to think that this is bloody well GDPR wrongness?

[GastonHaugh]

Some details changed to protect the innocent but anyways

My brother had an accident and went off sick. His injuries are pretty shocking, including some brain trauma which wasn’t obvious initially. He’s been on long term sick ever since and his company (massive construction) have a policy they use which covers a portion of his income whilst he is off.

The insurance company they use rrgaularly reviews his claim and he’s not getting better any time soon. His solicitor suggested getting a Subject Access Request on the insurer to see what they were thinking long term and it turns out he’s been under surveillance. I think that the contact with the surveillance company should have been included in the disclosure but it hasn’t been and the insurer is saying that it’s their data, not his. But how can that be? They’ve disclosed who he is and the case in order to commission the surveillance!

Am I right? Is this a breach?

I've made subject access requests before. They've not been required by law to share literally every bit of information they hold about me. Much of the correspondence has been redacted and simple states 'request for X to make appointment with me'.
The request asking someone to 'spy' might be 'sensitive' eg let's say on a friend FB it shows a sports team photo of your husband it might be that they went to a training session or hung around in the bar on the off chance he was there either playing or 'hobbling about' when he said he was in traction. If you knew this and you were a fraudster it might compromise Investigation. It could be that the insurers had said Start at Small-town FC on a weds......OK just hypothetical scenarios, but a SAR doesn't mean you get to see everything ever recorded about you.

Of course it's legal, not everyone is honest.

I had a temporary job dealing with claims against a public sector organisation. They tailed people who claimed to be bedbound and filmed them doing things like going to the gym

Thankyou. His cognition is such that he can sort of get along every day but this sort of thing blows him away. He can’t sort of process it, so it’s kind of fallen to me to dig through. He was filmed a few years ago when they tried to overturn the claim, and they filmed him with my little niece, at a kids soft play! He appealed and won, but they’ve really put him through it.

Make a complaint about how they are handling the claim instead?

Or seek legal advice on the handling of the claim ?

Or I don't know if there is an insurance ombudsman?

Ultimately focus on the big issues that you want resolving

GDPR isn't the the magic wand people assume it is.

That’s how insurance companies work - if they don’t have to pay they won’t, so they’ll keep an eye on the claimant to make sure the injuries are consistent with the claim.

If the claim hinges on him being unable to do XYZ but they can prove he can do it, then they’ll stop paying (and likely counter-claim to recover their losses).

All perfectly normal, and I’m glad they do it to keep premiums down and avoid fraud.

I have no doubt there are fraudsters. In my brother’s case he isn’t a fraud and has medical reports coming out of his ears but they do t look at the big picture, they look at ways to dislodge the claim. They included a long email chain which started with a report that THEY commissioned, where their own Occy Health man said he couldn’t go back to work, because of XYZ, and seeing as his job was at least daily doing XYZ then he was still covered by the policy.

So the next person gets that report and says “ah so his job is more than XYZ. He can do ABC. That report says he can do ABC. So he’s fine.”

Then file gets passed to next person, opening with “Bobs job includes ABC, which we have demonstrated he can do, stop paying him.”

Then they go back to Bob and say “your claim has ceased, you can do ABC” and Bob says “yeah, but, I’m employed as an XYZer and I can’t do that. Your report says that.” And then someone higher up goes “oh yeah.”

Shambolix.

I’m not suggesting it’s a magic wand. But it’s a stick. And given their conduct thus far I want to make sure they’re doing it properly.

Yes of course there is an ombudsman. Hes been down that route already once, and won.

I'm sure your brother isn't.

But the people we investigated had medical reports too. Sometimes they were just very good at hoodwinking doctors.

Like I say, I don't think GDPR is an answer., I think it would be more fruitful to lodge a complaint or look at what legal action is available

It's not even a stick really. There are a lot of exemptions (quite rightly) and the ICO has fairly limited powers.

I would try the ombudsman again if necessary

How can you tell if someone is hoodwinking a doctor? Their report is their report surely?

I’m sorry about your brother’s injuries.

Like others have said, there are exemptions and a SAR doesn’t entitle your brother to every document in which he is mentioned. The name of the company or the person that carried the surveillance out is not your brother’s personal data so I’d expect that to be redacted from any document that was disclosed to him.

If you’re looking to take out some kind of civil claim against the insurance company for breach of contract he might be entitled to more disclosure if it was relevant to the issue you were asking the court to determine but that’s a different process to a SAR under the DPA.

If they tell the doctor they can't walk but then are filmed out and about running and (in one memorable case) ice skating

Ok I see - that’s obvious stuff then. My brother’s evidence is scans etc and then comments on the scans from consultants.

Theyy have said repeatedly that the nature of his condition is degenerative but each time the claim is reviewed it’s like the insurer starts from scratch and takes a snapshot and says “Look! Here he is at soft play! How can he say he can’t work?” It’s illogical. But it’s been 20 years now so the chances of dislodging the claim are diminishing, you’d think.

Thankyou - I know the disclosure is different if either side was considering litigating but that’s unlikely.

Im just trying to make sure we have absolutely everything. They are so so slippery. The tricks they have tried over the years are horrible.

He says he wishes they would just sod off and leave him to it. There has to be a point at which it must be worth paying him off or something but they don’t seem to be looking at it that way at all.

If you suspect you don’t have everything or that they’ve failed to make a reasonable search for the information requested you need to escalate it with the company (they should have a process for this) and if you still feel they’re not responding accordingly the right to access can be enforced via court order.

I hope things work out for your brother.

Thankyou. We have written back with a list of “holes” in disclosure so I’ll see what they say.

If they are withholding information about the data you have received or withholding copies of data that they hold they should tell you what exemption they are applying to that data.

As a data subject you/your DH have various basic rights over your/his personal data but exemptions (which are mostly in the Data Protection Act) may mean the data controller is exempt from granting you that access because various data subject rights do not apply. They should tell you in their letter what exemptions they have applied and why. You can also ask them to search again. You can then challenge their decision and go through their complaints/review process. If you are not satisfied you can then complain to the ICO.

Processing has to be lawful, fair and transparent.

Sorry you and your brother are going through this, OP. Don't think I can offer any advice other than what you're already doing, but just wanted to let you know you're not alone.

I had a MH crisis some 20+ years ago and it was very similar. I'd been told by psychiatrist to 'get out & do nice things', but that didn't stop investigator following and videoing me everywhere. And not covertly, totally out in the open and with a threatening manner.

All their games, plus those of my ex-employer, made me much more paranoid than I already was, and greatly hindered my recovery.

After several years of fighting for every monthly payment I did eventually get a (very reduced) final settlement which enabled me to walk away from them both, but I only managed to rebuild my life after moving to live overseas.

Your brother's lucky to have you fighting his corner - I really hope you both get justice.

The name of the company is not withheld information about you. All that is relevant is that there is a company.

The insurance company wouldn't want to be open to you trying to bribe the surveillance people. There is likely a commercial reason too