GDPR with refusing medical information
<p>How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply?</p>

<p><a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/" rel="noreferrer">https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/</a></p>

<p>My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service.</p>

<p>The only other one that slightly fits is condition h) in "the provision of health or social care or treatment or the management of health or social care systems"</p>

<p>But its a bit of a stretch. Are they likely to make consent a pre-condition of service anyway, or is there a more appropriate way?</p>

<blockquote>
  <p>How does GDPR work with insurers in relation to refusing information
  about pre-existing medical conditions? Due to it being special
  category data. As in, which of the "conditions for processing special
  category data" would apply?</p>
</blockquote>

<p>As far as I see, Article 9 (a) ("explicit consent") would apply. So the insurer would have to ask the customer for consent.</p>

<blockquote>
  <p>My first thought was it would be consent-based (condition a), but
  under consent, it is noted that you should avoid making consent a
  precondition of service.</p>
</blockquote>

<p>Yes, that is often noted, but that is only partially true. The GDPR actually says (Article 7, emphasis mine):</p>

<blockquote>
  <ol start="4">
  <li>When assessing whether consent is freely given, utmost account shall
  be taken of whether, inter alia, the performance of a contract,
  including the provision of a service, is conditional on consent to the
  processing of personal data <em>that is not necessary for the performance
  of that contract</em>.</li>
  </ol>
</blockquote>

<p>So making consent a precondition of service can be ok, <strong>provided that the data is "necessary for the performance of that contract"</strong>. Whether knowing about preexisting conditions is "necessary" for an insurance provider is something a court would have to decide, but on the face it does not seem unreasonable.</p>

<p>Source: <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">General Data Protection Regulation</a></p>

<p>I think your basis would be to rely on a combination of Article 6 (1) b) ... for the performance of a contract to which the data subject is party ... and Article 9 (2) a) the data subject has given explicit consent.</p>

<p>There are some draft notes from the ICO that infer consent may be a precondition if it is necessary for the delivery of a service.</p>

<p><a href="https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf" rel="nofollow noreferrer">https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf</a> </p>

<p>Caveat... am no legal expert, have just spent a fair bit of time trawling the regulation and the ICO guidance.</p>

gdpr