8.3 Data Protection Principles & Solvency Oversight

The UK Data Protection Framework: UK GDPR and DPA 2018

Data protection and privacy compliance are essential operational requirements for London Market participants. Broking houses, Lloyd's syndicates, company market insurers, and loss adjusters continuously process vast volumes of commercial, operational, and personal data. In the United Kingdom, the data protection regime is governed by two complementary legal frameworks:

1. UK General Data Protection Regulation (UK GDPR): Following the UK's departure from the European Union, the EU GDPR (Regulation (EU) 2016/679) was retained in domestic law as the UK GDPR. It establishes core definitions, processing principles, data subject rights, and controller obligations.
2. Data Protection Act 2018 (DPA 2018): National legislation that supplements the UK GDPR by enacting national derogations, defining specific statutory conditions for processing sensitive data, establishing the functions and powers of the Information Commissioner's Office (ICO), and codifying criminal data offences.

Key Statutory Roles

• Personal Data: Any information relating to an identified or identifiable living natural person (Data Subject). This includes names, addresses, identification numbers, policy numbers, telephone numbers, IP addresses, and medical records.
• Data Controller: The natural or legal person that determines the purposes and means of the processing of personal data (e.g., an insurance company, managing agent, or placing broker).
• Data Processor: A natural or legal person that processes personal data on behalf of the controller (e.g., outsourced IT providers, electronic placing software hosts, third-party claims administrators / TPAs).

---

The Seven Core Data Protection Principles (Article 5)

Article 5 of the UK GDPR establishes seven fundamental principles that must be adhered to whenever personal data is processed:

1. Lawfulness, Fairness, and Transparency: Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject. Data controllers must provide individuals with clear, accessible Privacy Notices detailing who is collecting the data, why it is needed, how long it will be stored, and who it will be shared with.
2. Purpose Limitation: Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. An insurer that collects claimant health data to settle a personal injury claim cannot use that data for unapproved marketing or cross-selling.
3. Data Minimisation: Personal data must be adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed. Underwriters must not demand unnecessary personal history when evaluating commercial risks.
4. Accuracy: Personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to erase or rectify inaccurate data without delay.
5. Storage Limitation: Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed. London Market firms must implement formal data retention and secure destruction schedules.
6. Integrity and Confidentiality (Security): Data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organisational measures (e.g., encryption, pseudonymisation, multi-factor authentication, and restricted role-based access controls).
7. Accountability (Article 5(2)): The controller is responsible for, and must be able to actively demonstrate compliance with, all the principles above. This requires maintaining detailed processing logs, conducting Data Protection Impact Assessments (DPIAs), appointing a Data Protection Officer (DPO) where mandatory, and integrating data protection by design and by default into commercial IT workflows.

---

Lawful Bases and Special Category Data in Insurance

Under Article 6, identify an applicable lawful basis: consent, contract, legal obligation, vital interests, public task, recognised legitimate interests, or legitimate interests. The recognised-interests basis introduced by the Data (Use and Access) Act 2025 (DUAA) applies only to specified public-interest purposes and still requires necessity; ordinary legitimate interests requires balancing against individual rights. Contract necessity applies to the data subject's contract, not automatically to all information used in insurance.

Special Category Data (Article 9) and Criminal Convictions (Article 10)

Article 9 of the UK GDPR prohibits the processing of sensitive personal data—including racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data, health data, and data concerning sexual orientation—unless an Article 9 condition is satisfied. Article 10 similarly restricts processing data relating to criminal convictions and offences.

The Insurance Dilemma and Schedule 1 of the DPA 2018

Commercial insurance inevitably involves sensitive data: personal accident policies, international medical travel coverage, aviation passenger liabilities, employers' liability claims, and directors' and officers' (D&O) criminal record checks. However, relying on "explicit consent" creates severe commercial failure points: an injured employee or third-party claimant could withhold or withdraw consent, making it legally impossible for an insurer to evaluate the claim or fulfill its policy obligations.

Schedule 1, Part 2, paragraph 20 of the DPA 2018 provides an insurance condition for specified special category data, including health and genetic data:

• Processing must be necessary for an insurance purpose, such as advising, arranging, underwriting, administering cover or handling a claim, and necessary for reasons of substantial public interest.
• The condition covers the data categories specified in paragraph 20; it is not permission to use every kind of sensitive information. An Article 6 lawful basis and the required Appropriate Policy Document are also needed.
• An additional consent test applies where processing is not for decisions/measures about the data subject and the subject has no relevant contractual rights or obligations. The controller must then be unable reasonably to obtain consent and must not be aware that consent is being withheld. Mere failure to respond does not count as withholding.
• Criminal-offence data is not Article 9 special category data. It requires Article 6 lawfulness plus Article 10 authority or an applicable DPA condition; the firm must identify that route and its safeguards separately.

---

Data Subject Rights and ICO Enforcement

The UK GDPR grants individuals powerful statutory rights:

• Right of Access (Subject Access Request / SAR): Individuals have the right to request confirmation of data processing and obtain a copy of their personal data. The controller must respond without undue delay and at the latest within one calendar month, free of charge (unless the request is manifestly unfounded or excessive).
• Right to Rectification: The right to have inaccurate personal data corrected without delay.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of personal data. In insurance, this right is qualified: insurers can lawfully retain records where retention is necessary for legal compliance or the establishment, exercise, or defense of legal claims (such as defending against liability claims throughout statutory limitation periods).
• Restriction, Portability and Objection: These rights apply subject to their legal conditions. For significant decisions based solely on automated processing, the current safeguards include information about the decision, representations, human intervention and the ability to contest it. Special category data remains more restricted.

Role of the Information Commissioner's Office (ICO)

The Information Commissioner's Office (ICO) is the UK's independent supervisory authority for data protection. Regulated entities face stringent oversight:

• Breach Notification within 72 Hours: Under Article 33, in the event of a personal data breach, the data controller must notify the ICO without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If a breach presents a high risk to individuals, the affected data subjects must also be informed without undue delay.
• Administrative Fines: The ICO possesses statutory power to levy severe administrative fines. For serious infringements of data principles or data subject rights, the maximum fine is up to £17.5 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

---

Prudential Solvency Oversight: Solvency II and Solvency UK

Prudential solvency regulation ensures that insurance companies maintain adequate financial resources, robust governance, and technical provisions to absorb extreme catastrophe losses and fulfill valid policyholder claims under stressed market conditions. The prudential regime in the UK originates from the European Union's Solvency II Directive (implemented in January 2016), which was transposed into UK law and is supervised by the Prudential Regulation Authority (PRA). Post-Brexit, the framework has been adapted into Solvency UK, streamlining regulatory reporting while preserving core prudential standards.

The Solvency framework is structured around Three Pillars:

Loading diagram...

Pillar 1: Quantitative Financial Requirements

Pillar 1 governs the valuation of assets, technical provisions (liabilities), and capital adequacy. It establishes two key capital thresholds:

• Solvency Capital Requirement (SCR): The target regulatory capital requirement. The SCR is calibrated to a 99.5% Value-at-Risk (VaR) over a one-year time horizon. This is commonly expressed as a 1-in-200 annual probability calibration for loss of basic own funds. It is not a prediction that a catastrophe occurs once every 200 calendar years or a guarantee that the insurer will survive every severe event. Insurers may calculate their SCR using either the standard regulatory formula prescribed by the regulator or a PRA-approved Internal Model (tailored to the insurer's specific risk profile, commonly utilized by large Lloyd's syndicates and international underwriting groups). On observing SCR non-compliance, the firm must notify the PRA immediately and submit a realistic recovery plan within two months. It must normally restore eligible own funds or reduce risk to comply within six months, unless the PRA permits a longer period.
• Minimum Capital Requirement (MCR): The lower, absolute statutory minimum capital floor below which policyholders would be exposed to unacceptable risk. The MCR is calibrated between 25% and 45% of the firm's SCR, subject to an absolute monetary floor. MCR non-compliance requires immediate notification and a short-term finance scheme within one month to restore compliance within three months. Failure to meet the MCR recovery requirements can lead to withdrawal of authorisation.

Pillar 2: Qualitative Supervisory Review and Governance

Pillar 2 focuses on internal governance, risk management systems, and regulatory supervisory reviews. It requires insurers to establish an effective system of governance with four mandatory, independent control functions:

1. Risk Management Function: Identifies, measures, and monitors underwriting, market, credit, and operational risks.
2. Compliance Function: Advises management on compliance with statutory and regulatory rules.
3. Internal Audit Function: Independently reviews and evaluates the adequacy and effectiveness of internal controls.
4. Actuarial Function: Evaluates technical provisions, coordinates reserve calculations, and assesses underwriting policy and reinsurance arrangements.

The Own Risk and Solvency Assessment (ORSA)

The centerpiece of Pillar 2 is the Own Risk and Solvency Assessment (ORSA). The ORSA is an ongoing, forward-looking internal assessment performed by the insurer's board of directors. It evaluates the firm's overall solvency needs in relation to its specific commercial risk profile, risk tolerance limits, and multi-year strategic business plan. The ORSA must be performed at least annually and immediately following any material change in the firm's risk profile (such as a major acquisition, entry into a new insurance class, or a massive catastrophic loss event).

Pillar 3: Supervisory Reporting and Market Discipline

Pillar 3 enhances market transparency, supervisory oversight, and public accountability through two distinct reporting channels:

• Supervisory Reporting: Firms submit applicable quantitative templates and other required information to the PRA. Under the UK reforms, the Regular Supervisory Report (RSR) requirement ended on 31 December 2023; it should not be treated as a current universal UK return.
• Public Market Disclosure: Annual publication of the Solvency and Financial Condition Report (SFCR). The SFCR is made publicly available on the insurer's website, disclosing its business performance, system of governance, risk profile, valuation methods, and capital management (including SCR and MCR coverage ratios). This public transparency enables brokers, policyholders, credit rating agencies, and financial analysts to independently verify the insurer's financial solvency and balance sheet strength.