Privacy and Security in Insurance: Protecting your data

The modern insurance industry relies on “big data” to price risk more accurately. While traditional underwriting used static factors like age or zip code, today’s insurers use dynamic data fueled by the Internet of Things (IoT).

Telematics and Connected Cars

One of the most significant shifts in data privacy involves the automotive industry. A recent investigation by The New York Times found that General Motors and other manufacturers were sharing detailed driving behavior—including hard braking, rapid acceleration, and speeding events—with data brokers like LexisNexis Risk Solutions [1].

This data is used to create “risk scores” that insurers purchase to set premiums. In many cases, drivers were enrolled in these tracking programs, such as GM’s “Smart Driver,” through “deceptive consent” buried in the fine print of infotainment system setups or mobile apps [2].

Data Brokers and Insurtech

Your data often lands in the hands of third-party aggregators. Companies like Verisk and LexisNexis compile “Consumer Disclosure Reports” that act similarly to credit reports but for insurance risk. According to Consumer Reports, nearly every major automaker now collects “driver behavior data” and shares it with insurance-focused data exchanges [3].

The primary risks associated with insurance data fall into three categories:

1. Financial Penalty: Poor “driver scores” or health data metrics can lead to significantly higher premiums. In one documented case, a driver saw a 21% insurance spike due to tracking data he didn’t realize was being shared [1].
2. Sensitive Location Tracking: Modern policies that require GPS tracking can reveal visits to sensitive locations, such as medical clinics or places of worship. The Federal Trade Commission (FTC) has warned that the surreptitious disclosure of such information is an unfair practice that threatens consumer welfare [4].
3. Cybersecurity Breaches: Because insurance companies hold Social Security numbers and financial details, they are high-value targets for hackers. Protecting these assets is as critical for the insurer as it is for the policyholder. Much like you would secure physical items as described in Property Insurance: Protecting Your Assets, your digital assets require a proactive defense strategy.

Protecting your privacy requires a multi-front approach involving your car, your mobile devices, and the insurance companies themselves.

1. Audit Your Vehicle Settings

If you drive a car manufactured in the last five years, it is likely connected to the internet.

• Request your report: Visit the LexisNexis Risk Solutions and Verisk websites to request your consumer disclosure files. This will show you exactly what driving data has been shared about you.

• Check the App: Open your vehicle’s brand app (e.g., MyChevrolet, Toyota App) and look for settings labeled “Data Privacy,” “Smart Driver,” or “Usage-Based Insurance.” Toggle these off if you do not want your behavior tracked.

• Factory Reset: When selling or returning a leased car, always perform a factory reset on the infotainment system to wipe your synced contacts and location history.

2. Guard Your Mobile Interaction

Insurance apps often request “Always On” location permissions to track mileage or driving habits. If you are not enrolled in a specific discount program that requires this, set location permissions to “Only While Using the App.”

3. Vet Your Insurance Agent

A knowledgeable agent should be transparent about how a company uses your data. When you Find and Vet Local Insurance Agents in Your Area, ask them specifically about “usage-based insurance” (UBI) programs and whether the carrier sells de-identified data to third parties.

4. Use State Privacy Rights

Residents of states like California (CCPA), Virginia, and Colorado have the legal right to:

• Right to Delete: Request that an insurer or data broker delete your personal info.

• Right to Opt-Out: Request that your data not be sold or shared with third parties [3].

The link between privacy and insurance is no longer just about keeping your name off a mailing list; it is about preventing “surveillance pricing” and identity theft. As the industry moves toward more granular tracking, the burden of protection shifts to the consumer.

Action Plan

1. Immediate Audit: Request your LexisNexis and Verisk reports today to see if your driving data is currently being sold to insurers.
2. Opt-Out: Check your vehicle’s app and your insurance mobile app for “connected services” or “driver feedback” programs; disable them unless the discount clearly outweighs the privacy loss.
3. Update Security: Enable Multi-Factor Authentication (MFA) on all insurance and financial portals to prevent unauthorized access to your policy details.
4. Review Permissions: Regularly check your smartphone settings to see which insurance apps have access to your “Motion & Fitness” or “Location” data.

While data-driven insurance can offer lower rates for some, the hidden cost is often your privacy. By staying informed and utilizing federal and state privacy tools, you can ensure that your coverage protects your assets without compromising your personal life.