78International Association of Insurance Supervisors and CGAP Working Group on Microinsurance (2007) Issues in Regulation and Supervision of Microinsurance. Available at https://www.google.co.za/url?sa¼t&rct¼j&q¼&esrc¼s&source¼web&cd¼2 & ved¼2ahUKEwihqKiQx\_boAhULQhUIHXeACP0QFjABegQIAhAB&url¼https%3A%2F% 2Fwww.iaisweb.org%2Ffile%2F34275%2Fissues-paper-in-regulation-and-supervsion-ofmicroinsurance-june-2007&usg¼AOvVaw340q6Oe8yb\_D9kNa5i0oEp. Accessed 30 August 2019.

79Biener et al. (2013), pp. 2–3.

80ILO (2012).

81Biener et al. (2013), p. 2.

82Biener et al. (2013), pp. 2–5.

83The IAIS mention in their policy document that consumer protection is vital to the proper implementation of such policies. See page 6 of the International Association of Insurance Supervisors and CGAP Working Group on Microinsurance (2007) Issues in Regulation and Supervision of Microinsurance. Available at https://www.google.co.za/url?sa¼t&rct¼j&q¼&esrc¼s& source¼web&cd¼2&ved¼2ahUKEwihqKiQx\_boAhULQhUIHXeACP0QFjABegQIAhAB& url¼https%3A%2F%2Fwww.iaisweb.org%2Ffile%2F34275%2Fissues-paper-in-regulation-and-

protection as a whole". 84 It is therefore evident that consumer protection is one of the fundamental principles of effective microinsurance policy implementation.85

It is therefore clear that microinsurance is to have profound benefits for low-income earners, essentially offering these consumers access to a product which they never had access to before. The success of microinsurance is based on various factors, especially with regard to a proper and fair regulatory framework. The regulatory framework for any microinsurance products should be aimed at consumer protection.

#### 3.3 Principles for an Effective Microinsurance Model

The IAIS highlighted specific principles for the successful implementation of microinsurance in their 2007 policy document. The policy document mentions the following principles as essential for the proper implementation of microinsurance: developing a microinsurance policy and promoting its implementation; facilitating the availability of key information/statistical data on microinsurance business; promoting learning processes and dialogue among relevant sectoral stakeholders; enacting clear laws and regulations in accordance with internationally accepted standard that encourage insurance coverage for low-income households and its compliance while limiting regulatory arbitrage, contributing to the policy dialogue with government so that social insurance schemes are working in conjunction with microinsurance; developing clear policies to enhance access to financial services which can be used as a basis for discussion with legislators, and also between government departments and supervisors; limiting moral hazard and fraud by promoting awareness, and putting in place controls and incentive systems; and promoting consumer education and raising awareness to instill an insurance culture among low-income households.86

These principles as highlighted by the IAIS in 2007 are crucial for microinsurance models to succeed. It is now necessary to consider the microinsurance model in South Africa and deliberate exactly what it entails for consumers and the insurance industry as a whole.

supervsion-of-microinsurance-june-2007&usg¼AOvVaw340q6Oe8yb\_D9kNa5i0oEp. Accessed 30 August 2019.

84Llanto (2007), pp. 61–86.

85Llanto (2007), pp. 61–86.

86See page 6 of the International Association of Insurance Supervisors and CGAP Working Group on Microinsurance (2007) Issues in Regulation and Supervision of Microinsurance. Available at https://www.google.co.za/url?sa¼t&rct¼j&q¼&esrc¼s&source¼web&cd¼2 & ved¼2ahUKEwihqKiQx\_boAhULQhUIHXeACP0QFjABegQIAhAB&url¼https%3A%2F% 2Fwww.iaisweb.org%2Ffile%2F34275%2Fissues-paper-in-regulation-and-supervsion-ofmicroinsurance-june-2007&usg¼AOvVaw340q6Oe8yb\_D9kNa5i0oEp. Accessed 30 August 2019.

#### 4 Microinsurance in South Africa

#### 4.1 History of Microinsurance

Microinsurance is a fairly recent concept in the South African insurance industry.87 South Africa has always differentiated between indemnity insurance and non-indemnity insurance, long-term insurance and short-term insurance,88 and most recently through the enactment of the Insurance Act,89 life and non-life insurance.90

However, it is evident from the above classifications that microinsurance was never recognised as a formal insurance product. So when did microinsurance first come into the picture? In 2008, the South African National Treasury put forward the idea of microinsurance when it first released a discussion paper on the future of this type of insurance in South Africa for public comment.91 This discussion paper was then supported by written-comments and proposals given by participants, which were evaluated and taken into consideration by the Treasury.92 In July 2011, after significant consultation, the National Treasury published a policy document on microinsurance93 in which a comprehensive policy framework was set out.94 The framework emphasised that there were three features of the insurance industry that needed urgent reform; namely, the need to promote better access for South Africans to affordable insurance products that meet the risks they specifically face, the need for consumers to better match the products that they buy with their insurance needs and the strengthening of consumer protection in general.95 Financial inclusion for the mass market was the objective of the framework.96

This is where the concept of microinsurance was born and thereafter became a formally recognised insurance product with the Insurance Act (IA)97 and PPRs

87Microinsurance was only enacted in 2018 but first received attention back in 2008 when the National Treasury set out a discussion paper on the matter.

88Reinecke et al. (2013), p. 10.

8918 of 2017.

90The Insurance Act defines "life insurance business" as any activity conducted with the purpose of entering into or meeting insurance obligations under a life insurance policy and "non-life insurance business" as any activity conducted with the purpose of entering into or meeting insurance obligations under a non-life insurance policy.

91National Treasury (2008) The future of microinsurance regulation in South Africa discussion paper. www.treasury.gov.za, Accessed 13 July 2019. See also Millard (2012), p. 665.

92Millard (2012), p. 665.

93National Treasury (2011) The South African Microinsurance Regulatory Framework accessed at www.treasury.gov.za. Accessed 13 July 2019.

94Millard (2012), p. 665.

95National Treasury The South African Microinsurance Regulatory Framework 1. See also Millard (2012), p. 665.

96Millard (2012), p. 665.

9718 of 2017.

regulating this new type of insurance. The IA defines microinsurance in section 1 as follows:

'microinsurance business' means insurance business:

	- (i) life insurance business, classes 1, 3, 4 or 9; and
	- (ii) non-life insurance business, in the sub-class personal lines in: (aa) classes 1, 2, 3, 9, 11, 14 or 17; and (bb) class 10, but only to the extent that the insurance obligations directly relate
		- to the classes referred to in item (aa); and

The Act also defines who a "microinsurer" is and states that it is, "an insurer licensed to conduct only microinsurance business". 98

In the non-life insurance sphere, microinsurance is available in the form of motor, property, agriculture, legal expense, certain liability policies, consumer credit, certain accident and health policies and reinsurance products.99 It appears from the above-mentioned forms of microinsurance policies that a lot more consumers will now have access to insurance products that meet their specific needs. This ultimately means that a larger portion of the South African population will now have access to these products.100 The 2018 PPRs contain concise rules on this type of insurance product and importantly, sets out the rules on the application of the provisions,101 the structure of the policy,102 the variation and renewal of such a policy,103 waiting

98See section 1 of the Insurance Act 18 of 2017.

99See Table 2: Classes and sub-classes of Insurance Business: Non-life Insurance" in terms of the Insurance Act 18 of 2017. See also Millard (2012), p. 665, 667.

100Financial inclusion is paramount to this newly recognised insurance product.

101Rule 2A.2.

102Rules 2A.4.

103Rule 2A.5.

periods,104 exclusions,105 excesses,106 claims,107 the reinstatement rules,108 and rules on the reporting of a new product.109

The insurance market in South Africa is one of the largest on the continent.110 The South African insurance market accounted for USD 42 billion of the total premiums written of the global market in 2016.111 PWC compiled a report in which they stated that South Africa has the highest insurance penetration levels in Africa and is a relatively more mature market, which might point to fewer opportunities for growth in the future.112 However, the increasing growth in premiums tell a different story. Long-term gross written premiums rose from US\$15.8 bn in June 2016 to US\$19.3 bn in June 2017, while short-term insurers experienced growth from US\$4.0 bn to US\$4.9 bn over the same period.113 This proves that there is major growth on the cards for South Africa and Africa as a whole, especially if the microinsurance market can be tapped. In South Africa, there are also very few big insurers that dominate the market, making entrance for smaller businesses very difficult.114

In terms of the microinsurance market in South Africa, the population in the country consists of a vast majority of low-income earners as well as people who are exposed to luxuries such as insurance on a daily basis.115 A large part of the population is not considered "financially literate" and this means that many South Africans do not understand financial products and the consequences of these types of products.116 This is where microinsurance is to have a significant impact.

104Rule 2A.6.

108Rule 2A.10.

109Rule 2A.12.

110PWC Report "Ready and Willing: African insurance industry poised for growth" September 2018. Available at https://www.pwc.co.za/en/assets/pdf/south-african-insurance-2018.pdf. Accessed 6 January 2020. This also illustrates why a chapter on South Africa is included in an international European book.

111PWC Report "Ready and Willing: African insurance industry poised for growth" September 2018. Available at https://www.pwc.co.za/en/assets/pdf/south-african-insurance-2018.pdf. Accessed 6 January 2020.

112PWC Report "Ready and Willing: African insurance industry poised for growth" September 2018. Available at https://www.pwc.co.za/en/assets/pdf/south-african-insurance-2018.pdf. Accessed 6 January 2020. The top four life insurers are very dominant and account for 52% of the market, while the top non-life players control 56% of the market.

113PWC Report "Ready and Willing: African insurance industry poised for growth" September 2018. Available at https://www.pwc.co.za/en/assets/pdf/south-african-insurance-2018.pdf. Accessed 6 January 2020.

114Ibid at page 18.

115Mpedi and Millard (2010), p. 508.

116Nanziri and Olckers (2019), p. 2.

The financial literacy of South Africans was put to survey by the National Income Dynamics Study and it was found that only 40.57% of South Africans are financially literate.117 It was further found that peoples financial literacy increases when they go on to study a diploma or degree and that household incomes also had an effect on financial literacy.118 The survey found that 63.3% of households with an income of R30,000 or more per month are financially literate compared to only 34.1% in households of R5000 per month or less.119 This proves that low-income earners, the possible microinsurance consumer, is not always financially literate and therefore, there is a need that these products are designed correctly for these specific consumers.

A further study conducted by the Financial Services Board in 2015 showed that about 69% of adult South Africans do not have emergency funds to cover their expenses for 3 months in case of sickness, job loss, economic downturn or other emergency.120 When surveying people about insurance products the study revealed that only 38% percent of South Africans indicated that they do not hold at least one insurance product in 2015 compared to 62% of adults who hold at least one insurance product.121 Only 51% of South African adults are aware of insurance products.122 The most popular type of insurance product held was funeral insurance with 28% of adults holding an account with a burial society.123

From the above it is therefore apparent that there is a need for microinsurance products for low-income earners in South Africa. These consumers also require protection from risks but it is essential that microinsurance products are designed and sold differently to these consumers in order to cater for their needs.

#### 4.2 Policyholder Protection Rules on Microinsurance

#### 4.2.1 Introduction

Microinsurance is now recognised as a formal type of insurance product in South Africa.124 Since the promulgation of the Insurance Act,125 microinsurance is regulated by statute and the specific rules on how these products are to be structured

117Nanziri and Olckers (2019), p. 2.

118Nanziri and Olckers (2019), p. 2.

119Nanziri and Olckers (2019), p. 2.

120Roberts et al. (2016), p. 9.

121Roberts et al. (2016), p. 9.

122Roberts et al. (2016), p. 9.

123Roberts et al. (2016), p. 9.

124See the Insurance Act 18 of 2017 as well as the 2018 PPRs.

12518 of 2017.

and carried out are outlined in the PPRs.126 Chapter 3 of the 2018 PPRs regulates microinsurance. Rule 2A has been included and the rule regulates various aspects of microinsurance.127 These rules are to have a profound impact on low-income earners and households.

The PPRs have set stringent rules as to how these types of policies may be designed, marketed128 and sold to low-income earners in South Africa. In addition, all non-life insurance products are regulated by the 2018 PPRs which also include rules on product design as well as disclosure requirements.129

#### 4.2.2 Specific Rules on Microinsurance

#### <IP_ADDRESS> Outline

Rule 2A of the 2018 PPRs contains comprehensive guidelines on all aspects of microinsurance.130 These rules will be dealt with in further detail below. Rule 2A.2 starts off with setting out the application of the rule and states that,

This rule applies to any microinsurance policy and applies concurrently with, and in addition to, all other rules set out in these Policyholder Protection Rules. If there is an inconsistency between any provision of this rule and any other rule in these Policyholder Protection Rules, the provision of this rule prevails.

In terms of the use of the term 'microinsurance' rule 2A.3 states that, "An insurer, other than a microinsurer, or any person acting on behalf of that insurer may not use the term 'microinsurance' or any derivative thereof in respect of a policy or in any advertisement in respect of a policy."

#### <IP_ADDRESS> Structure of the Policy

The structure of a microinsurance policy is significant as it is important to note exactly how these types of products are designed with the specific consumer in mind. Rule 2A.4 states that a microinsurance policy may not have a contract term of more than 12 months and also that the value of the policy benefits under a microinsurance policy may not exceed the maximum amounts as prescribed by the Prudential Authority. The rule also makes mention of the fact that such a policy must, upon expiry of its contract term, either be automatically renewed; or terminated in

126See rule 2A in terms of the Short-term Insurance Act Policyholder Protection Rules.

127Including claims, excesses, reporting of new products and the structure of these policies.

128Rule 10 sets out the rules for the advertising of insurance products.

129Rule 2 and rule 11 respectively.

130Every aspect from the structure of the policy, to waiting periods, to exclusions is dealt with in rule 2A.

accordance with the requirements set out in these Rules.131 A microinsurance policy may not provide that any of the policy benefits thereunder is subject to the principle of average.132

Therefore, microinsurance policies may not have a contract term more than 12 months and the monetary cap introduced under the section gives effect to the very basic principle of microinsurance: that is that the value of the policy should not exceed a specific amount.133 The fact that a microinsurance policy is valid for a 12-month period does not appear to be any different from other short-term insurance contracts, as most short-term policies are valid for a period of 12 months and are then renewable after that period has expired.134

#### <IP_ADDRESS> Waiting Periods

A waiting period is for the most part a regular feature in insurance contracts. These periods usually provide for a time period which has to elapse before a benefit will be paid to the policyholder.135

As far as waiting periods for microinsurance policies are concerned, rule 2A.6 states that, "a microinsurance policy, underwritten under the accident and health class of non-life insurance business as set out in Table 2 of Schedule 2 to the Insurance Act, may not impose a waiting period exceeding the shorter of one quarter of the term of the policy or 6 months, in respect of which policy benefits are payable on the happening of a death, disability or health event resulting from natural causes". 136 Additionally, a microinsurance policy may also not impose a waiting period in respect of policy benefits payable on the happening of a death, disability or health event resulting from an accident.137 Furthermore, a microinsurance policy may also not impose a waiting period when it is renewed.

131Rule 2A.4.3.

132See rule 2A.4.1.–2A.4.4.

133Caps under microinsurance policies are limited to R100,000 for life insurance and R300,000 for non-life insurance. See also Millard (2012), p. 665, 667.

134Millard (2012), p. 665, 667. As far as the variation and renewal of a microinsurance policy goes, rule 2A.5.1 states that the terms, conditions or provisions of a microinsurance policy may not be changed or varied during the first 12 months after inception of the policy, unless the microinsurer can demonstrate that there are reasonable actuarial grounds to change or vary the terms, conditions or provisions of the microinsurance policy or that the variation will be to the benefit of the policyholder or member of a group scheme concerned; and the variation is done in accordance with rules 11.6.3 and 11.6.4.

135Millard (2012), p. 665, 668.

136Rule 2A.6.1.

137Rule 2A.6.2.

#### <IP_ADDRESS> Exclusions

Exclusion clauses are another common feature in insurance policies. Exclusion clauses generally provide that the liability of the insurer will be excluded in specific instances.138 The policyholder should be aware of any exclusion clauses as contained in the policy as these clauses directly affect the liability of both parties to the contract.139 Policyholders should be aware of instances where the insurer will not cover them. This is generally in line with consumer protection provisions. As far as microinsurance policies are concerned, rule 2A.7.1. states that a microinsurance policy in respect of which the aggregate value of the policy benefits is R120,000 or less may not impose any exclusions or conditions limiting the liability of the microinsurer, other than exclusions or conditions relating to:

From the above it is evident that the exclusion rules relating to microinsurance policies ensure that exclusions in these policies are limited to specific instances of unlawful conduct and general unlawfulness.

Rule 2A.7.2 then provides that a microinsurance policy in respect of which the aggregate value of the policy benefits exceeds R120,000 may impose exclusions or conditions, in addition to those set out in rule 2A.7.1(a) to (f), limiting the liability of the microinsurer if the microinsurer is able to demonstrate that such exclusions or conditions will:

Once again, reaching an equitable balance between the insurer and policyholder appears to be the aim of the provision.

138Reinecke et al. (2013), pp. 241 and 112 state that parties to an insurance contract should be in agreement on the identities of the parties to the contract the performances to be rendered by each of them. In addition, the authors state that "[c]onsensus about performance requires unanimity about the existence and meaning of the proposed terms of the contract, such as warranties, suspensive and resolutive conditions, exclusions, time clauses and any other terms affecting the parties' respective obligations."

139Reinecke et al. (2013), pp. 241–242. See also Millard (2012), pp. 668–669.

#### <IP_ADDRESS> Excesses

An excess clause provides that a policyholder must bear the first portion of the loss himself.140 In principle, this means that a policyholder will only be able to claim if the loss suffered is more than the excess required to be paid in terms of the policy.141 In terms of microinsurance, such policies should contain an excess that is proportionate to the loss suffered. In terms of rule 2A.8.1, it is mentioned that microinsurance policies may only provide one standard excess per risk event covered under a particular class of non-life insurance business.142

Additionally, rule 2A.8.2 specifies that if an excess is payable under a microinsurance policy, such excess must be disclosed to a policyholder or member of a group scheme, or a potential policyholder or potential member of a group scheme in accordance with rules 11.4.1, 11.5.1143 and 17.10. Therefore, excess payments must be disclosed to the prospective policyholder before the contract is entered into. The PPRs further regulate the disclosure of excess payments.144 The fact that excesses must be disclosed to microinsurance policyholders is indispensable to these policyholders as they do not always have the finances readily available at any given time.

Excess amounts should be proportional to the loss suffered145 and rule 2A.8.3 states that where any excess is payable under a microinsurance policy in respect of which the aggregate value of the policy benefits is R120,000 or less, the excess may not exceed the lower of 10% of the value of the policy benefits, payable for the risk event as set out in the policy146 or R1000.147 Where the aggregate value of the policy benefits exceeds R120,000, the excess payment may not exceed 10% of the value of the policy benefits, payable for the risk event as set out in the policy. An additional

140Reinecke et al. (2013), pp. 327–328 and 242.

141Ibid.

142Rule 2A.8.1. As referred to in Table 2 of Schedule 2 of the Insurance Act.

143These rules regulate pre-contractual disclosure of all contractual terms, including excess payments.

144Rule 17.10 provides that "Where any excess is payable by the policyholder, the excess:

(a) must be clearly disclosed to the policyholder as required by rules 11.4.2(d)(iii) and 11.5.1(c) (iii);

(b) must be disclosed to the claimant as required by rule 17.8.3;

(c) must be fair and reasonable; and

(d) may not constitute an unreasonable barrier to a claimant, taking into account the reasonably assumed circumstances and expectations of the average targeted policyholder and claimant in respect of the policy concerned." 145Reinecke et al. (2013), pp. 327–328.

146Rule 2A.8.3(a).

147Rule 2A.8.3(b).

requirement in the new rules provides for an annual inflation-linked escalation of these values.148

In light of the above provisions it appears as if the rules on excess amounts for microinsurance policies are very much in line with the purpose of microinsurance, in that the aimed target market are given value for money, especially where the amount of money these consumers have, is the key consideration.

#### <IP_ADDRESS> Claims Process

Claims stage is a critical period in the insurance relationship.149 Usually policyholders only become aware of certain contractual provisions which may impact them negatively at this stage.150

In terms of microinsurance policies, rule 2A.9.1 states that subject to rule 2A.9.2, a microinsurer must, within 2 business days after all required documents in respect of a claim under a microinsurance policy have been received, assess and make a decision whether or not the claim submitted is valid,151 and authorise payment of the claim,152 repudiate the claim,153 or dispute the claim and notify the insured of any dispute.154

In the case where an insurer disputes a claim submitted by the policyholder, the insurer must, within 14 business days after expiry of the period referred to in rule 2A.9.1 investigate the claim further,155 come to a decision whether the claim submitted is in fact valid,156 and then make a decision as to whether to pay or repudiate the claim.157 It must be kept in mind that these types of policyholders do not have the additional resources lying around to simply cover a loss and therefore they are strongly relying on the insurance coverage taken out. Insurers should therefore comply with the short time-frames in order to compensate the policyholder efficiently and effectively.

A noteworthy provision in the rules comes out in rule 2A.9.3. This rule stipulates that a microinsurer may not reject a claim under a microinsurance policy on the basis

148Rule 2A.8.5. The amounts referred to in this rule escalates annually, from the effective date of this rule, by the Consumer Price Index (CPI) annual inflation rate published by Statistics South Africa, as defined in section 1 of the Statistics Act, 1999 (Act 6 of 1999).

149Reinecke et al. (2013), p. 320.

150Reinecke et al. (2013), p. 322. For example, forfeiture clauses generally only come to the knowledge of the policyholder when they submit a claim at claims stage.

151Rule 2A.9.1(a).

152Rule 2A.9.1(b)(i).

153Rule 2A.9.1(b)(ii).

154Rule 2A.9.1(b)(iii).

155Rule 2A.9.2(a).

156Rule 2A.9.2(b).

157Rule 2A.9.2(c).

that the policyholder did not disclose if the microinsurer did not specifically request the policyholder to disclose that information before the inception of the policy. This is to have far-reaching consequences for microinsurance policyholders. Evidently, insurers now have to play a more active role in the pre-contractual disclosure phase and must ask the necessary questions.158 Therefore, disclosure requirements for non-life microinsurance products are very much pro-consumer and seek to protect the consumers in a real manner. Obviously, rule 2A.9 will be a game changer for the consumer in protecting their rights at claim stage.

#### <IP_ADDRESS> Reinstatement

The concept of reinstatement of insurance policies occurs when a policy has lapsed due to the non-payment of the premium within the days of grace.159 The payment of premiums is always a cause for concern in insurance policies. Where an insurer reinstates a policy, reinstatement is in effect a renewal of the contract on the same terms as before and insurers may specify formalities before considering the reinstatement of a lapsed policy.160

In terms of microinsurance policies, rules 2A.10.1(a) and (b) stipulate that if a microinsurance policy has lapsed due to the non-payment of premium and the microinsurer reinstates such policy, the microinsurer must do so on at least the same terms as the policy that had lapsed and may not impose a waiting period under the reinstated policy. Additionally, rule 2A.10.2 stipulates that if a microinsurer enters into a new microinsurance policy with the same policyholder or member of a group scheme within 2 months after a microinsurance policy has lapsed due to the non-payment of premium, the microinsurer may not impose a waiting period under such new policy.161

Therefore, the rules on reinstatement of policies are very much pro-consumer and afford the policyholder a fair amount of protection.

Now that the concept of microinsurance on an international level as well as in terms of South African law has been considered, it is necessary to now focus on the provisions of product design in South Africa. The IDD highlights the importance of product design in insurance products as well as the sales side of these products. The evaluation of the provisions of the IDD above illustrated the importance of taking customers' needs into consideration and product approval processes.162 Interestingly

158This appears to be in line with the recent decision in Mahadeo v Dial Direct Insurance Ltd 2008 4 SA 80 (W).

159Reinecke et al. (2013), p. 105.

160Reinecke et al. (2013), p. 105.

161Rule 2A.10.3 stipulates that rule 2A.10.2 does not apply where the policyholder or member of a group scheme had not completed a waiting period imposed under the lapsed policy, in which case the microinsurer may impose a waiting period not exceeding the unexpired part of the waiting period under the lapsed policy.

162See paragraph 2 above.

enough, South Africa has included concise rules on product design in the PPRs. These rules also demonstrate the importance of both approval processes and consumer needs. Therefore, these rules will be evaluated below and once these rules have been clarified, the question of whether South Africa can learn or take away anything of value from the IDD provisions, will be deliberated.

#### 4.3 Policyholder Protection Rules on Product Design

Rule 2 in the 2018 PPRs deals with the product design of various insurance products.163 In terms of non-life insurance products, rule 2 places specific rules and restrictions on insurers when developing these products. The rule starts off by stating that insurers when developing products must make use of adequate information on the needs of identified types, kinds or categories of policyholders or members;164 insurers must undertake a thorough assessment, by competent persons with the necessary skills, of the main characteristics of a new product, the distribution methods intended to be used in relation to the product and the disclosure documents related thereto in order to ensure that the product, distribution methods and disclosure documents165:

Rule 2.2 goes further and states that "before an insurer starts to market, offer or enter into specific policies in respect of a new product, a senior manager of the insurer must in writing approve the product and confirm that the product, distribution methods and disclosure documents meet the principles set out in rule 2.1(b)." 167

163These rules thus apply to all non-life insurance products including microinsurance products. 164Rule 2.1. (a).

165Rule 2.1. (b).

166Rule 2.1. (c).

167See rule 2.2. Also, take note that rule 2.3. states that 2.3 this rule only applies to the development of any new product as of 1 January 2018 and any material change in design of an existing product."

In summary, it is evident that the rules on product design as set out in the 2018 PPRs are strongly geared towards making sure that various non-life insurance products are designed with the correct consumer in mind. Insurers can no longer design insurance products for a broad market. Rather, they now need to make sure that they can identify the needs of various types of consumers and design insurance products with these specific consumer needs in mind. They also need to do appropriate research on their consumers, identify various distribution channels to be used when marketing the specific products to the consumers as well as always ensuring the customers are treated fairly throughout the entire process.168

It is thus clear that rule 2 also identifies the various distribution channels through which products may be marketed to consumers and also takes into account the disclosure requirements for consumers.169 This is similar to what the IDD sets out in its provisions and rules. The IDD focuses strongly on making sure that consumers are treated equally in the designing and marketing of insurance products, despite the different distribution channels used by insurers.170

Therefore, rule 2 in the 2018 PPRs encompasses many of the same principles as in the IDD, in that insurance products should be designed with a specific market in mind as well as the fact that the product should be marketed to the correct market and that customers are treated fairly throughout the entire process. This means that in the realm of microinsurance, these now formalised insurance products must be designed for low-income consumers and should be specifically geared towards them.

#### 4.4 Disclosure Requirements in Terms of the PPRs

Rule 11 of the 2018 PPRs provides for certain disclosure requirements, similar to what we see in the IDD. In terms of rule 11.3.1, it is required that insurers provide communication to policyholders in plain language, which must not be misleading, in an appropriate medium, clear and readable print sizing and monetary amounts must be provided in monetary terms.

Further, rule 11.3.2. states that an insurer must take reasonable steps to ensure that a policyholder is given appropriate information about a policy in good time so that the policyholder can make an informed decision about the policy prior to inception and throughout the duration of the policy.171

168See rule 2.3.

169Take note that rule 11.3.2. specifically states that policyholders must be given appropriate information about a policy in good time so that the policyholder can make an informed decision about the policy prior to inception and throughout the policy.

170See paragraph 2.2. above.

171This applies to intermediaries too in terms of rule 11.3.6 and 11.3.7. What is considered good time will depend on the importance of the information in the policyholder's decision making process and the point at which it is considered most useful. See further rule 11.3.4.

Also of significance is rule 11.4.1(a) which states that where the insurer provides a policyholder, or intermediary, before a policy is entered into, with a policy quotation or similar communication that purports to provide detailed information to the policyholder, and it may be reasonably expected that the policyholder will rely on such information to make a decision whether to enter into the policy or not, the quotation or communication must include information as set out in rule 11.4.2.172

Interestingly, this rule puts the burden on both the insurer as well as an intermediary. Therefore, insurers must give the intermediaries the information and then it can be expected that the intermediaries must relay this information to the consumer. It must be noted that intermediaries are governed by the Financial Advisory and Intermediary Services Act173 and FAIS requires intermediaries to also disclose relevant information to the consumer before the contract is concluded in terms of the General Code of Conduct.174

This is similar to the disclosure requirements as set out in the IDD, however, one noticeable difference is that the IDD makes specific mention of the length of this document which can be vital to microinsurance consumers who may benefit from a short-concise document outlining the important aspects of the policy.

Evaluation of the product design and disclosure requirements for microinsurance products.

If we apply the provisions of product design in the PPRs specifically to microinsurance products, then it is safe to say that non-life microinsurance products must be designed by insurers in a way that takes into account exactly what these consumers require from such products, that insurers identify exactly who their market is and what they need from insurance products and then design the products accordingly.175

Insurers must also consider the exact distribution channels of microinsurance products in order to ensure that the correct market is identified and that the best distribution channels for these consumers are utilised. It is also essential that insurers design microinsurance products in a manner that promotes the fair treatment of these customers at all times.176 In addition, it is crucial that a senior manager approves the microinsurance product before it is specifically marketed or offered to the

172This rule states that the insurer must provide the policyholder with the name of the insurer, type of policy, nature and extent of policy benefits, any charges or fees levied against the policy, premium payable, frequency of premium, cooling-off rights, exclusions or limitations and any circumstance which could give rise to a conflict of interest.

17337 of 2002.

174See section 3(1) of the GCC which requires that providers must, when rendering a financial service such as giving advice, must ensure that such advice is factually correct, provided in a plain language, given timeously so as to allow the consumer to make an informed decision, must be adequate and appropriate for the consumer taking into account their level of knowledge, must be provided in writing if so requested by the consumer etc.

175Rule 2.1.

176Rule 2.

consumers.177 The role of the senior manager in this instance is to confirm that the product, its distribution channels and disclosure of all necessary documents meet the principles of rule 2.1(b). Therefore, there is an approval process in place, similar to what we see in article 25 of the IDD.

The provisions on microinsurance specifically appear to be pro-consumer and aim to protect the consumers in almost every aspect. Although some of the provisions in rule 2A are quite similar to other short-term (non-life) policies, such as the time period of 12 months or the waiting period provisions, it is still evident that the rules are strongly based on the protection of the consumer. From the product design stage of microinsurance policies, to the advertising and selling of these products, all the way to claims management procedures, the PPRs apply and therefore, consumer protection is the idea throughout. Therefore, microinsurance consumers will also receive the benefits of disclosure as set out in rule 11, ensuring that they receive adequate information before the inception of the policy in order to make an informed decision.

However, is this sufficient in protecting the needs of microinsurance consumers? Is there not more that can be done to personalise these products for the consumer? This is where the IDD comes in. The following paragraph will ask the ultimate question of, what can South Africa learn or take away from the IDD?

#### 5 What Can South Africa Take Away from the IDD to Enhance the Current Microinsurance Provisions?

The IDD is a comprehensive piece of legislation. The directive is specifically aimed at providing uniform rules on product design and the sales of insurance products across various distributors. The emphasis and inclusion of various distributors is significant as this is broadening the application of the directive to more products and providers. Therefore, creating a fairer insurance market for all customers. The analysis of the directive above highlighted the most significant aspects of the directive. It is evident that the customer comes first and that insurance products are designed specifically taking into account the interests and needs of a target market. The distributors of the insurance products must then ascertain if a single customer falls within the target market of the specific product. If they do fall within the target market, then distributors can adapt the product based on the customer's needs. This therefore ensures that the customer is in fact receiving a product which takes their personal needs into account. This is a commendable feature of the directive. No longer can insurers sell one single product for every customer. Rather, products must be designed according to the target market, which is selected by insurers in accordance to the customer's needs. This is to have far-reaching benefits for the customer. The fact that the directive also encompasses more distributors who must comply

177Rule 2.2.

with the directive ensures that customers are receiving the same and fair treatment across all suppliers and distributors. Therefore, customers do not need to worry that because they are dealing with an intermediary, and not directly with an insurer, that they might not be receiving the same advice or treatment. This ensures fairness on all levels of distribution.

One of the most significant features of the directive is the product information document that customers must receive before the contract is concluded. The fact that customers must receive a document that is short, concise, not misleading, accurate, in an official language and which explains to the customer what the product entails, is in fact the most far-reaching provision of the directive. This document allows consumers, at the pre-contractual stage, to make an informed decision. It appears as if this specific provision can be of most value to the South African microinsurance model. Although the PPRs have rule 11.3 and 11.4 which deal with disclosures at the pre-contractual stage, the IDD is far more specific in the fact that it must be a two (2) page document and that it must be in an official language. These two factors can have a significant impact on potential microinsurance consumers.

It was stated above that the vast majority of the population in South Africa are not financially literate and are low-income earners. Thus, making microinsurance a viable option for many people. However, we also face the barrier of most of these consumers not speaking or understanding the English language. South Africa has 11 official languages and therefore, the majority of the population do not speak or understand English. It is trite that insurance policies in South Africa are generally stipulated in English. This will prove to be a major obstacle to the microinsurance consumer. Therefore, South Africa would benefit from following this provision of the directive aimed at providing product information documents that are concise and in an official language.

If South Africa were to follow this approach as adopted in the IDD then that would mean that microinsurance consumers should receive a specific document which is short, concise, not misleading, in plain language, in one of the official languages of the country, and which clearly sets out what the policy entails and what insurance product the consumer is covered for. This would have extensive benefits for the consumer. By receiving a document that is easy to understand, that is in a language they speak and that is short and concise, this can reduce the uncertainties and issues that come about through long-winded policies which are difficult for the layman to understand.

This is a crucial feature which can enhance consumer protection in the microinsurance sphere. It is evident that the current PPRs are very much on track with the IDD in terms of product design, disclosure requirements and the fact that products must be designed with consumers needs in mind. South Africa also follows a similar process of product approval for insurance products. The PPRs currently state that insurance products must go through an approval process by a senior manager who will ensure that the products have been correctly designed for a specific consumer and that their needs were taken into account. However, we do not see a similar provision in the PPRs to that of the product information document as contained in the IDD with regards to the length of the document and the language requirement.

Therefore, if we come back to the question of this chapter which asked, what can the IDD offer the South African microinsurance market? It then becomes clear that following the provisions as set out in article 20 will provide microinsurance consumers in South Africa with significant protection. Article 20(4) also specifically makes mention of the "type of customer", this is something that the PPRs should also make mention of. It needs to be remembered that all customers are different, therefore we cannot apply the same selling and advice standards to all customers. Products should be sold differently according to the type of customer.

Article 20(6) state that for non-life insurance products, the information referred to in paragraph 4 shall be provided by way of a standardised insurance product information document. Paragraph 7 then sets out what the document should entail. Paragraph 8 goes even further by stating exactly what kind of information the document should encompass. It states that it should contain information about the type of insurance, the cover provided, the main risks (included and excluded), premiums and duration of payments, obligations on terms of the contract, what happens when a claim is made, the duration of the contract and terminating the contract.

Although South Africa has similar provisions in rule 11.3.2. and rule 11.4.2 of the PPRs, it would have more of an impact on consumers to have a very short document, being restricted to 2 pages, and in an official language of the consumer. The two rules are also currently applicable to intermediaries too and therefore, the obligation will extend to intermediaries to provide consumers with a standardised insurance product document, as in line with the current rules 11.3.6 and 11.4.1. of the PPRs, as well as in terms of the FAIS General Code of Conduct.

The benefit of providing a standardised insurance product information document to the microinsurance consumer should outweigh the cost of having to prepare such a document. As far as the cost implication goes for the insurer in developing the standardised insurance product information document for the consumer, it is submitted that there will not be any major financial burden on the insurer in developing this document. Currently, rule 11.4.1. of the PPRs allows for insurers to supply policyholders with a quotation or similar communication before the policy is entered into which enables the policyholder to make an informed decision, and this does not come with any additional cost to the policyholder. Rule 11.4.2. sets out the information which must be contained in this quotation or communication and the list is extensive. Once again, no mention of fees to the policyholder is made mention of. Insurers provide this information free of charge to consumers. Therefore, it is submitted that producing a standardised insurance product information document for microinsurance consumers will not cause a financial burden and will only assist the consumers in making an informed decision as to whether to enter into the policy or not. Providing the document in an official language should not affect the consumer as in terms of the National Credit Act178 section 63 states that every consumer has the right to receive documents in an official language to the extent that it is reasonable having regard to usage, practicality, expense, regional circumstances and the balance of the needs of the population. Section 65(3) of the Act then goes on to state that a credit provider must not charge a fee for the original copy of any document required to be delivered to a consumer in terms of this Act. Therefore, the NCA makes it clear that documents may be requested in an official language and that the provider may not charge a fee for such documents. If we apply this to another financial sector, the insurance industry, then it is not irrational to assume that insurers are to provide consumers with an information document at the pre-contractual stage in an official language at no cost to the consumer. Rather, insurers should focus on this vast untapped market that is capable of bringing in significant revenue for the insurer.

#### 6 Conclusion

The product design of insurance products is no longer an easy or effortless task for insurers. Insurers used to be in control of the process of product design and they were previously the ones who could set the tone of how various types of insurance products were designed and marketed to the public. This is no longer the case. The IDD, in the EU market, and the PPRs in terms of South African legislation, are both setting clear and concise rules on exactly how various insurance products are to be designed and marketed to the public. Consumer protection is at the forefront of both of these pieces of legislation. Insurers and intermediaries must now follow strict rules when designing and marketing insurance products. The fact that the EU as well as South Africa have recognised the importance of protecting consumers, at various phases of any insurance product lifecycle, is commendable.

With specific regard to microinsurance products, this means that these more vulnerable consumers are now afforded additional protection in the design of these specific insurance products. Microinsurance policyholders can now be guaranteed that the policies are designed with their specific needs accounted for. However, there is more that can be done in the sales of these products to protect consumers. By following the IDD in terms of its momentous provision of the insurance product information document, South Africa can ensure better and more personalised protection for microinsurance consumers. South Africa should provide a similar document for its microinsurance consumers and the PPRs should make mention of taking into account the type of customer purchasing the product.

It is pertinent to remember that not all customers are the same and therefore it is necessary to take different types of customers' needs into account. The South African microinsurance model can only benefit from taking the provisions

17834 of 2005.

of article 20 of the IDD into account when selling microinsurance products. This will ensure a higher level of consumer protection as a whole for consumers which have for the most art been excluded from the insurance industry for all this time.

#### References

#### Articles, Documents and Textbooks

#### Legislation

Financial Advisory and Intermediary Services Act 37 of 2002 Insurance Act 18 of 2017 Insurance Distribution Directive (EU) 2016/97 National Credit Act 34 of 2005 Policyholder Protection Rules 2018

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

## Part III The Interplay Between the Insurance Distribution Directive and Other Regulations/Sciences

## The Interplay Between the GDPR and the IDD

Viktoria Chatzara

#### 1 Introduction

The operation of the European Union insurance industry during the last years has been deeply disrupted by the adoption in 2016 and the entry into force in 2018 of the General Data Protection Regulation (the "GDPR") 1 and the Insurance Distribution Directive (the "IDD"),2 which have caused significant changes to the EU and national markets. In some cases these changes have even affected non-EU market players, as in the case of the GDPR provisions, the scope of which also covers companies established outside the EU, but offering products or services to EU-located individuals or monitoring the behavior of individuals within the EU.3 In other cases the implementation of the new rules has resulted in radical transformations of the insurance market.4

V. Chatzara (\*)

Rokas Law Firm, Athens, Greece e-mail<EMAIL_ADDRESS>
1 Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2 Directive (EU) No. 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast).

3 See in this relevance Article 3(2) of the GDPR, as well as Guidelines 3/2018 on the territorial scope of the GPDR (Article 3)—Version adopted after public consultation by the European Data Protection Board (EDPB) on 12 November 2019, and available at: https://edpb.europa.eu/sites/ edpb/files/files/file1/edpb\_guidelines\_3\_2018\_territorial\_scope\_after\_public\_consultation\_en\_1. pdf.

4 As, for example, in the case of the Greek Law 4583/2018 transposing the IDD, Article 5 par. 7 of which prohibited the cooperation between insurance agents and insurance brokers, thus obliging

P. Marano, K. Noussia (eds.), Insurance Distribution Directive, AIDA Europe Research Series on Insurance Law and Regulation 3, https://doi.org/10.1007/978-3-030-52738-9\_11

#### 1.1 Similar Origins and Parallel Lives

Both the GDPR and the IDD have parallel "life stories", as they both come to respectively replace previously applicable EU laws on data protection (namely the Directive 95/46/EC) and on insurance mediation (namely the Directive 2002/92/ EC), aiming to address any issues that rose from the implementation of the previous laws, and also to modernize the applicable legal framework in the data protection and insurance distribution field.

As a coincidence that added to the regulatory compliance burden of the insurance industry participants that were affected by these new sets of rules, both the GDPR and the IDD were enacted in 2016 (May and January respectively), and became effective in 2018 (May and October5 ). With respect to the GDPR, although it granted the national legislators the possibility to adopt more detailed and/or stricter provisions in relation to certain issues,6 for which it is often mentioned as "hybrid" Regulation, its provisions became directly applicable and enforceable, as provisions of an EU Regulation. On the contrary, in order for IDD to become applicable, the national law measures transposing it into the legal orders of each Member State needed to be enacted.

Root Causes and Aims Both the GDPR and the IDD were adopted by the European Union in the aftermath of the severe financial crisis of 2008, and during the groundbreaking intrusion of technological solutions in the insurance and, generally, the financial services sector. Particularly with respect to the financial sector, legislators and regulators aimed to minimize the possibility for any future systemic risks, increase corporate transparency requirements and strengthen consumer protection.7 In relation to the data protection field, the different implementation of Directive 95/46/EC across the Member States led to inconsistencies that created complexity, legal uncertainty and increased administrative costs,8 and thus the need for reform.

As far as the GDPR is concerned, its enactment and entry into force is considered to be the most significant change in personal data protection law during the last

market players to reform the structure of existing distribution networks that widely consisted up to now of both agents and brokers.

5 According to the provisions of Directive (EU) 2018/411 that transferred the deadline for the national laws transposing the IDD to be enacted to 1 July 2018, and the date since which said national measures had to apply, to 1 October 2018 at the latest.

6 Such as the processing of employees' personal data, the processing of special categories of personal data, any restrictions to the rights granted to data subjects, etc. Such implementing, more detailed provisions, have been adopted, for example in Greece, by virtue of Law 4624/ 2019, which caused the need for further compliance measures to be taken, in order for the data processing operations to be aligned with the national law provisions as well.

7 Emond and Tereza (2019).

8 European Commission – Fact Sheet, Questions and Answers – Data protection reform, 21 December 2015, available at: http://europa.eu/rapid/press-release\_MEMO-15-6385\_el.htm.

20 years,9 updating and modernizing the principles of the 1995 Directive. Taking into account the needs that triggered its enactment the main aims of the GDPR, as declared in its text, are on the one hand the provision of adequate protection to individuals, who are expected to gain more control over their personal data,10 and, on the other hand, the facilitation of businesses with the reduction of the administrative costs.11 At the same time, the GDPR provisions also seem to have taken into consideration the rapid technological developments that have increased the scale of data collection and sharing,12 and that are expected to further take place and add to the challenges of personal data protection. In this regard, personal data protection obligations are being described in the GDPR provisions in such a generic and broad manner (e.g. with the use of general legal terms, such as "appropriate technical and organizational measures", reference to the "state of the art", etc.) that allows their constant adaptation to any further technological advances.

The IDD provisions, on the other hand, were included in the financial services legislative texts that aim at minimizing any future systemic crises from taking place. As such, its main objectives include the minimum harmonization of insurance distribution regulation across the EU, and the enactment of consistent prudential standards and of elevated conduct standards.13 At the same time, the IDD operates as a tool aiming to the enhancement of the EU Single Market in the insurance sector, thus, intending to create a level playing field for all different insurance distribution channels,14 reduce any cross-sectoral differences and improve the competitiveness level of the EU insurance market.15 Further to the above, the IDD provisions also

9 Patel (2017).

10See Recitals No. 10 et. seq. of the GDPR.

11See Recital No. 9 of the GDPR, as well as reference to the benefits of the new provisions in the Communication from the Commission to the European Parliament and the Council, Stronger protection, new opportunities – Commission guidance on the direct application of the General Data Protection Regulation as of 25 May 2018, COM(2018) 43 final, 24 January 2018, available at: https://eur-lex.europa.eu/l egal-content/EN/TXT/?qid ¼1563892565511& uri¼CELEX:52018DC0043. 12Truli (2016).

13PwC, Hot Topic – Insurance Distribution Directive – Are you ready? – Update February 2018, PwC, February 2018, available at: https://www.google.com/url?sa¼t&rct¼j&q¼&esrc¼s& source ¼web&cd ¼15&cad ¼rja&uact ¼8 &

ved¼2ahUKEwjznMqu2MjjAhVQqaQKHWNXCKMQFjAOegQICRAC&url¼https%3A%2F% 2Fwww.pwc.co.uk%2Ffinancial-services%2Fassets%2Fpdf%2Finsurance-distribution-directive-

are-you-ready-january2018.pdf&usg¼AOvVaw0GzYf6-KfmQ38U2v5sovEG. 14In this context, the scope of the IDD not only covers insurance intermediaries, but also insurance undertakings, when engaging in direct sales to customers – see Article 1(2) in conjunction with Article 2(1)(1) of the IDD.

15Deloitte, Insurance Distribution Directive (IDD): the MiFID of insurance, 2017, available at: https://www.google.com/url?sa¼t&rct¼j&q¼&esrc¼s&source¼web&cd¼9 & ved¼2ahUKEwjznMqu2MjjAhVQqaQKHWNXCKMQFjAIegQIARAC&url¼https%3A%2F% 2Fwww2.deloitte.com%2Fcontent%2Fdam%2FDeloitte%2Fgr%2FDocuments%2Ffinancial-ser vices%2Fgr\_insurance%2520distri bution%2520directive\_noexp.pdf& usg¼AOvVaw2KmAlxEQC4lOigxnILyLXk.

intend to improve consumer protection,16 providing for enhanced precontractual information and conflicts of interest obligations.

Law and Regulatory Supplements Apart from the main legal texts of the GDPR and the IDD (and their national harmonizing laws), a series of secondary, implementing hard and soft law texts has been adopted to supplement the data protection and insurance distribution regulatory framework. From a data protection law perspective, several Guidelines on specific issues arising from the GDPR provisions17 had already been adopted by the Working Party of Article 29 (of the Directive 95/46/EC), and have now been endorsed by the newly established European Data Protection Board (EDPB), that continues issuing additional Guidelines, Opinions and other tools concerning the implementation of the GDPR.18 The GDPR provisions are further supplemented by national law provisions regulating more specific issues, as mentioned above, as well as by virtue of regulatory decisions and guidance issued by the competent national Data Protection Authorities, in a way that the affected insurance market participants still need to take into account any national legal and regulatory particularities that may apply to their operations and which are evolving on an ongoing basis.

Similarly with respect to the IDD, the European Commission has issued (on the basis of relevant authorizations provided in the IDD provisions) delegated19 and implementing acts20 which regulate specific issues, e.g. more detailed rules on the Product Oversight and Governance (POG) obligations, a standardized template for the Insurance Product Information Document (IPID), etc. Given that the IDD is a minimum harmonization directive (in the sense that Member States may provide for more stringent obligations on insurance distributors), and that its provisions do not (as a rule) apply directly, but need to be harmonized by virtue of national measures, which are the ones applicable, insurers and intermediaries falling into the scope of the new rules will need to examine what national IDD laws they need to comply with, particularly in case they engage in cross-border activities, given that conduct supervision falls into the ambit of the host regulator's supervision.21 In parallel,

16EIOPA, Annual Report 2016, published on 15 June 2017, available at: https://eiopa.europa.eu/ publications/annual-reports.

17Such as the interpretation and implementation of the transparency notion under the GDPR, the Data Protection Impact Assessment, the Data Protection Officer, the data portability right, etc.

18See a list of the applicable Guidelines endorsed and/or adopted by the EDPB at: https://edpb. europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recommendations-best-practices\_en.

19Available at: https://eur-lex.europa.eu/search.html?DB\_DELEGATED¼32016L0097&qid¼<PHONE_NUMBER>983&DTS\_DOM¼ALL&type¼advanced&lang¼en&SUBDOM\_INIT¼ALL\_

ALL&DTS\_SUBDOM¼ALL\_ALL. 20Available at: https://eur-lex.europa.eu/search.html?qid¼1563887688536&DTS\_DOM¼ALL& type ¼advanced&DB\_IMPLEMENTING¼32016L0097&lang¼en&SUBDOM\_INIT¼ALL\_

ALL&DTS\_SUBDOM¼ALL\_ALL. 21In this sense, an insurance distributor established in Germany, but selling insurance in France, will have to comply (for its France-related operations) with the applicable French IDD provisions, and

EIOPA is also empowered and proceeds with issuing soft law guidelines concerning the implementation of IDD provisions, which should be also taken into account.22 As a result, also with respect to the IDD, market participants need to consider any applicable national law and regulatory derogations, in order to ensure their compliance with the new regime.

#### 1.2 Impact on Insurance Activities

As noted above, both the GDPR and the IDD radically reform the previously applicable data protection and insurance mediation laws, significantly affecting the operations of both insurance undertakings and intermediaries. The transformation projects undertaken by the affected companies in light of the new rules touch upon and affect all functions, departments and activities, from the ones concerning the relations with customers, business partners and other third-parties, to the ones pertaining exclusively to internal organizational and operational issues.

Internal Effects From an internal aspect, insurers have been required to amend any existing or to adopt new policies and procedures regulating their data collection and processing activities, to identify and implement the appropriate legal bases for each processing activity, to incorporate the privacy by design and by default notions in the procedures and guidelines they follow when designing new activities, to appoint a Data Protection Officer, to conduct data protection impact assessments (when required under the applicable provisions), and to amend their privacy notices and related documentation to customers according to the new information obligations.23 At the same time, the IDD and its national transposing measures have obliged the affected parties to draft and adopt additional policies and procedures (e.g. POG policies, insurance distribution policies, etc.), to appoint responsible key persons for the insurance distribution activities, and even to proceed with the certification of such key persons and other involved employees.24

with the German IDD provisions with respect to any products it sells in Germany—see in this regard also PwC, Hot Topic – Insurance Distribution Directive – Are you ready? – Update February 2018, as above.

22See in this relevance: https://eiopa.europa.eu/consumer-protection/insurance-distributiondirective.

23See Patel (2017).

24For example in Greece, under the previously applicable law, the employees of insurance undertakings did not need to be certified as to their professional knowledge. According to the Greek law transposing the IDD, the insurance undertaking's employees that are directly involved in the insurance distribution activities, as well as the persons assigned with the responsibility for such activities, have now been required to take exams organized by the Bank of Greece (the Greek Regulatory Authority) and have their professional knowledge and experience certified.

Impact on External Relations With respect to any external relations, insurers have been required to re-evaluate the consent declarations they had been using, and even to request that their customers would grant them anew any necessary consents (or to identify a different, more appropriate legal basis for the processing of personal data). The relations between insurers and intermediaries have also been scrutinized from a data protection law perspective, causing some times debates between the parties, as it was necessary to determine whether they constitute controller-to-processor or controller-to-controller relations, in order to further assess what, if any, GDPR compliance measures needed to be taken.25 The IDD provisions similarly impact on almost all external relations in the context of the insurance business: depending on the exact national law requirements, any cooperation agreements between insurers and intermediaries need to be reexamined and duly amended, to reflect any obligations arising for each party from the new rules. With respect to the distributor-customer relation, the IDD elevates the customer's best interest as an overarching principle, in the sense that the interests of the customers are required to be taken into account precontractually, as customers need to be proposed insurance products which are suitable and appropriate for them at the time of purchase, but also throughout the life cycle of a product.26 In this relevance, insurance distributors are required to prepare appropriate procedures and documentation, to be able to proceed with the specification of the customer's demands and needs, to provide advice concerning an insurance product,27 and to explain the link between the proposed product and the customer's demands and needs.28

Compliance Projects It derives from the above that the entry into force of the GDPR and the IDD regulatory frameworks has caused insurers and intermediaries to engage in long, time-consuming and burdensome compliance projects, which have even gone as far as to completely restructure their operations. Although relating to different policy and law sectors, the GDPR and IDD sets of rules affect each other, and compliance with both these frameworks is intrinsically interconnected: to advise a customer on an insurance product according to the IDD, data collection and

25KPMG, The GDPR and key challenges faced by the Insurance industry, February 2018, available at: https://www.google.com/url?sa¼t&rct¼j&q¼&esrc¼s&source¼web&cd¼1&cad¼rja& uact¼8&ved¼2ahUKEwjMg4fw\_cjjAhUQKlAKHYK3AHsQFjAAegQIBBAC&url¼https%3A %2F%2Fassets.kpmg%2Fcontent%2Fdam%2Fkpmg%2Fie%2Fpdf%2F2018%2F03%2Fie-gdprfor-insurance-industry.pdf&usg¼AOvVaw0bmREPmoGtekQSR5\_7t2gz. 26Bernardino (2016).

27Particularly in cases where national laws on IDD render obligatory the provision of advice, in the sense of a personalized recommendation.

28Caroline Veris and Patricia Goddet – Deloitte, Insurance Distribution Directive – 2018: a challenging year for the European insurance sector, Performance magazine issue 25, available at: https://www.google.com/url?sa¼t&rct¼j&q¼&esrc¼s&source¼web&cd¼1&cad¼rja& uact¼8&ved¼2ahUKEwjBq6mxvcvjAhVbURUIHfeZBXcQFjAAegQIAhAC&url¼https%3A% 2F%2Fwww2.deloitte.com%2Fcontent%2Fdam%2FDeloitte%2Flu%2FDocuments%2Ffinancialservices%2FInsurance%2Flu-insurance-distribution-directive-2018-challenging-year-europeaninsurance-sector-012018.pdf&usg¼AOvVaw3gvYcV6eDFpDwSB2\_x-B7j.

processing needs to take place, thus the relevant procedure needs to take into account the GDPR requirements. The same applies in other aspects as well. Considering that data collection and processing is crucial for the insurance business, in the context of numerous operations ranging from risk assessment and premium calculation to claims payment,29 it is self-evident that any IDD-related compliance actions need to be designed bearing in mind the GDPR requirements and the relevant compliance actions already undertaken.

Such interplay becomes even more evident and the parallel compliance with both frameworks imperative with the expansion of insurance technology (InsurTech) solutions: the use of InsurTech and, particularly, of Internet of Things (IoT) applications in the insurance industry expands and covers all areas from risk assessment to policy and premium re-evaluation and to claims evaluation, and results in an exponential increase of the volume of personal data collected and processed by insurers. In this regard, InsurTech applications need to be designed in a way that safeguards compliance with the applicable data protection principles and requirements in general, but also ensures that any IDD-related requirements (such as the obligation to act in the customer's best interest) are also respected.

This chapter does not aim to exhaustively track down all the possible aspects and cases where GDPR and IDD rules interact, or to propose adequate solutions in the questions which such interaction may pose. Its aim is to highlight some characteristic examples of functions and procedures where such interplay is evident, and lay down some initial thoughts concerning the particular aspects of such interaction that arise and must be taken into account.

#### 2 GDPR and IDD Interaction Affecting Internal Functions

The new data protection and insurance distribution regulatory frameworks establish new, enhanced obligations on the insurers and intermediaries falling into their scope. These cause them to undertake remedial measures affecting first of all their internal organization and operations. The new sets of rules have caused the radical amendment of their internal policies and procedures or the adoption of new ones, the creation of new internal positions and, in general, have added up to the already heavy internal governance obligations that were imposed on the affected parties, particularly on insurers by virtue of the Solvency II regime.

In this relevance, and considering that data collection and processing has always been at the core of the insurance business, any remedial measures aiming to ensure compliance with the IDD provisions shall be also examined as to whether they

29Insurance Europe, GDPR is around the corner: time for final checks by insurers – An overview of insurers' obligations under the General Data Protection Regulation, May 2018, available at: https://www.insuranceeurope.eu/sites/default/files/attachments/GDPR%20is%20around%20the% 20corner.pdf.

encompass personal data processing, in which case, they should be designed and implemented bearing also in mind the applicable GDPR provisions and obligations. All the more so, to the extent that the use of InsurTech solutions that lead to increased volumes of data input to insurers and more direct and frequent insurercustomer interaction and data transmission is integrated in the newly developed functions. At the same time, any GDPR-related compliance measures need to be drafted taking account of the particularities stemming from the nature of the relevant insurance business.

#### 2.1 Product Oversight and Governance Requirements for Manufacturers

One of the characteristic—if not the most characteristic—examples of internal organization obligations described in the IDD30 and its implementing provisions,31 with significant interaction with the GDPR-related obligations, are the newly established Product Oversight and Governance (POG) obligations for insurance undertakings and insurance distributors.32 POG requirements constitute one of the most important novelties in the EU insurance distribution regulation enacted by virtue of the IDD, aligning in this respect insurance regulation with the respective provisions already applicable in other financial services sectors.33 POG arrangements are considered to be part of the company's system of governance (though not being considered as constituting a new key function for insurers34), comprising of internal processes, functions and strategies aiming to ensure a correct design of insurance products, thus intrinsically linked with the Solvency II corporate governance framework and filling a gap thereof from a customer protection point of view.35

30Article 25 of the IDD.

31Namely the provisions of the Commission Delegated Regulation (EU) 2017/2358 of 21 September 2017 supplementing Directive (EU) 2016/97 of the European Parliament and of the Council with regard to product oversight and governance requirements for insurance undertakings and insurance distributors (the "POG Regulation").

32The discussion around the GDPR and the POG-related obligations and their interplay concerns cases where POG-related activities and procedures entail the collection and processing of personal data, and not exclusively of statistical and/or fully anonymized data.

33Thus constituting a good example of the so-called "Mifidization" of the insurance regulation, as POG requirements were first included in the MiFID II text. See in this respect Prof. Pierpaolo Marano, The "Mifidization": The Sunset of Life Insurance in the EU Regulation on Insurance?, Liber Amicorum for Professor Ioannis Rokas, 2017.

34EIOPA, Preparatory Guidelines on product oversight and governance arrangements by insurance undertakings and insurance distributors, EIOPA-BoS-16-071, 18 March 2016, available at: https://eiopa.europa.eu/Pages/Guidelines/Preparatory-Guidelines-on-product-oversight-and-gover nance-arrangements-by-insurance-undertakings-and-insurance-distributor.aspx.

35EIOPA's Preparatory Guidelines on POG, as above.

As described in the applicable provisions, the POG requirements aim to ensure effective customer protection, a level playing field for all market operators, equal conditions of competition and an appropriate standard of consumer protection,36 in line with the general EU insurance regulation objectives of protection of policyholders and beneficiaries.37 In this regard, the intended outcome of effective POG requirements is the correct identification of the target market for each insurance product, as well as the design of more targeted insurance products, better suited for the insurance demands and needs of the respective target market. The design and adaptation, however, of insurance products to their target market, as well as the effective monitoring of insurance products throughout their life span, requires the collection and processing of significant volumes of data, including personal data. Said activities, in their turn, fall directly into the scope of the GDPR, which evidences the interdependence between these two sets of rules.

#### 2.1.1 Product Approval Process

The core POG-related obligations on insurers and intermediaries qualifying as manufacturers of insurance products38 consist in that said manufacturers shall adopt, implement and review an appropriate "Product Approval Process" regulating the development and distribution of new products and significant adaptations to existing insurance products. Such Product Approval Process shall be designed having in mind the principle of proportionality, in the sense that it shall be relatively simple for straightforward and non-complex products, and more complex in case of more sophisticated products that may entail higher risk for the customers.39

The main elements that should be included in a Product Approval Process can be summarized in the definition of: (a) the "insurance product" or the "material change" to an insurance product, (b) the methods used to identify the target market for the insurance product and the risks relevant to said target market, (c) the methods used to determine the appropriate distribution strategy and the information to be provided to the distributors, (d) the methods used to ensure that the insurance product is distributed to the identified target market, and (e) how the insurance product will be monitored and reviewed.40

36Recital (1) of the POG Regulation.

37Recital (16) of the Solvency II Directive (Directive 2009/138/EC).

38According to Article 3(1) of the POG Regulation, insurance intermediaries are considered to be manufacturers "where an overall analysis of their activity shows that they have a decision-making role in designing and developing an insurance product for the market", while under par. 2 of the same Article, such decision-making role is deemed to exist if the intermediary autonomously determines the essential features and main elements of an insurance product (e.g. coverage, price, costs, risk, target market, etc.), which are not substantially modified by the insurer providing coverage for the insurance product.

39Recital (2) of the POG Regulation.

40BaFin, Product approval process: Requirements for product manufacturers and distributors, 02.03.2018, available at: https://www.bafin.de/dok/10523912.

Target Market Identification The identification of the appropriate target market and of the demands and needs thereof in the context of the Product Approval Process requires the collection and processing of significant data volumes by manufacturers (Big Data), including personal data. Target markets shall be identified at a sufficiently granular level depending on the characteristics and risk profile of their members, as well as on the complexity and nature of the respective insurance product.41

A strong trend in the insurance sector towards increasingly data-driven business models, in the context of which traditional data sources (e.g. demographic data, exposure data) are being combined with new sources like IoT-deriving data, online media data, etc., is being documented,42 and is expected to impact on the insurance product design procedures and result in better segmentation of the different target markets. Insurers are seen to be taking advantage of the technological advances in order to address any asymmetric information phenomena they have been facing until recently, due to which they were not able to offer insurance products reflecting accurately the risk profile of their customers.43,44

In this relevance, Product Approval Processes are expected to further incorporate in the product design functions the use of new and innovative data sources and Big Data Analytics (BDA) tools, aiming to better understand the customers' needs and characteristics, define further segmented target markets, develop more tailored products and services, and proceed with more accurate risk assessments. The impact of advanced BDA tools has already been evident in this regard, with the appearance and continuous development of usage-based insurance products, particularly in motor and health insurance.45

Product Testing At the same time, in the course of the Product Approval Process, and before proceeding with distributing a new insurance product, manufacturers shall test their insurance products appropriately, including scenario analysis, in order

41Filip Oller, KPMG Luxembourg, Product Oversight and governance requirements under IDD, 24 October 2017, available at: https://blog.kpmg.lu/product-oversight-and-governance-require ments-under-idd/.

42EIOPA, Big Data Analytics in Motor and Health Insurance: A Thematic Review, 2019, available at: https://eiopa.europa.eu/Pages/News/EIOPA-reviews-the-use-of-Big-Data-Analytics-in-motorand-health-insurance.aspx.

43Porrini (2017).

44For example EIOPA stated that, in case of motor liability insurance products, which are mandatory for consumers and which may limit product differentiation, require less granularity and detail in terms of the identified target market, while in the case of insurance-based investment products (IBIPs), which are more complex, the identification and description of the appropriate target market should be more detailed.

45In this context, and with the integration of IoT tools into the insurance value chain, the process is leading to the identification of insurance demands and needs on a completely individual basis in relation to each customer, and to the design of completely personalized insurance products.

to assess whether the product meets the identified needs, objectives and characteristics of the target market throughout its lifetime. Such product testing operations may need to go, depending on the nature and the characteristics of the product tested, up to the point of testing the product on a pilot group, to examine whether it meets the expectations of the target customers or not,46 in which case personal data will once again be collected and processed.

#### 2.1.2 Product Monitoring Phase

Apart from the obligations related exclusively to the design phase of an insurance product, the Product Approval Process shall also provide for and regulate the continuous and regular monitoring of a product launched in the market, with the aim to ensure that it continues meeting the intended customers' demands and needs, and that it does not cause any adverse effects to the customers. In this regard manufacturers shall proceed with regular reviews of the products and identify any factors that may significantly alter the demands and needs or the characteristics of the identified target market, or the main features, the coverage and the guarantees of the insurance product.47 In the same context, manufacturers shall document and take account of any circumstances that may adversely affect the customers of an insurance product, and proceed with taking appropriate measures to mitigate such adverse effects, informing at the same time the customers and the distributors of such remedial measures.48

All the above mentioned monitoring and review actions that take place in the after-sales service phase, and with a view to being efficient and to truly add to customer protection, as is the aim of the POG obligations, require further collection and processing of personal data determining the exact circumstances that may materially affect the characteristics of the insurance product or the target market, or that may cause adverse effects to the customers. In order to further assist in the collection and evaluation of such data, insurers have also introduced technological tools in the post-sales service and assistance sectors, such as automated answers in their call centers, robotized customer service evaluation, to generate insights about complaint management, fraud detection and customer authentication issues.49

46EIOPA, First set of Questions & Answers on the Application of the Insurance Distribution Directive, 11.07.2018, available at: https://eiopa.europa.eu/Pages/News/EIOPA-publishes-firstset-of-Questions%2D%2DAnswers-on-the-Application-of-the-Insurance-Distribution-Directive. aspx.

47Article 7(1) of the POG Regulation.

48Article 7(3) of the POG Regulation.

49EIOPA, Big Data Analytics in Motor and Health Insurance: A Thematic Review, as above.

#### 2.2 Product Distribution Arrangements

POG provisions impose further obligations on both manufacturers and distributors concerning the distribution of insurance products. The measures to be taken to ensure compliance with said obligations similarly entail data processing issues, in a way that the design and implementation of POG compliance measures needs to take into account any applicable GDPR-related aspects so as to ensure compliance with the respective data protection obligations as well.

#### 2.2.1 Choice and Audit of Appropriate Distribution Channels

The identification of the target market by manufacturers under the Product Approval Process impacts upon the choice of the distribution channels to be used, as they must be appropriate for said target market.50 The choice of appropriate distribution channels may also entail data collection and processing activities on behalf of the manufacturer, particularly in the event that the affected distributors are individuals, and to the extent that the choice of appropriate distributors is deemed to require the processing of information on the key persons being responsible for the insurance distribution activities.

In the same context, manufacturers provide the distributors with information on their Product Approval Process and the objectives thereof, and ensure that their products are being distributed in accordance with said Process, namely, in accordance with the identification of the target market for each product, i.e. whether the insurance products are being distributed on said target market.51 Nevertheless, this obligation does not automatically result in a strict prohibition to distributors to sell an insurance product outside the target market, neither does it oblige manufacturers to take any measures against distributors proceeding with such sales, in any case. On the contrary, according to EIOPA's guidance, in cases of distribution outside the target market, manufacturers need to assess whether there are any adverse consequences for the customers outside the target market, who were provided with the product and take corrective measures, in case of such adverse effects, in order to mitigate them.52 Such assessment, however, evidently entails personal data collection and processing activities, aiming to assess the possibility for any adverse effects on the specific customers.

50Article 8(1) of the POG Regulation.

51Article 8(3) of the POG Regulation.

52EIOPA, First set of Questions & Answers on the Application of the Insurance Distribution Directive, as above.

#### 2.2.2 Product Distribution Arrangements

In terms of distributors, the POG Regulation provides that they shall also have in place specific product distribution arrangements with the aim to ensure that they obtain from the product manufacturer all information required on the specific features of the insurance product and the identified target market, aiming to prevent and mitigate customer detriment, support a proper management of conflicts of interest and ensure that the objectives, interests and characteristics of customers are duly taken into account.53 Furthermore, insurance distributors are required to ensure that the distribution strategies they follow are in line with the distribution strategies and target markets identified by the product manufacturer.

For these objectives to be achieved, insurance distributors will need to collect and process customers' personal data so that they assess whether any conflicts of interest may arise, and to evaluate the customers' characteristics, demands and needs, so that they assess whether each customer falls into the relevant target market, and propose appropriate insurance products. The volume of personal data collected in this context increases exponentially with the use of new technologies (IoT, connected devices), that are being more and more included in the design of new distribution strategies and methods. As such, product distribution arrangements need to be drafted and designed in a way that takes into account the necessary data processing activities for their efficient implementation, as well as any related GDPR (and other data protection) obligations.

Reporting to the Manufacturer The obligations which IDD and its implementing POG Regulation pose on distributors extend throughout the life span of the insurance product. Distributors shall monitor and notify the manufacturer of any indication that the insurance product is not in line with the target market's demands and needs, or in any event that they become aware of any circumstances that may adversely affect the customers.54 For distributors to fully comply with these obligations, they shall monitor the performance of the insurance products they distribute during their whole term, by maintaining contact with the relevant customers, and by collecting and processing adequate and appropriate data, that will allow them to duly evaluate the product's performance and conformity with the insurance demands and needs of the identified target market. Should such alignment not occur or cease, distributors will also have to transfer the relevant data to product manufacturers, in order for appropriate measures to be taken. Similar data transfers will have to take place in case of adverse effects caused by or due to product characteristics to the customers.

All the above, indicatively stated, personal data collection and processing activities will have to be duly designed in the product distribution arrangements adopted by insurance distributors, in a way that takes into consideration the GDPR-deriving

53Article 10(1) and (2) of the POG Regulation.

54Article 11 of the POG Regulation.

data protection obligations. More to that, the issue of the legal capacity under the GDPR, in which insurance distributors act when processing such personal data and transferring them to the product manufacturers, should be also examined, as further data protection implications may arise, that may even affect the form of the cooperation between the distributors and the manufacturers.

#### 2.3 Related Data Protection Issues

As derives from the above brief analysis, compliance with the POG and product distribution obligations requires the design, adoption and implementation of a series of internal policies, procedures and activities that encompass personal data collection and processing and, as such, fall into the scope of the GDPR provisions. In this respect, the design of any appropriate IDD compliance measures should not take place without also taking into account any relevant GDPR implications, and without ensuring compliance with the new data protection framework as well.

#### 2.3.1 Privacy by Design and by Default

A key element of the GDPR's risk-based approach and its focus on the accountability principle55 is the adopted legal obligation for data controllers56 to put in place appropriate technical and organizational measures designed to implement data protection principles, both at the time of the determination of the means for processing and at the time of the processing itself (privacy by design), and for ensuring that, by default, only personal data which are necessary for each specific processing purpose are being processed (privacy by default).57 The notion of privacy by design, as the idea of integrating data protection principles at the design of any system, service, product or process, and throughout their lifecycle, is not a new one, as the need to be proactive in considering any privacy requirements has been acknowledged long before the GDPR.58 Nevertheless, it was by virtue of the

55In the sense that data controllers must ensure and be able to demonstrate compliance with the GDPR provisions.

56I.e. of the persons that, alone or jointly with others, determine the purposes and means of the processing of personal data—see Article 4(7) of the GDPR.

57Article 25 of the GDPR.

58The term "privacy by design" was originally used by Ann Cavoukian, the Information and Privacy Commissioner in Ontario, Canada, and was broken down in the so-called "seven foundational principles": 1. Proactive not Reactive, Preventative not Remedial; 2. Privacy as the Default Setting; 3. Privacy Embedded into Design; 4. Full functionality—positive sum, not zero sum; 5. End-to-end security—full lifecycle protection; 6. Visibility and transparency—keep it open; 7. Respect for user privacy—keep it user-centric. See in this respect: https://www.ipc.on.ca/wpcontent/uploads/2018/01/pbd.pdf.

GDPR provisions that the privacy by design notion transformed from a "best practice" (as it was considered under the previous regime) to a legal obligation.

General Principles and Guidelines As a legal obligation, the privacy by design and by default notions shall be embedded in the design of all activities that may entail personal data processing operations, including in the design of the Product Approval Processes and the product distribution arrangements of manufacturers and distributors respectively (POG-related obligations, policies and procedures in general), taking into account the nature, scope, context, purposes and complexity of the relevant activities, the state of the art and costs of implementation of any measures, and the risks that the processing operations may cause to individuals. Data controllers shall implement appropriate technical and organizational measures and necessary safeguards, designed to implement the applicable data protection principles in an effective manner and to protect the rights and freedoms of data subjects.59

In practice, compliance with the privacy by design and by default principles could be achieved by ensuring that data protection outcomes are achieved, when drafting the POG-related policies and procedures, such as60:

59See Guidelines 4/2019 on Article 25, "Data Protection by Design and by Default" of the European Data Protection Board, adopted on 13 November 2019—Version for public consultation, available at: https://edpb.europa.eu/sites/edpb/files/consultation/edpb\_guidelines\_201904\_dataprotection\_ by\_design\_and\_by\_default.pdf. To be noted that the final relevant guidance of the EDPB on the privacy by design and by default notions, along with practical guidelines for their effective implementation, after the public consultation, was not made publicly available by March 2020.

60Information Commissioner's Office, Guide to the General Data Protection Regulation (GDPR) – Accountability and Governance – Data Protection by design and by default, 22.05.2019, available at: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protec tion-regulation-gdpr/accountability-and-governance/data-protection-by-design-and-default/.

61For instance, distributors, when designing the procedures for reporting any adverse circumstances to product manufacturers, shall ensure that only the personal data relating to and adequately describing such adverse circumstances will be transferred to the product manufacturers.

• Providing customers/data subjects with appropriate tools, so that they can determine whether their personal data are being properly processed.

As a result, apart from ensuring that the minimum requirements set by the IDD and the POG Regulation are met, insurers and intermediaries shall also ensure that any data processing operations are also taking place in the context of a design process integrating data protection principles in both the design and operational phase thereof. Furthermore, measures to mitigate any risks to the affected individuals, taking into account the state of the art and the cost of implementation, shall be also selected and implemented throughout the POG arrangements; such measures shall be appropriate and effective, in the sense that they must assist the data controller in ensuring and being able to demonstrate compliance with the GDPR. Equally important, the appropriate data protection safeguards shall be implemented into the processing activities described in the applicable POG arrangements.62

Manufacturer—Distributor Relations Taking into account that the privacy by design and by default obligations refer to data controllers, the issue of whether an insurance distributor qualifies as an individual (or joint) data controller or as a data processor acting on behalf of the manufacturer-data controller, and to what extent, becomes of importance even at the stage of designing appropriate and adequate product distribution arrangements. Should the insurance distributor be characterized as a data controller, the case is quite simple as it will bear complete responsibility in embedding privacy by design and by default into its product distribution arrangements. The issue, however, becomes a bit more complicated, in case the distributor is considered to be joint controller with the manufacturer, in the sense that they jointly determine the means and purposes for the processing activities in the context of the product distribution. In this case their cooperation agreement should also contain a specific description of the roles and responsibilities undertaken by each of them in terms of the data protection obligations and, namely, the ones stemming from the rights granted to data subjects by the GDPR, and the ones concerning the provision of appropriate information to them.63 More to that, the possibility for the distributor to be considered to act as data processor64 on behalf of the manufacturer (who is acting as the data controller), should also not be precluded, particularly in cases where the distributor does not have any discretionary powers and exclusively follows the guidelines and mandates of the manufacturer when it comes to product distribution activities. In such case, would the distributor as a data processor not have to comply with the privacy by design and by default obligations when designing its product distribution arrangements? Or would the manufacturers, as data controllers,

62European Data Protection Supervisor (EDPS), Opinion 5/2018 – Preliminary Opinion on privacy by design, 31 May 2018, available at: https://edps.europa.eu/data-protection/our-work/publications/ opinions/privacy-design\_en.

63Article 26 of the GDPR.

64I.e. as the person which processes personal data on behalf of the data controller—see Article 4 (8) of the GDPR.

have to ensure that the distributors-data processors they choose to cooperate with design and operate their processes in a way that safeguards personal data protection, thus indirectly obliging distributors to endorse privacy by design and by default principles in any case whatsoever? What additional provisions and safeguards would have to be included in the cooperation agreement between the manufacturer and the distributor, in order to duly reflect such controller-processor relation65?

In the same context, issues concerning the privacy requirements implemented by each one of the parties involved and, particularly, any inconsistencies between the different privacy arrangements, should be also identified and addressed, in a way that the different privacy settings are duly respected by all parties, particularly in cases involving BDA. The solution of "automated policy definition and enforcement", in a way that one party cannot refuse to follow the policy of another party in the same chain, could be examined in this direction.66

Third Party Providers Rapid technological advancements and the increasing penetration of InsurTech solutions throughout the insurance value chain impacts the product design phase as well. Product approval and monitoring processes quickly incorporate InsurTech tools, aiming to collect through them the adequate and appropriate data needed to achieve their goals. Although many insurers directly invest in technological research and innovation, others cooperate with InsurTech providers in order to purchase or obtain rights to use appropriate tools. Even in this case, and though InsurTech providers would not directly be seen as falling into the scope of the obligation to abide with privacy by design and by default principles, they would have to (and insurers and intermediaries cooperating with them should examine whether they do) design their products in a way that enables data controllers to implement all necessary measures to ensure data protection.67

Privacy-Enhancing Technologies In the same relevance, and as a means to assist them in ensuring the integration of data protection principles into their product approval and distribution arrangements, manufacturers and distributors should consider using privacy-enhancing technologies (PETs), i.e. technologies that embody fundamental data protection principles, by minimizing personal data use,

65Particularly in light of Article 28 of the GDPR regulating the controller-processor relationship, and par. (3) thereof, providing for the minimum contractual provisions that shall be included in the agreement or other legally binding document to be executed between them.

66ENISA, Privacy by design in big data – An overview of privacy enhancing technologies in the era of big data analytics, December 2015, available at: https://www.enisa.europa.eu/publications/bigdata-protection.

67EDPS, Opinion 5/2018 – Preliminary Opinion on privacy by design, as above. See also in this relevance Recital 78 of the GDPR, stating that: "When developing, designing, selecting and using applications, services and products that are based on the processing of personal data or process personal data to fulfil their task, producers of the products, services and applications should be encouraged to take into account the right to data protection when developing and designing such products, services and applications and, with due regard to the state of the art, to make sure that controllers and processors are able to fulfil their data protection obligations ...".

maximizing data security, and empowering individuals.68 Despite the fact that they have not yet become a standard and widely-used component in system design, PETs such as encryption, protocols for anonymous communications, attribute-based credentials, etc.,69 could be incorporated into the product approval and distribution policies designed and implemented in light of the new IDD obligations, ensuring at the same time compliance with the applicable GDPR provisions.

Privacy by Design in Big Data Analytics Product design and monitoring processes in large scale are expected to require the collection and use of big data by product manufacturers, thus giving rise to increased privacy concerns. As a result, increased privacy by design arrangements will need to be integrated in the design and implementation of the relevant product approval and distribution procedures. In this relevance, the notion of "selectiveness" could assist in ensuring GDPR compliance: its accurate implementation would ensure that only the information that is actually needed for a specific analysis is securely being accessed and processed (instead of collecting all possible data to feed the analysis).70

Privacy by Default In the same time, the privacy by default notion, as elaborated in the relevant GDPR provisions, is intrinsically linked with the data minimization and the purpose limitation principles,71 according to which data controllers shall ensure that they process only the personal data required for the specific processing purpose, and that they do not proceed with any further processing of the personal data for purposes other than the specific, legitimate ones they collected the personal data for (which shall be further notified to the data subjects concerned). In this sense, and in order to comply with both the privacy by default obligations, and the obligations to abide by the general processing principles of the GDPR, POG-related arrangements encompassing personal data processing shall be designed in a way that personal data processing is limited to the personal data that are necessary for the correct and sufficiently granular identification of the target market, for the adequate monitoring of the insurance product's performance, and for no further processing purposes (such as, for example evaluation of a customer's behavior).

68See ICO's GDPR guidance on privacy by design and by default, as above. ENISA refers to PETS as "software and hardware solutions, i.e. systems encompassing technical processes, methods or knowledge to achieve specific privacy or data protection functionality or to protect against risks of privacy of an individual or a group of natural persons"—see also in this respect: https://www. enisa.europa.eu/publications/big-data-protection.

69ENISA, Privacy and Data Protection by Design – from policy to engineering, December 2014, available at: https://www.enisa.europa.eu/publications/privacy-and-data-protection-by-design.

70ENISA, Privacy by design in big data – An overview of privacy enhancing technologies in the era of big data analytics, as above.

71As provided in Article 5(1) of the GDPR.

#### 2.3.2 Transparency and Information Issues

Another set of major issues arising from the GDPR provisions and concerning the collection and use of personal data in the course of the implementation of POG-related arrangements, refers to the obligations of data controllers to duly inform the affected individuals of the processing their personal data undergo, in line with the general principle of transparency of the data processing activities.72 Transparency constitutes an overarching principle in the GDPR constellation,73 applying irrespectively of the legal basis applicable and throughout the processing activities, to three central areas:

Transparency Concerns in POG Arrangements Personal data processing in the context of product design and product monitoring and evaluation activities, particularly in the cases involving massive data collection through connected devices, or big data analytics, could raise transparency concerns. Traditional notice mechanisms, such as simple privacy notices, written forms, etc., are considered to be inadequate to provide proper transparency and control over the personal data processing activities.75 Particularly in the case of BDA tools being employed, the transparency concerns are more elevated, as many firms encounter difficulties in

72As provided in Article 5(1)(a) of the GDPR.

73Although not defined in the GDPR provisions, the notion of transparency is described in Recital 39 of the GDPR, according to which: "It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain information and communication of personal data concerning them which are being processed ...".

74Working Party 29, Guidelines on transparency under Regulation 2016/679, 17/EN, WP260 rev.01, adopted on 29 November 2017 and last revised and adopted on 11 April 2018, as endorsed by the EDPB, available at: https://edpb.europa.eu/our-work-tools/general-guidance/gdpr-guide lines-recommendations-best-practices\_en.

75ENISA, Privacy by design in big data – An overview of privacy enhancing technologies in the era of big data analytics, as above.

adequately and properly explaining some complex data processing tools and procedures.76

POG arrangements shall be designed so as to ensure that affected data subjects are provided with the appropriate information on the processing of their personal data,77 in a way that complies with the transparency requirements.78 Namely, any information solutions to be adopted, shall ensure that the information or communication to the data subjects must be concise, transparent, intelligible and easily accessible, using clear and plain language, must be in writing or by other means, including (where appropriate) by electronic means or even orally where requested by the data subject, and generally free of charge. It is crucial, when designing the way of providing the required information, that it is clearly differentiated from any non-privacy related information (such as other precontractual information to be provided under the IDD provisions), and that the necessary information is provided in a way that prevents information fatigue of the individuals. Data subjects must be able to duly determine in advance the scope and the possible repercussions of their personal data processing activities, in a way that they are not surprised at a subsequent stage. However, given that the GDPR increased information obligations add to the existing obligations to provide precontractual information to the customers that derive from the applicable insurance regulation (e.g. the load of information prescribed by the IDD and the Solvency II Directive), the problem of providing overwhelming information to the customers arises, which, in its turn, may lead to opposite results than the intended customer-data subject protection.79

Information Obligations In this relevance, insurers and intermediaries are ultimately obliged to think out of the box and manufacture alternative methods and means of providing the required information to the customers. The use of InsurTech solutions throughout the insurance value chain, which grants insurance market players the possibility to develop a direct and continuous relation and communication with their customers could be also employed in order to address any transparency concerns that may arise from encompassing data processing operations into the product design and monitoring procedures to be implemented.

GDPR provisions already grant data controllers the discretion to provide the required information via electronic tools, where appropriate (which could be the case, for example, where customers agree to connect with their insurer by means of connected devices). In such cases, the transparency goals could be achieved by employing not (or not only) plain textual communications, which do not seem to

76EIOPA, Big Data Analytics in Motor and Health Insurance: A Thematic Review, as above.

77As set out in Articles 13 and 14 of the GDPR (depending on whether the personal data are being collected directly from the data subjects or from other sources).

78A description of the transparency requirements, in the form of the general rules applying to any information and/or communications to the data subjects, is provided in Article 12 of the GDPR. 79Tarasiuk (2019).

adequately and efficiently address the evolution of services,80 but also by incorporating into the design of the product offering and monitoring phases layered approaches (which can provide information to the users at different stages of the processing and at different levels of detail), maybe even in combination with standardized icons, pictograms and other visualization tools, which are provided for in the GDPR, where appropriate.81 In this regard, the integration of technological advances into the adopted POG-related arrangements, should not only aim at increasing the amount and frequency of data input from the customers, but should also be employed in a way that assists in achieving compliance with the GDPR transparency obligations.

#### 2.3.3 Other Privacy-Related Implications

The extensive collection and use of personal data for the purposes of efficient POG arrangements in line with the relevant IDD provisions enhances already existing or triggers new GDPR-related obligations.

Data Protection Impact Assessment According to the GDPR, a Data Protection Impact Assessment (DPIA) is a process designed to describe the processing activity, assess the necessity and proportionality of said processing activity, identify the risks to the rights and freedoms of the affected individuals, and assist in defining the appropriate measures to mitigate said risks. In this relevance, DPIAs are considered to be tools assisting the data controllers with their accountability obligations, as they not only help them comply with their GDPR obligations, but also to demonstrate and prove compliance at any point.82 As described in the GDPR provisions, a DPIA is mandatory only in cases the contemplated processing activity is likely to result in a high risk to the rights and freedoms of natural persons,83 particularly when new data processing technologies are employed, and, in any case, in the processing operations the national Data Protection Authorities have included in their lists of processing activities requiring the conduct of DPIAs.

In the case of data processing operations taking place in the course of product design and monitoring activities, they would most likely be considered as triggering the obligation for a DPIA, particularly in case of systematic and extensive evaluation

80Indicatively, it was shown that, in order for an average user to read the privacy policies for all visited web services, he/she would need to spend approximately 30 working days per year. See ENISA, Privacy by design in big data – An overview of privacy enhancing technologies in the era of big data analytics, as above.

81Working Party 29, Guidelines on transparency under Regulation 2016/679, as above.

82Working Party 29, Guidelines on Data Protection Impact Assessment (DPIA) and determine whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679, adopted on 4 April 2017, 17/EN, WP 248, and endorsed by the EDPB, available at: https://edpb. europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recommendations-best-practices\_en.

83Article 35(1) of the GDPR.

of personal data including automated decision-making processes, large scale processing of special categories of data or even of simple personal data, matching or combination of different datasets, innovative use of technological solutions, or in case the data processing may prevent the data subjects from exercising their rights or using a service/contract.84 As a result, the design of the product approval process and the product distribution arrangements, shall be accompanied by a Data Protection Impact Assessment, in accordance with the relevant GDPR provisions and guidance, including at least the following information concerning the relevant data processing activities:

Depending on the data activities envisaged in the course of the product approval, distribution and monitoring arrangements, and on the severity of the risks to the data subjects that may arise thereof, the risk mitigating measures may not be considered to sufficiently reduce the potential risks from the envisaged processing activities. In such case, manufacturers or distributors (as the case may be) will have to consult with the competent Data Protection Authority before launching the contemplated data processing activities, which may even conclude that said processing activities shall not take place at all.85

Further to the above, if the product design, distribution and monitoring activities deem to require a DPIA, such Assessment shall take place primarily at the design stage of such processes. However, the DPIA, as well as the compliance with all GDPR obligations, is not prescribed as an one-off exercise, but rather as a

84These data processing activities are included in the indicative examples of operations that trigger the obligation for a DPIA according to Article 35(3) of the GDPR, the WP 29 Guidelines on DPIA, while most of these categories have been included in the lists of activities triggering the DPIA obligations, issued by the national Data Protection Authorities—see, indicatively, the relevant list issued by the Hellenic Data Protection Authority (HDPA) in its Decision 65/2018, published in Government Gazette B' 1622/10.05.2018, available at: https://www.dpa.gr/portal/page?\_ pageid¼33,239286&\_dad¼portal &\_schema¼PORTAL. 85The provisions of Article 36 of the GDPR are of relevance.

continuous exercise that has to be repeated regularly, in order to ensure continuous compliance of the relevant data processing activities with the GDPR provisions.86 In the context of such regular review and re-evaluation as to the adequacy of the DPIA findings, the measures taken to mitigate any risks to the data subjects may also have to be duly updated, in line with the state of the art developments.87

Data Protection Officer The GDPR provisions establish a new position in the organizational structure of data controllers and processors, the Data Protection Officer (DPO), the appointment of whom is obligatory in case the core activities of the data controller/processor consist of processing operations, which require large scale, regular and systematic monitoring of data subjects, or large scale processing of special categories of personal data.88 Insurance undertakings, given the significance of data collection and processing activities for their insurance business, are among the categories of data controllers falling into the scope of the obligation to appoint a DPO. Such obligation is further enhanced in the event that additional data processing activities are designed to be included in the functions of the insurance company, in the course of its product design, distribution and monitoring activities. The DPO, as described in the relevant GDPR provisions,89 monitors the compliance of the company with its GDPR obligations, and shall be involved, from the earliest stage possible in all issues relating to data protection, including where a DPIA is being carried out.90 As such, the manufacturer's and/or the distributor's DPO (as the case may be), shall be included in the design of the product approval, distribution and monitoring arrangements, so that he/she may identify the privacy-related issues that may arise therein, and assist the company in ensuring compliance with the related GDPR obligations.

Records of Processing Activities Under the GDPR provisions, data controllers are obliged to maintain records of the data processing activities they undertake in writing (including in electronic form), which shall be made available upon request to the competent Data Protection Authority.91 In this respect, the data processing operations taking place in the course of the product design, distribution and monitoring functions, shall be also duly recorded in such records, which shall contain references to the processing purposes, the categories of the personal data and data subjects involved, the categories of recipients to whom personal data are being disclosed,

86Working Party 29, Guidelines on Data Protection Impact Assessment (DPIA) and determine whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679, as above.

87Bieker et al. (2017).

88See in this relevance the provisions of Article 37 of the GDPR.

89Articles 38–39 of the GDPR.

90Working Party 29, Guidelines on Data Protection Officers (DPOs), adopted on 13 December 2016, last revised and adopted on 5 April 2017, 16/EN, WP 243 rev. 01, as endorsed by the EDPB and available at: https://edpb.europa.eu/our-work-tools/general-guidance/gdpr-guidelines-recom mendations-best-practices\_en.

91See Article 30 of the GDPR in this relevance.

where applicable information on any cross-border data transfers to countries outside the EEA, the envisaged retention periods for the different data categories, and a general description of the adopted technical and organizational security measures being implemented.

The new IDD framework on insurance distribution provides for new internal governance obligations on both insurers and insurance intermediaries falling into its scope. Such new obligations include the need for insurance manufacturers to adopt and implement appropriate Product Approval Processes, which may also provide for procedures to effectively monitor the performance of the insurance products being released in the markets, while insurance distributors shall similarly adopt and implement appropriate product distribution arrangements. Taking into account the goals which these new procedures aim to accomplish, in terms of defining appropriate and sufficiently granular target markets for the insurance products depending on the characteristics, the demands and needs of the respective customers, and ensuring that the products are duly distributed in the relevant target market, and continue being aligned with the insurance demands and needs without causing any adverse effects to the customers, as well as the fact that data collection and processing has always been of utmost importance for the development of insurance business, it becomes self-evident that product design, distribution and monitoring requires corresponding and extensive data collection and processing operations. As a result, compliance with the relevant IDD obligations must be designed and achieved in a way that compliance with the applicable GDPR obligations is at the same time ensured.

In this relevance, the privacy by design and by default notions and their practical implications should be taken particularly into account during the design of the relevant POG-related policies and procedures, in the sense that the GDPR data processing principles (especially the principles of data minimization, purpose limitation and data safety) shall be embedded into the new policies, as an integral part thereof. Particularly in case of the use of InsurTech and BDA tools, any transparency concerns shall be properly and adequately addressed, in order to ensure that the data subjects are aware of the nature, scope and consequences of the data processing activities that concern them, and are not taken by surprise at a subsequent stage. Technological advances should be employed aiming to further enhance the transparency factor, where and as appropriate. The design and implementation of the new POG-related operations shall be duly monitored as to its compliance with the GDPR by the company's appointed DPO, while a DPIA seems to be obligatory before and during the course of the new or enhanced data processing activities. The details of such processing activities should be also duly documented, in records of data processing activities having the minimum content prescribed in the relevant GDPR provisions.

#### 3 GDPR and IDD Implications in the External Relations