By: Abg. Miguel Ángel Saltos, Mgs.
Introduction
Insurance companies and insurance advisory companies carry out data processing in their activities in various ways. For example, when signing an insurance contract, these companies collect personal information from the client, such as their name, address, date of birth, health status, medical history, occupation, income, among other relevant data to evaluate the risk and establish the conditions of the insurance. Furthermore, when processing claims, insurance companies may collect and process sensitive data related to the health or personal situations of policyholders.
Another example of data processing by these companies is risk assessment and premium setting, where personal and financial data are used to determine the cost and conditions of insurance. Likewise, when offering insurance advisory services, these companies may collect and process personal data of potential clients to provide personalized recommendations.
In summary, insurance companies and insurance advisory companies carry out data processing by collecting, storing, using and sharing customers’ personal information to carry out their business activities and fulfill their contractual obligations.
The General Regulations of the Organic Law on Protection of Personal Data and companies in the insurance sector
The General Regulations of the Organic Law on the Protection of Personal Data have significant implications for insurance companies and insurance advisory companies in Ecuador. These companies, when processing personal data in the context of their activities, whether as data controllers or data processors, are obliged to comply with the provisions of this regulation.
This implies that they must designate a special representative in Ecuador if they do not have a residence in the country, report and update the information in the National Registry for the Protection of Personal Data, as well as comply with the obligations and responsibilities established in the regulations. In addition, these companies must consider the need to designate a Personal Data Protection Officer, who will act as a communication channel with the owners of personal data and the Personal Data Protection Authority.
These companies are obliged to apply the different duties determined in the General Regulation of the Organic Law on the Protection of Personal Data from the moment in which they process personal data in the context of their activities as data controllers or persons in charge of the processing of personal data. data, whether they take place in Ecuadorian territory or not. This is established in article 2 of the General Regulation of the Organic Law on Protection of Personal Data.
Insurance companies and insurance production advisors would have to carry out several actions to comply with the standards established in the General Regulations of the Organic Law on Protection of Personal Data in Ecuador. Among these actions are:
- Designate a special representative in Ecuador, if you do not have a domicile in the country, to comply with the provisions of article 3 of the regulations.
- Report and update the information in the National Personal Data Protection Registry, in accordance with the provisions of articles 84 and 85 of the regulations.
- Register the databases or processing in the National Registry for the Protection of Personal Data within a period of ten days, as indicated in article 86 of the regulations.
- Comply with the provisions established in the Single Registry of Controllers and Persons in Charge of the processing of unfulfilled personal data, in accordance with the provisions of articles 87 and 88 of the regulations.
- Apply appropriate technical, legal, administrative and organizational measures in order to guarantee and be able to demonstrate that the data processing carried out complies with the regulations.
- Through the respective adjustments, the measures must guarantee that. By default, the
- data cannot be accessible to an indefinite number of people in an automated manner.
These actions are basic for insurance companies and insurance producing advisors to comply with the personal data protection standards established in the regulations, thus guaranteeing respect for the fundamental rights and freedoms of the holders of personal data in Ecuador.
Conclusion
With the entry into force of the General Regulation of the Organic Law on the Protection of Personal Data, companies in the insurance sector of Ecuador find themselves with the unavoidable duty to adjust their operational and commercial processes to avoid falling into non-compliance or infractions to the recent regulations that have been issued regarding data protection. The application of the law goes beyond mere formalities, which is why they must have the participation of professionals in different disciplines to ensure that the information collected from their policyholders is duly protected.
For more information you can contact:
Abg. Miguel Ángel Saltos | Email: miguel.saltos@lince-saltos.com | Telephone: (+593 4) 2630313
