DPA clarified the role of insurance companies and banks in the processing of personal data carried out in the context of the distribution of insurance policies. Specifically, while the insurance company acts as data processor, the distributing bank plays the role of data controller. In fact, pursuant to Article 58 of IVASS Regulation, the discretion of the distributor in relation to purposes and means of the processing is limited to collecting information from the insured in order to assess his/her profile and needs, while the insurance company must provide the intermediary with appropriate instructions in respect of the afore-said pre-contractual phase.
DPA’s opinion of 18 May 2022