Protection of personal data in the insurance industry

In January 2025, the insurance company Allstate is sued for illegally obtaining customer data, and the state of Texas proposed to prohibit the use of AI to make health insurance decisions by insurance companies. It is worth noting that back in 2022-2023, a number of insurance companies faced major data breaches: MCNA Dental (USA) lost the data of 9 million¹ customers, Medibank (Australia) - 9.7 million, Zurich Insurance (Switzerland) - 1 million.

The US experience

In January 2025, the Texas Attorney General filed a lawsuit against insurance companies Allstate and its subsidiary, Arity, for the alleged unlawful collection, use, and sale of auto users' location data. Allstate purchased geolocation data from Toyota, Lexus, Mazda, Chrysler, Dodge from the mobile apps² GasBuddy, Fuel Rewards, Routely. The collected geolocation data was used to adjust insurance premiums and claims coverage (e.g., real-time driver observation data allows for conclusions about driving patterns and detailed³ calculation of incident risks). This unfair practice affected the rights of 45 million users and caused them to incur unnecessary insurance costs.

In January 2025, the State of Texas also considers a bill to regulate the use of AI technology in procedures for evaluating patients' use of health insurance. Adoption of the bill could prevent insurance companies from making automated decisions to deny coverage.

Russia’s experience

In Russia, insurance companies can request medical data for expert examination from territorial funds of mandatory health insurance, and in 2022 the Ministry of Health confirmed the right of insurers to receive such⁴ data directly from medical organizations. However, Russian legislation does not provide for special requirements for insurers to process personal data.

From the monitoring issue No. 1 (13), January 2025. Download the full issue (PDF) · issue page at the Gaidar Institute