avis-n0-38-2025.pdf

Here are the key points summarized:

I. Introduction

• The Authority is reviewing an amendment to the Law on Insurance.

II. Purpose and Scope of the Amendment

• The purpose is to clarify the processing of personal data in relation to insurance claims.
• The scope is limited to the processing of personal data by the Royal Decree, as defined in the Law on Insurance.

III. Delimitation of the Ruling

• The Authority notes that the amendment should specify the categories of data to be processed and the persons who have access to such data.
• The Authority also suggests clarifying the delegation to the King at Article 7, §3 of the Law on Insurance.

IV. Proportionality and Minimization of Data

• The Authority recommends specifying that personal data must be limited to what is necessary for the purposes for which they are processed.
• The Authority also notes that the first phrase of Article 7, 5° of the Law on Insurance should be removed, as it is a paraphrase of the GDPR and does not add any additional value.

V. Duration of Data Processing

• The Authority suggests removing the first sentence of Article 7, 5° of the Law on Insurance, which states that personal data must be kept for no longer than necessary.
• Instead, the Authority recommends specifying a maximum duration of five years, as provided in the current Law on Insurance.

VI. Conclusion

• The Authority estimates that at least three modifications are required to ensure the amendment is in line with GDPR requirements:
  • Clarify the delegation to the King at Article 7, §3 of the Law on Insurance.
  • Specify the categories of data to be processed and the persons who have access to such data.
  • Remove the first phrase of Article 7, 5° of the Law on Insurance.