Health Insurance Form Asking About Applicants' Sex Lives (2020-10-12)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint. A complainant objected that a health/medical insurance application form asked male applicants whether they had ever engaged in homosexual activities, arguing this amounted to unlawful collection of sensitive personal data.

• Finding: The data controller admitted it had no legal basis under the Data Protection Law (DPL) to process this sensitive personal data about applicants' sexual activity.
• Remedial action taken: The controller voluntarily removed the question from the insurance form, deleted all data already collected in response to it, and undertook a full review of other client-facing documents for DPL compliance.

This is a case outcome notice rather than a rule or policy statement, but it illustrates the Ombudsman's expectation that data controllers only collect sensitive personal data where a clear legal basis exists, and that controllers should proactively remediate and review other forms when such issues are identified.

Applies to

data controllers, health/medical insurance providers