LuxembourgInsurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Security, Governance, DPIA
As of .
What it requires
- If you are an insurance or reinsurance undertaking, process health data other than genetic data only where necessary for pre-contractual measures or for performing an insurance or reinsurance contract, and respect professional secrecy under Article 300 of the Law of (Article 181-3, paragraph 1).
- Apply the measures Article 181-3 lists: a data protection officer, impact assessments, anonymization, pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of General Data Protection Regulation (GDPR) Article 5 (Article 181-3, paragraph 1, point 2).
- Document and justify internally any exclusion of the data protection officer, impact assessment, anonymization, audit or code of conduct measures, and keep the documentation available to the Commission nationale pour la protection des données (Article 181-3, paragraph 2).
- Never derogate from the encryption, access restriction, logging, staff awareness and internal policy measures (Article 181-3, paragraph 3).
Who enforces it
Enforcement body
Commission nationale pour la protection des données (CNPD), to which controllers and processors must make available the documentation of excluded measures.
What this law does
Processing of health data other than genetic data is lawful, under General Data Protection Regulation (GDPR) Article 9(2)(g), when necessary for pre-contractual measures in insurance or reinsurance or for performing an insurance or reinsurance contract, subject to professional secrecy and to appropriate measures.
The measures are a data protection officer, impact assessments, anonymization or pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of GDPR Article 5.
Each controller and processor must document and justify internally any exclusion of the data protection officer, impact assessment, anonymization, audit or code of conduct measures and keep the documentation available to the Commission nationale pour la protection des données. In no case may a controller or processor derogate from the measures in letters d), e), f), g) and j).
When LexLint raises it
When your app profile says your app provides financial services.