This is a notable entry from the Justis International Law & Technology Writing Competition 2019 in the category of Social Media, Technology and the Law, by Gabriel Araujo Souto, formerly of Antonin Scalia Law School, George Mason University. Find out more about this year’s competition topics here.
Social media platforms such as Facebook, Twitter, and Instagram not only record your digital behavior, but also allow third parties to see who you are friends with, what you are interested in, and the kind of updates and images you publish. Platforms like Facebook do not just show information about what someone likes and who they follow, they can also host a variety of tools designed to collect data. Personality questionnaires and surveys are highly effective ways of profiling, which is the use of personal data to evaluate certain personal aspects relating to a natural person by automated processing, that assists in the main challenge of the insurance industry: the pricing of policies. This is because there are several factors to be considered when assembling a client’s risk, such as age, place of residence, work, marital status, and other questions. As a result, insurers set up profiles that fit their clients according to the risk each one has during the life of the insurance policy.
Insurers, lenders, and other financial providers use a variety of data to identify potential customers and decide whether to offer insurance or loans. In the last half century, insurance companies have started offering insurance policies knowing very little about their customers. But in this new technological age, they evolved and began to persistently seek new and different ways of revising their classification structures. One of these new ways is to use social media to capture customer data, which makes it possible for the price of insurance policies to vary according to certain information or if the compensation of an insurer can be paid or not with advent of information through the analysis of the customer’s social media.
Moreover, the practice of profiling for the calculation of social credit loans already occur in countries such as China, where the government’s social credit program will lead the country’s citizens to be judged not only by their ability to pay loans, but also what they like in social media and how they become good citizens in their social media. Thus, a high score gains benefits like travel visas, loans and car rental without deposits. The program has already been implemented on a voluntary basis and mandatory participation is planned for 2020. This collection and use of personal data may seem like a massive invasion of privacy, especially to those accustomed to western democracies. But even in the West such practices are already in place, such as Lenddo, a financial technology company that creates credit ratios for millions of people in 15 countries, including India, Mexico, and Peru. Thus, customers give Lenddo unique access to all their digital data, including social networks in exchange for a better credit offer.
In addition, litigation involving insurers takes a new proportion with the use of social media, reducing the informational asymmetry between insurer and insured. For example, if a customer says in an insurance policy that he or she is not a smoker, but has photos on his or her social network, smoking cigarettes and asks the insurer for an indemnity involving the insurance policy, that person may argue that there has been a breach of contract. Such an approach can be replicated in a number of contexts, such as the insurer’s refusal to reimburse hospital expenses if the client has contracted a travel insurance plan and declares that they would not engage in dangerous activities but in the same period of time posting videos on their social media practicing extreme sports. Such analysis of social media then goes from data collection to data processing, creating a new scope of action by insurers after the insurance policy negotiation, since this may deny the insured’s compensation in case there is evidence of contractual breach.
Therefore, it is necessary to regularize the activities of data collection by insurers on social media in order to ensure legal security for the insured. In that sense, the European data protection regulatory framework, the General Data Protection Regulation (GDPR), should be highlighted, which introduces a new right not to be subject to a decision based solely on the legal effects or similar effects of the data subject. However, the right does not apply to profiling using personal data if any resulting decision is necessary to enter into, or the performance of, the contract between the data controller and the data subject or if the insurer has the explicit consent of the subject data. Thus, the normative dialogue between insurance law and data protection should ensure both a safeguard for the insurer’s performance when using personal data to mitigate insurance policy risks and for policyholders who must have the assurance that their own data will be legally used for fair pricing through their personal information.
Gabriel Araújo Souto is an Ambassador of the American Bar Association Section of Antitrust Law’s Law Student Ambassador Program. He was a visiting student of the Global Antitrust & Economics LLM at Antonin Scalia Law School of George Mason University. He is a researcher at the Brazilian Institute of Public Law (IDP).
 See generally Kirsten Korosec, This Is the Personal Data that Facebook Collects — And Sometimes Sells, Fortune (Mar. 21, 2018), http://fortune.com/2018/03/21/facebook-personal-data-cambridge-analytica/.
 Art. 4 (4) of GDPR defines profiling as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”. See European Commission, General Data Protection Regulation (2016), http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf.
 See Frederick G. Crane, Insurance Principles and Practices, John Wiley & Sons, 1st edition 385 (1980) (stating that rates and premiums prices are based and selected by the amount of data).
 Id, at 395 (stating that premiums prices vary by the type of information).
 See generally Jack Torrance, Could social media posts really determine your insurance premiums?, Management Today (Nov. 02, 2016), https://www.managementtoday.co.uk/social-media-posts-really-determine-insurance-premiums/future-business/article/1414322.
 See generally Kevin Peachey, Facebook blocks Admiral’s car insurance discount plan, BBC Business (Nov. 02, 2016), https://www.bbc.com/news/business-37847647.
 See Alexandra Ma, China has started ranking citizens with a creepy ‘social credit’ system — here’s what you can do wrong, and the embarrassing, demeaning ways they can punish you, Business Insider (Oct. 29, 2018), https://www.businessinsider.com/china-social-credit-system-punishments-and-rewards-explained-2018-4.
 See Casey Hynes, How Social Media Could Help The Unbanked Land A Loan, Forbes (Apr. 25, 2017), https://www.forbes.com/sites/chynes/2017/04/25/how-data-will-help-drive-universal-financial-access/#4077bfcd57e6.
 See Michael Osakwe, Do Insurance Companies Look at Your Social Media Profiles?, NextAdvisor Blog (Jul. 06, 2015), https://www.nextadvisor.com/blog/insurance-companies-social-media-profiles/.
 Article 22 of GDPR states that “The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”. European Commission, supra note 2.
 See generally Rhiannon Webster, GDPR Deep Dive: Profiling in the Insurance Industry, DACbeachcroft (Jun. 21, 2016), https://www.dacbeachcroft.com/es/gb/articles/2016/june/gdpr-deep-dive-profiling-in-the-insurance-industry/.