Brokers Ireland Compliance Update September 2020 Linda Doyle
Items Covered • GDPR and outsourcing • Brexit • Central Bank and Cyber Fraud • Consumer Insurance Contracts Act 2019 • Covering PCF roles during COVID19 • Assessing Financial Soundness of Insurers – Role of MGAs
GDPR and outsourcing Article 24(1) Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Article 28(1) Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. Recital 81 When entrusting a processor with processing activities, the controller should only use processors providing sufficient guarantees, in particular in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements of this Regulation, including for the security of processing. Article 28(3) Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller… 3
Data Protection considerations when outsourcing What will the data processor being doing on your behalf? How much personal data will the data processor have access to? What personal data will the data processor have access to? Will it include sensitive personal data? Where is the data processor storing the data? 4
What due diligence is necessary? Controllers are required to choose processors that provide sufficient guarantees that they will process personal data safely, securely and in accordance with applicable laws. This can be demonstrated by performing due diligence, and keeping a record of that due diligence. Controllers should also refresh their due diligence regularly during the course of the relationship. 5
Whose contract? Article 28(3) Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. Its up to the Data Controller to ensure there is a written agreement between themselves and the data processor. But that does not mean the Data Controller has to write it. The contract must meet, at a minimum, requirements set out in Article 28(3) (a) to (h). 6
Where is the personal data going? Data Controllers must find out where the personal data is being processed and stored. Are there other third parties involved in the processing, even partially? Who has access to the data? Is any of it sub-contracted? Is there a sub-contracting agreement in place? Is the personal data being transferred to outside of the EEA? i.e. to a third country? - Is there an adequacy decision? - Standard Contractual Clauses? 7
What happens if things go wrong? Data security breaches can place a huge amount of stress on a controller's relationship with its data processor. Have clear expectations on both parties included in the agreement. - Include a deadline for initial reporting of suspected breaches by the data processor to the data controller. - Include a plan for ongoing updates from the data processor to the data controller. - Ensure as part of the plan resources will be set aside by the data processor to identify the cause of the breach, and make plans to mitigate such a breach going forward. 8
What happens when the relationship ends? Ending an outsourcing relationship can be more complex than simply providing a few months' notice in writing, and instructing the processor to return or delete personal data. Time may be needed to wind-down the services – to allow data controllers time to bring the services in-house or transfer to a new processor. Consider: - The format for the return - If the services will tail off over time - An obligation on the provider to work with the controller - The back-up practices of the provider. 9
Brexit If there is a no-deal Brexit the UK’s transition period ends on 31 December 2020… - Irish based MGAs/Wholesale Brokers that place business with UK providers - UK Insurers - UK Wholesale Brokers - UK Based Markets withdrawing from the Irish Market - UK Run-Off or Temporary Permissions Regime (TPR) and the Financial Service Contracts Regime (FSCR). Your responsibility to ensure that all insurance undertakings or distributors, with which you engage, have or will have, the appropriate licensing/authorisations to underwrite/place EU risks for EU policyholders. 10
Central Bank, Cyber Fraud and Mandatory Reporting Section 19 of the Criminal Justice Act 2011 imposes a requirement on organisations and individuals to report information relating to possible frauds which might either - prevent the fraud being committed or - secure the apprehension, prosecution or conviction of a person involved in fraudulent activity. Any failure to comply with mandatory obligations uncovered in a subsequent regulatory investigation is likely to be viewed as an aggravating factor in the assessment of penalties. Section 19 also provides that a “person” (which includes a corporate body) is guilty of an offence if he or she withholds information which may be of material assistance in the prevention, apprehension, prosecution or conviction of any other person for certain prescribed “relevant offences”. 11
Central Bank and Cyber Fraud Members should consider reporting obligations under Section 19, not just their data protection or other regulatory obligations in response to incidences of cyber-crime. Includes knowledge of aiding, abetting, counselling or procuring the commission of a prescribed relevant offence, as well as conspiring to commit, or inciting the commission of an offence. A notification may be made to any member of An Garda Síochána. Maximum penalty that can be imposed is an unlimited fine and imprisonment for up to 5 years or both. 12
Consumer Insurance Contracts Act 2019 Signed into law on 26 December 2019 Commencement order signed on 1 September 2019 For information, see Summary and Guidance document which is on the Compliance Support section of our website, within section entitled Consumer Insurance Contracts Act. 13
Consumer Insurance Contracts Act 2019 The Act applies to life and general insurance contracts entered into and variations to such contracts, after the effective date(s) of the various provisions of the Act. Most provisions of Consumer Insurance Contracts Act 2019 are effective from 1 September 2020, with the exception of Section 8, 9, 12 and 14(1-5) which are effective from 1 September 2021. Section 18(4) postponed also, and will not come into effect from 1 September as originally planned. The Act will have a significant impact on all those who distribute insurance products, including brokers transacting both life and non-life business. The Act imposes duties on both the consumer and insurer post contract stage, as well as in respect of claims handling. 14
Consumer Insurance Contracts Act 2019 Section 7: Insurable Interest An insurer cannot reject a claim from a consumer just because the consumer does not have insurable interest in the subject-matter of the contract of insurance. A consumer will still be required to demonstrate loss in order to make a valid claim. The Act does acknowledge that a consumer may be required to have an interest in the subject matter of a contract of insurance where that insurance contract is a contract of indemnity, where the interest required does not extend beyond a factual expectation of the economic benefits or losses that would arise in the normal course of events. 15
Consumer Insurance Contracts Act 2019 Section 10(1): Provision of information relevant to contract of insurance Within a reasonable time after concluding a contract of insurance, the insurer shall, where such is relevant to the particular contract, provide the consumer on paper or another durable medium with the completed application or proposal form. 16
Recommend
More recommend
