Persyonuvernd (Iceland) — TM tryggingar
Persyonuvernd examined TM's automated decision-making for life and health insurance and, while generally compliant, ordered TM to fix transparency about how smoking information affects premium calculation.
Key takeaway — how to prevent this
AI that denies insurance claims or benefits must preserve meaningful human review of medical necessity; automated mass denials draw bad-faith, breach-of-contract and class-action liability.
Case brief
Read from the decision on 2026-09-18. Every holding carries a short verbatim quote from that text (in IS, the document's language).
- Decided by
- Persónuvernd
- Parties
- Persónuvernd v. TM tryggingar hf.
- Decision date
- September 23, 2024
- Remedy
- Persónuvernd ordered TM tryggingar to bring its processing of applicant smoking information for surcharged insurance policies into compliance with fair and transparent processing standards by October 21, 2024.
- Appeal
- Appeal status not stated
Key holdings
The processing of personal and health data for automated insurance quote evaluation was based on valid customer consent and satisfied legal requirements for automated individual decision-making.
“Er það jafnframt niðurstaða Persónuverndar að vinnslan geti verið heimil á grundvelli 1. tölul. 9. gr. laga nr. 90/2018” — Niðurstaða
The processing of applicant smoking data when issuing surcharged insurance policies failed to fully comply with the principle of fair and transparent data processing.
“Vinnsla persónuupplýsinga um reykingar umsækjenda við útgáfu trygginga með álagi samrýmist ekki að fullu meginreglu laganna og reglugerðarinnar um lögmæta, sanngjarna og gagnsæja vinnslu persónuupplýsinga.” — Ákvörðunarorð
TM tryggingar was formally ordered to bring its processing of smoking information in surcharged life and health insurance policies into compliance with transparency principles.
“Lagt er fyrir TM að færa vinnslu persónuupplýsinga sem fer fram í tengslum við sjálfvirka ákvarðanatöku um útgáfu líf- og sjúkdómatrygginga með álagi til samræmis við meginreglu” — Ákvörðunarorð
In plain English
The Icelandic Data Protection Authority, Persónuvernd, conducted an own-initiative investigation into the automated processing of personal data by insurance company TM tryggingar hf. and TM líftryggingar hf. in connection with applications and quotes for life and health insurance policies. The investigation focused on whether the automated decision-making system safeguarded individual rights, adhered to fairness and transparency, and collected only necessary personal information. Persónuvernd found that the automated decision-making process was generally based on valid customer consent and met legal requirements for automated individual decisions, as customers were informed and provided options for human intervention or review. Additionally, the data minimization and purpose limitation requirements were met. However, Persónuvernd determined that TM failed to fully meet transparency and fairness principles regarding how applicant smoking status affects insurance premiums. While general terms mentioned that smoking could result in a surcharge, issued insurance policies did not clearly explain whether or how smoking specifically increased premium calculations. Persónuvernd ordered TM to bring its processing of applicant smoking data for surcharged policies into compliance by October 21, 2024.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.