Informed Consent in Italian Digitalized Insurance Contracts. From the Privacy Shield to Schrems II

In the recent “Schrems II” decision, the Court of Justice of the European Union established that United States domestic law, in particular provisions relating to national security, provide limited protections for personal data transferred from EU to US. In light of these limitations as compared to European Union levels of protection of the human rights of the individuals whose data are transferred, the CJEU declared the Privacy Shield invalid with immediate effect. Pending an adaptation of the relevant US legislation to reflect European Union law, it appears possible to continue transferring personal data from the European Union to the United States only by resorting to Specific Contractual Clauses and Binding Corporate Rules, which must be assessed based on their compliance with the GDPR. In the Italian insurance sector, in particular in the case of digitalized contracts, for the purposes of data transfers compliant with the provisions of the GDPR, operators in the sector will have to rely on ad hoc clauses included in their agreements in relation to the respective roles of the different parties involved in the insurance distribution process. This scenario may involve more onerous obligations for companies, intermediaries, etc.