Paying your insurance with personal data - Welcome innovation or privacy risk?

08/01/2025 - It's January, the month when many people have just purchased new health insurance. You may have noticed it in the annual search for the best policy at the most competitive premium; some health insurers operate business models where customers can earn premium discounts by sharing their personal data. Customers can earn these discounts by meeting health goals, such as taking enough steps or taking sports classes.

At first, this seems like a win-win situation: the customer saves money and the insurer runs less risk of having to reimburse high claims. However, this development raises several questions. Besides possible ethical objections to the trade in personal data, there are also legal uncertainties about the legality of processing it. This blog explores this shift and the underlying dilemmas.

Valid consent

Processing of personal data must be based on a processing ground from Article 6 of the General Data Protection Regulation (GDPR). The processing of personal data by insurers to create a risk profile is based on the consent of the insured. This consent must be free, specific, informed and unambiguous. Among other things, this means that data subjects must have a genuine or free choice and must be able to refuse or withdraw consent without adverse consequences. Where there is a clear imbalance between parties, consent cannot be a valid basis for processing. This raises the question of whether commercial pressures or power relationships preclude the giving of free consent to the processing of personal data in exchange for discounts.

According to the European Data Protection Board (EDPB), the crucial question in assessing imbalances between parties is whether the position of the data controller in the market, alone or in combination with other factors, leads data subjects to feel that they have no other realistic alternatives. With insurance that is required by law and where insurers have a dominant market position, it is difficult for policyholders to refuse consent without negative consequences. This can lead to an imbalance between parties.

Possibility of an equivalent alternative?

Data subjects should be able to refuse the sharing of their personal data that is not necessary for the provision of the service. The Court of Justice of the European Union ruled in the case on Meta's pay or okay model that this can mean that users are offered an equivalent alternative without data processing for an appropriate fee. This equivalent alternative is further colored in an EDPB opinion. Although the opinion primarily concerns large online platforms, it has broader implications for data processing and consent in other sectors.

The EDPB argues that the offer of an equivalent alternative and the disadvantage to the data subject of refusal are important factors in the validity of consent. If the alternative differs only because of the fact that the data controller does not process personal data, it can in principle be considered equivalent. In insurance, providing the data on which the discount is based is usually not necessary for the basic service (the insurance itself).

However, offering an equivalent alternative service where the discount is based on a risk profile compiled from personal data is difficult. Unlike behavioral advertising, for example, where there is no direct relationship between the behavior of the individual and the service purchased, discounts can vary by person and situation. Without a risk assessment based on the processing of personal data, the insurer cannot determine how much discount the insured misses out on, thus also what the price should be of the equivalent alternative.

The future of paying with personal data

In our digital economy, information about natural persons often and increasingly has a value comparable to money for market participants. It is therefore to be expected that the number of business models in which consumers are given the opportunity to pay with personal data will increase. Insurers and other companies must meet strict requirements when using the consent basis for processing personal data as a contractual consideration. This standard is unlikely to always be achievable in practice. The balance of power between parties, including the degree of obligation of the service offered, the disadvantage experienced by the data subject in refusing consent, the market position of the company, and the provision of any equivalent alternative play a role. The challenge lies in creating a model in which consumers are not forced to sacrifice privacy for lower costs, but in which freedom of choice is central.