.

There has been considerable criticism that the deliberately wide wording of the Act is impractical and too far reaching. However, it came into effect on 1 July 2011 and has introduced the following offences:
• Paying bribes – it is an offence to offer or give a financial or other advantage with the intention of inducing the person to perform a relevant function or activity improperly or to reward that person for doing so
• Receiving bribes – it is an offence to receive a financial or other advantage intending that a relevant function or activity should be performed improperly as a result

The most controversial offences are where:
• A person associated with a relevant commercial organization (including employees, agents and external third parties) bribes another person; and
• The organization cannot show that it had adequate procedures in place to prevent bribes being paid.

Thus a company can be guilty even if no one was aware of the bribery.

The offences may lead to prosecution if done by a British national or company, regardless of whether the act took place in or outside the UK. The offence of failing to prevent bribery will also apply to foreign companies with a business presence in the UK irrespective of where the bribe is paid.

Individuals may be sentenced to up to 10 years imprisonment. Companies could receive an unlimited fine.