In the first part of this two part series we discussed about the regulatory frameworks governing insurance companies and insurance intermediaries. In this part we will look at the guidelines applicable to both insurance companies and insurance intermediaries which includes cyber security and ecommerce guidelines.
In addition to the previously-mentioned regulations, the IRDAI has also issued certain guidelines pertaining to data security and protection that are applicable to both insurance companies as well as insurance intermediaries. These are the Guidelines on Information and Cyber Security for Insurers[i] (Cyber Security Guidelines) and the Guidelines on Insurance E-Commerce[ii] (E-commerce Guidelines) and have been discussed below.
The IRDAI prescribed the Cyber Security Guidelines in 2017 with the aim of ensuring that organisations define and implement procedures to ensure the confidentiality, integrity, availability and consistency of all data in a more robust manner. These guidelines are applicable to all information, records and data created, received or maintained by insurers and their employees, third party vendors and business distributors that have been provided with access to an organisation’s data in the course of carrying out their designated duties and functions, irrespective of the form of the records. In the event policyholder information is shared with intermediaries and other regulated entities, it imposes an obligation on the insurer to ensure that adequate mechanisms are put in place to address issues related to information and cyber security. While the Cyber Security Guidelines remain silent on what constitutes adequate mechanisms in this regard, the IRDAI may take a view that the intermediaries and other regulated entities with whom the policyholder information is shared, are also subject to the obligations imposed on an insurance company in relation to information and cyber security, as specified herein below.
Accordingly, the Cyber Security Guidelines require insurance companies and their intermediaries to have: (i) a uniform framework for data, cloud, mobile and cyber security; and (ii) an in-built governance mechanism, (including a board approved policy on information and cyber security, a chief information security officer responsible for articulating and enforcing the policy and an information security committee responsible for the information security governance framework) to address security related issues on a periodic basis. The IRDAI has mandated implementation of the measures prescribed thereunder, inter alia, in relation to (i) appointment of a chief information security officer and formation of the information security committee; (ii) preparation of a gap analysis report; (iii) formulation of cyber crisis management plan; (iv) finalisation of a board approved policy on information and cyber security; (v) formulation of an information and cyber security assurance programme; and (vi) completion of the first comprehensive information and cyber security assurance audit in a phased manner.
Identifying that maintenance of data security is essential through all five phases of the data lifecycle (i.e., data at source, in motion, in use, at rest and at destruction), the IRDAI has prescribed a detailed framework for data protection on the insurer, which includes the following obligations:
While the Cyber Security Guidelines are prescriptive in nature, they enable certain functions to be carried out by insurance companies and intermediaries within its framework. This is evidenced by Paragraph 24 and Annexure B of the Cyber Security Guidelines, which specifically require insurance companies (and their intermediaries) to comply with various statutory provisions available for information and cyber security, including the IT Act and the SPDI Rules. The regime under the IT Act and the SPDI Rules mandate organisations sharing sensitive personal data or information (which includes details of physical, physiological and mental health conditions, medical records and history, etc.) with third parties to, inter alia, obtain the written consent of the person whose personal information is proposed to be shared.
By way of the aforementioned requirement and in the absence of any provision under the IRDAI regulations to the contrary, the IRDAI appears to have allowed the sharing of information, records and data with third parties for business purposes, provided that adequate (i) consents are obtained; and (ii) safety measures are put in place to ensure confidentiality and security of such information, records and data.
The E-commerce Guidelines are enabling in nature and were issued by the IRDAI in 2017 with the objective of increasing electronic transactions. They are applicable to insurance companies, intermediaries, etc. who set up an Insurance Self Network Platform (ISNP) (i.e., a website or mobile application), for selling and servicing insurance products. These guidelines require ISNPs to have adequate internal mechanisms for reviewing, monitoring and evaluating its controls, systems, procedures and safeguards so as to ensure: (i) the integrity of the automatic data processing systems; and (ii) privacy of data is maintained at all times. These internal mechanisms are to be reviewed annually by specified persons.
The E-commerce Guidelines also prescribe certain additional obligations that an ISNP is required to comply with, to ensure privacy of personal information and data security, including: (i) maintaining confidentiality and prevention of misuse of personal information collected during the course of an insurance transaction; (ii) having in place measures to ensure data privacy and installation of adequate systems, to prevent manipulation of records and transactions prior to commencing operations; (iii) review and reporting of the safeguards in place to the sub-committees of its board of directors, for corrective action (where necessary).
With increased internet connectivity, use of smartphones and a definitive shift towards e-commerce, data is no longer an intangible commodity, but a valuable asset requiring a great amount of protection. Personal information and data collected by insurance companies and intermediaries, can be utilised to personalise products, develop targeted marketing initiatives and effectively reduce fraudulent claims. Realising the demands of new-age customers and the benefits of digitisation, the insurance industry is aggressively adopting technological solutions to increase market penetration of products and efficiency of process management[iii]. However, it is pertinent to bear in mind that technological advancements compound the need to have a robust protective framework. Cyber security incidents not only compromise personal and proprietary information of the policyholders but also harm the ability to conduct business and undermine confidence in the sector.
There have been significant developments in the field of data protection in the recent past, including privacy being declared a fundamental right[iv] and release of the proposed draft of the Personal Data Protection Bill, 2018 by the committee of experts chaired by retired Supreme Court judge, Justice Srikrishna. The PDP Bill inter alia, prescribes the manner in which personal data (including sensitive personal data) is to be collected, processed, used, disclosed, stored and transferred. It prescribes a detailed framework to be followed by organisations (including government organisations) for giving notice and obtaining the consent of the data principals for processing of personal data and sensitive personal information. The PDP Bill proposes to supersede Section 43A of the IT Act and the SPDI Rules. Once the PDP Bill is enacted, insurance companies and intermediaries will have to ensure compliance with the additional obligations imposed thereunder for the processing, storing and transfer of data collected by them.
Specifically in the insurance sector, though the IRDAI has taken progressive steps in recognising the role of technological advancements[v], the sector itself is yet to uncover the full potential thereof, particularly in the fields of artificial intelligence, machine learning, and big data analytics. To this end, the IRDAI has also constituted a committee on regulatory sandbox in the insurance space[vi]. The regulatory sandbox carves out a safe and conducive space for stakeholders to experiment with insurtech solutions while the consequences of failure can be contained. Considering the enormous potential of insurtech innovations, coupled with the changing outlook towards adoption of technology in the insurance sector, it is imperative that the regulator understands these trends and ensures compliance with data protection and privacy regulations, so as to ensure that the interests of the stakeholders are not compromised.
[i] Guidelines on Information and Cyber Security for Insurers dated 7th April 2017.
[ii] Guidelines on Insurance E-Commerce dated 9th March 2017.
[iii] A consortium of leading Indian life insurance companies have partnered with a global technology firm and developed a blockchain solution which facilitates cross-company data sharing to reduce the risk of data breaches, fraud and money-laundering, while improving process efficiency and record-keeping. See “Leading Indian Life Insurers Partner with Cognizant to Develop Industry-Wide Blockchain Solution for Secure Data-Sharing and Improved Customer Experience” at http://investors.cognizant.com/2018-04-16-Leading-Indian-Life-Insurers-Partner-with-Cognizant-to-Develop-Industry-Wide-Blockchain-Solution-for-Secure-Data-Sharing-and-Improved-Customer-Experience.
[iv] K. S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors, Writ Petition (Civil) No. 494 of 2012.
[v] For example, the IRDA has recently allowed insurance policies and written mandates to insurance brokers to be held in electronic form. See “IRDAI Issues Clarification on Form of Written Mandate under the IRDAI (Insurance Brokers) Regulations, 2018” at http://corporate.cyrilamarchandblogs.com/2019/03/irdai-written-mandate-clarificationinsurance-brokers-regulations-2018/.
[vi] Report of the Committee on Regulatory Sandbox in Insurance Sector in India dated 5th February 2019.
