GDV

The BigBrotherAward 2006 in the “Consumer Protection” category goes to the Association of German Insurers (Gesamtverband der Deutschen Versicherungswirtschaft, GDV) represented by its president, Dr Bernhard Schareck for the insurance industry’s “warnings and indications” databases, which insurers use to exchange substantial amounts of data about millions of citizens — with undisclosed criteria, without sufficient legal foundation, and unknown to the people affected.

The insurance companies organised in the Association¹ are maintaining a joint database called “Uniwagnis” (uni[versal?] peril), in which data about insurance customers, but other people as well, are stored without their knowledge. The database, according to the Association, is about uncovering insurance fraud, but it is really a “black list” — and any person regarded  by any member company as “bad risk”, or a not so lucrative customer, could be recorded in it.

“No, not everyone (is thrown into this code pool). As a prerequisite, one has to have somehow been involved in a loss, and the insured person must be under suspicion of fraud. But the fraud does not need to be proven.”

(From an Association statement in their magazine, “Positions”)

There are about 10 million entries in the “Uniwagnis” database. How is that possible? How does one appear in this list?

Sooner than you think, actually. Imagine you had a car accident on a country road at night. Fortunately, there was a witness whose statement to the police confirms what happened. Imagine further that you are a student and the car was not registered to yourself but to your mother or your flatmate. You may not see anything wrong here, but each of these details would seem suspicious to insurers, “earning” you negative points on a secret scale of the insurers’ scoring system. By the time you exceed 60 points — for whatever reason — your car insurer would rate you as a “suspicious customer” and enter you in the “warnings” database of the Insurers’ Association. And because you were deemed suspicious, the same label would apply to everyone else involved in your accident: the registered car owner, the friendly witness and the assessor who evaluated the damage.

The warnings database does not only get involved when you claim your insurance, but as soon as somebody wants to enter into one — such as legal, life or disability insurance. Whenever one of the associated insurers receives an insurance application, “Uniwagnis” is activated through an interface in the background. Entries into the system are automatically passed on to the Association, regardless whether the customer only wanted to acquaint themselves with the terms and conditions and even if they expressly objected to their data being shared².

If “Uniwagnis” finds a hit, i.e. the newly entered personal data matches an existing record, that record is displayed. In theory, the employee of the querying insurance should now phone the insurance supplying the data and ask about the details. But in practice the mere existence of a matching record will suffice to give you special treatment. It is a stigmatisation with a consequence: being entered in the warnings database might for example lead to increased insurance premiums or prevent you from getting an insurance at all.

An example: legal expenses insurance will often take as little as two claims within one year as grounds for cancelling the contract. And you could even lose your legal insurance if for three times in three years you had only asked about getting coverage — no matter if the insurance was then actually claimed or had to pay at all. So, if you suffer from a difficult neighbour or landlord who would keep sending you those worrying letters so that in the course of 36 months you had raised this three times with your legal insurer, just to be on the safe side (without ever actually using it!), you might still end up with a terminated contract and a notice in “Uniwagnis”. Which would mean that all legal insurers are aware of this and might not insure you, or only do so for a higher fee. By asking your insurance to do only the slightest beginnings of its actual purpose — which is to be potentially called upon in case of loss — you might end up stored in a “fraud aversion” database without even knowing it.

Every two to three weeks, every insurance receives the full amount of data reported about millions of people. This data is transferred whether the insurance has a justifiable interest in it or not. A clear case of data being transferred for nothing but “stockpiling” — which is plainly illegal under the German Data Protection Act.

The Insurers’ Association does not see anything illegal in its actions: after all, the customers had consented to their data being shared, a clause they signed in their insurance contract. But do customers actually know what they are signing? Explanations are not given in the contract itself, only in a separate leaflet. The “Merkblatt zur Datenverarbeitung" (leaflet on data processing) comprises four sheets of small print. Often the customers won’t even be shown the leaflet before signing — let alone have the individual items be explained to them — because they are only sent it later with their insurance certificate. The same insurers that usually reply to complaints about their business practices by saying that customers were simply not reading their contracts actually conceal vital information from them. Customers are deliberately led to believe that giving consent to data sharing was just a formality. And customers like to believe it, because their mind is focused on other issues at the time they enter into an insurance contract.

Everyone who is reported into the warnings database would actually have to be notified by the insurance and be given an opportunity to comment. This does not only apply to insurance customers but even more so to related persons such as car owners, witnesses and assessors, because these people never even signed a contract with the insurance to begin with. But the insurances are not notifying anyone, as this would lead to a negative image and many complaints. And complaints management is expensive. So the storing goes on, without any kind of transparency.

“If you want to find out if your name is stored in one of the ‘warnings databases’ of the insurance industry, you’d better take a few days off work ...”, writes Finanztest, a major German financial services consumer magazine³. This is because the only way for customers to find out is to ask each insurer individually what they have reported to the Association — it is the individual companies who are legally obliged to respond to such queries. The Association refuses to give this information to citizens and considers itself not obliged to do so. Firstly, the Association says it is acting as a subsidiary of the insurances (citing § 11 of the German Data Protection Act), and secondly, they claim that the data is stored in a coded way, making it no longer personal or person-relatable.

This is what the Insurers’ Association calls “coding”: if you search the database for, say, “Petra Meyer” and “Hamburg”, you are given all existing records of people in Hamburg whose names sound similar (Petra Mayer, Petra Meyer, Petra Meier etc.) with address, possibly date of birth, reason for being reported and contact number for the reporting insurer. Using the address or date of birth, a link to the individual person can be made without any external information. If necessary, further data can be obtained through a call to the reporting insurance without the knowledge of the affected person. The data are therefore neither anonymous nor “pseudonymous”, in spite of the Association’s claims. All participants can relate the data to the person, so the data is person-related. The system is even lacking an effective prevention of queries out of mere curiosity or for advertising and marketing purposes.

There seems to be an abundance of lawyers who are happy to author (partly outrageous) justifications for the insurers’ practices. A law professor commissioned by the Association argues in a legal assessment⁴ that a “justifiable interest” for sharing the data would not need to be demonstrated at all, because the insurers had an interest in the warnings database as a whole. And he seriously holds out the view that it would be sufficient information to the customer if the “leaflet on data processing” would be kept in insurance agents’ offices so that customers “could inspect it”.

Another expertise⁵ commissioned by the consumer association VzBv⁶ however makes it clear that the declaration of consent to data sharing that is commonly used at present is ineffective because of serious legal shortcomings⁷. The consent given by consumers to the sharing of data is neither “conscious” nor “informed”, as mandated by law. Customers are not informed about the contents or the possible consequences of their data being shared, and they are not given an alternative decision. If customers do not consent, they might “potentially” not be given insurance.

The “warnings and indications” database does not only serve the stated purpose of tracking down insurance fraud, it facilitates a price cartel for the insurers. It is an obvious goal of the insurers to filter out so-called “bad risks” and insure these only against a higher premium or not at all. The insurers are thus using the warnings and indications database as a market information device to restrict competition, which is illegal and to the disadvantage of the consumer. That is a case to look at not only in terms of data protection, but also for the German monopolies commission.

How do the insurances succeed again and again in pushing through their positions in politics and new laws? “The Association of the German Insurers and the Association of Private Health Insurances are not very visible in public, but the more are they active behind the scenes. Because insurance giants such as Allianz AG are among the economic heavyweights, the industry is finding open ears in every political party”, says the daily newspaper “Die Welt”. The insurance lobby has a huge influence. Some parliament speeches or draft laws come straight from the insurers’ writing desks⁸

Sometimes their links to TV editors are too short as well. Between 2000 and 2005, the Insurers’ Association clandestinely bought themselves product placements in Marienhof, a successful soap on Germany’s nationwide public broadcasting station, ARD. Commissioned dialogues and magazine features are probably far more effective than conventional advertising — on the other hand, they’re completely illegal.

It seems that transparency is the last thing the organised insurance industry would want for its own activities — but their customers just can’t be transparent enough for them.

As legal scholar Daniel J. Solove concludes: Databases fundamentally change the way decisions in the administration are made and judgements that influence our lives are worked out. Databases are not the basic cause, but they enforce an already existing imbalance of power and tend to leave the people powerless⁹. The “warnings and indications” database of the insurance industry is a prime example.

We want our politicians to develop more spine against powerful lobbying organisations. We wish consumer associations and data protection commissioners more effectiveness in confrontations with the insurance industry. Our advice to the insurers themselves is to change their data protection and business practices profoundly — before the word “insurance fraud” takes on a whole new meaning in the public arena.

Congratulations, dear Association of German Insurers, dear Dr Schareck — you, for one, have been notified in advance; now you are stored in the public “warnings and indications” file that is the Big Brother Awards.