The Life Insurance Code Compliance Committee (Life CCC) has sanctioned an insurer for collecting customers’ medical information without obtaining valid medical authority.
Between March 2020 and March 2024, the insurer requested and collected medical information during underwriting without first obtaining consent using the prescribed authority wording.
In total, 2,171 applications were affected, impacting more than 2,000 customers.
Chair of the Life CCC, Jan McClelland AM, emphasised the seriousness of the breach.
“Collecting medical information without valid consent is a serious failure of a fundamental customer protection under the Code,” Ms McClelland said.
“Customers must clearly understand what medical information is being requested, how it will be used, and how it will be protected. That transparency is central to informed consent.”
The breach occurred after the insurer temporarily reassigned staff from a business area where consent was automatically obtained as part of the application process to an area where consent was not automatically captured.
As a result, the insurer requested medical information without confirmation that valid consent had been obtained.
The insurer identified the issue following a customer complaint in early 2024 and had not been detected through the insurer’s own quality assurance and monitoring processes.
The Life CCC found that the failure reflected gaps in oversight, particularly where manual processes replaced automated controls.
“Operational changes must not compromise core compliance safeguards,” Ms McClelland said.
“This case highlights the need for strong oversight and monitoring, especially where manual steps are introduced.”
Having considered the seriousness and duration of the breach, the number of affected customers, and the insurer’s remediation efforts, the Life CCC determined that a formal warning was the appropriate and proportionate sanction.
A formal warning holds the insurer accountable for its non-compliance and reinforces the expectation that insurers must consistently meet fundamental consent requirements.
“This is a core commitment under the Code,” Ms McClelland said. “We will continue to actively monitor compliance and take action where necessary.”
Read the full case summary.
About us:
The Life CCC is an independent body established to monitor compliance with the Life Insurance Code of Practice. Its purpose is to ensure consistent and high-quality service standards are maintained for the benefit of consumers. This also works towards increasing trust and confidence in the life insurance industry.
Contact details:
