CII issues vulnerability data guidance to help firms meet Consumer Duty requirements

The Chartered Insurance Institute (CII) has published new guidance designed to help insurance and personal finance firms manage customer vulnerability data while complying with both Consumer Duty requirements and UK data protection legislation.

The new guide, Data Privacy for Customers in Vulnerable Circumstances, was launched at an industry event in London yesterday (17 June) and seeks to provide firms with practical advice on collecting, storing and using vulnerability-related information.

According to the CII, the guidance builds on previous communications from the FCA and the Information Commissioner’s Office (ICO), which have stressed that data protection obligations and the need to support vulnerable customers are not mutually exclusive.

The guide identifies three key reasons firms may need to process vulnerability-related data – providing appropriate support and preventing harm, meeting regulatory reporting requirements and improving products and services.

Matthew Hill, chief executive of the CII, said firms should feel confident using data to improve customer outcomes.

“Too often data protection is used as an excuse not to do the right thing,” he said.

“Our new guidance should give insurance professionals the confidence to make data work for better consumer outcomes.”

‘Clear set of standards’

The guidance has been developed for compliance professionals, data protection specialists and operational leaders, with the aim of encouraging a more consistent approach across the insurance and personal finance sectors.

Robert Bell, director at RB Compliance Consultancy and co-author of the guide, said: “We live in a world where health and support needs are increasingly openly discussed, meaning firms have to be laser focused on supporting customers who find themselves in vulnerable circumstances.”

Bell explained that many firms continued to view UK GDPR as a barrier to recording vulnerability information.

“The CII identified this problem and the need to form a clear set of standards to guide firms through recording vulnerability data whilst maintaining compliance with UK GDPR,” he said

He added that the guidance had been developed to provide clear standards for managing vulnerability data while maintaining compliance with data protection rules and supporting the expectations of Consumer Duty