INSURANCE USE OF CONTINUOUS MONITORING DATA RESTRICTIONS – DETAILED EXPLANATION WITH CASE LAWS

1. Introduction

Continuous monitoring data refers to information collected regularly or continuously through wearable devices, smartwatches, fitness trackers, implanted medical devices, remote patient-monitoring systems and mobile health applications.

Such devices collect personal information relating to an individual's health, lifestyle and behaviour, including heart rate, blood pressure, blood glucose levels, sleep patterns, physical activity, body temperature and medication adherence.

Insurance companies may use this information to assess risk, calculate premiums, determine eligibility, investigate claims and develop personalised insurance policies.

However, the use of continuous monitoring data raises important legal and ethical concerns relating to privacy, informed consent, discrimination, confidentiality, data protection and consumer rights.

Insurance Use of Continuous Monitoring Data Restrictions refers to legal limitations imposed on insurance companies when collecting, accessing, analysing, sharing or using information generated through continuous monitoring technologies.

2. Legal Framework Governing Insurance Use of Monitoring Data in India

A. Constitution of India – Article 21

Article 21 protects the right to life and personal liberty, including the right to privacy.

In K.S. Puttaswamy v. Union of India (2017) 10 SCC 1, the Supreme Court recognised privacy as a fundamental right.

This judgment is important because continuous monitoring data may reveal highly personal details about an individual's health, medical conditions and daily activities.

Insurance companies must therefore respect individuals' privacy and avoid unjustified collection or disclosure of personal information.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 provides a framework for processing digital personal data in India.

Its important principles include consent, lawful processing, purpose limitation, data security, accuracy and appropriate deletion of personal information.

For example, if an individual provides smartwatch information for a wellness programme, the insurer cannot automatically assume that the information may also be used for unrelated commercial purposes.

C. Insurance Regulatory and Development Authority of India (IRDAI)

The IRDAI regulates insurance companies and protects policyholders in India.

Insurance companies must follow applicable underwriting requirements, product disclosures, policyholder protection standards and fair claims-handling practices.

Insurers should not use continuous monitoring information arbitrarily or beyond legitimate insurance-related requirements.

D. Information Technology Act, 2000

The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 provide an important framework for protecting sensitive personal information, including certain health and biometric information.

E. Insurance Contract Law

Insurance contracts are governed by principles of utmost good faith, fair disclosure, contractual interpretation and protection against unfair practices.

Monitoring information should not automatically become conclusive evidence of fraud or material misrepresentation.

3. Major Restrictions on Insurance Use of Continuous Monitoring Data

A. Restriction on Collection Without Informed Consent

Insurance companies should clearly explain what monitoring information they intend to collect and why it is necessary.

Consent should not be hidden in lengthy contractual documents or obtained through misleading practices.

B. Restriction on Excessive Data Collection

Insurers should collect only information reasonably necessary for the disclosed insurance purpose.

For example, collecting heart-rate information may be relevant to a wellness programme, but collecting unrelated private messages or browsing history would raise serious privacy concerns.

C. Restriction on Unauthorised Secondary Use

Information collected for one purpose should not automatically be used for another purpose.

For example, information collected to provide wellness rewards should not automatically be shared with marketing companies.

D. Restriction on Unfair Premium Discrimination

Insurance companies may use relevant risk-related information where permitted by applicable law.

However, individuals with disabilities, chronic illnesses or unusual working schedules may produce different monitoring results.

Insurers should not automatically classify such individuals as high-risk without considering relevant circumstances.

E. Restriction on Automatic Policy Rejection

An insurer should not rely blindly on an algorithm or wearable-device reading to reject insurance coverage.

Risk assessment should be based on appropriate underwriting standards and applicable law.

F. Restriction on Disclosure to Third Parties

Continuous monitoring information may be shared with reinsurers, third-party administrators, healthcare providers and technology companies.

Such sharing must comply with applicable legal requirements and appropriate confidentiality safeguards.

G. Restriction on Indefinite Data Retention

Insurance companies should not retain monitoring information indefinitely without a legitimate reason.

Personal data should be retained only for the period necessary for the relevant purpose or as required by applicable law.

H. Restriction on Using Unreliable Device Data

Wearable devices may produce inaccurate readings because of technical faults, incorrect positioning or software errors.

Insurers should verify the reliability of information before using it for important underwriting or claims decisions.

4. Important Case Laws

1. K.S. Puttaswamy v. Union of India (2017) 10 SCC 1

Facts: The case concerned whether the right to privacy was protected as a fundamental right under the Constitution of India.

Judgment: The Supreme Court unanimously recognised privacy as a fundamental right under Article 21 and other constitutional freedoms.

Legal Principle: Privacy includes personal autonomy, dignity and control over personal information.

Relevance to Insurance: Insurance companies collecting continuous health-monitoring information must respect individuals' privacy. Unjustified collection, disclosure or use of personal health data may raise constitutional and statutory concerns.

2. Justice K.S. Puttaswamy v. Union of India (2019) 1 SCC 1

Facts: The case examined the constitutional validity of the Aadhaar framework and the collection and use of biometric and personal information.

Judgment: The Supreme Court upheld the Aadhaar framework subject to constitutional limitations and safeguards, while striking down or restricting certain provisions.

Legal Principle: Collection and use of personal information must satisfy constitutional standards, including legality and proportionality.

Relevance to Insurance: Insurers should not collect more monitoring information than reasonably required for a legitimate purpose.

3. District Registrar and Collector, Hyderabad v. Canara Bank (2005) 1 SCC 496

Facts: The case involved the authority of public officials to inspect private documents and records maintained by banks.

Judgment: The Supreme Court recognised the importance of privacy in private documents and records.

Legal Principle: Private records cannot be subjected to arbitrary interference.

Relevance to Insurance: Medical and monitoring records contain sensitive personal information. Their collection and disclosure must follow lawful procedures and appropriate safeguards.

4. Life Insurance Corporation of India v. Consumer Education & Research Centre (1995) 5 SCC 482

Facts: The case concerned discriminatory terms and conditions in life insurance policies offered by LIC.

Judgment: The Supreme Court emphasised fairness, reasonableness and non-arbitrariness in insurance practices, particularly where a public authority is involved.

Legal Principle: Insurance-related decisions by public authorities must satisfy constitutional standards of fairness and equality.

Relevance to Insurance: This principle supports scrutiny of unfair insurance practices, including arbitrary premium differences or discriminatory treatment based on monitoring information.

5. Reynolds v. State Farm Life Insurance Company (2025 IL App (2d) 240399)

Facts: The plaintiff alleged that State Farm required genetic information as part of life insurance underwriting and that this violated the Illinois Genetic Information Privacy Act.

Judgment: The appellate court held that the particular statutory underwriting restriction relied upon by the plaintiff did not apply to life insurance underwriting.

Legal Principle: The scope of protection against insurers' use of sensitive personal information depends on the precise wording and coverage of applicable legislation.

Relevance to Insurance: The case demonstrates that restrictions applying to health insurance cannot automatically be assumed to apply to life insurance.

5. International Legal Framework

A. General Data Protection Regulation (GDPR), European Union

The GDPR provides strong protection for personal data, particularly health information.

Article 9 generally prohibits processing personal data concerning health unless a specified legal exception applies.

It also establishes safeguards concerning transparency, data minimisation, security and automated decision-making.

B. Health Insurance Portability and Accountability Act (HIPAA), United States

HIPAA protects protected health information handled by covered entities and their business associates.

It regulates the use and disclosure of protected health information and establishes security obligations.

However, not every wearable-device manufacturer or consumer health application is covered by HIPAA.

C. Genetic Information Nondiscrimination Act (GINA), 2008

GINA prohibits specified forms of genetic discrimination in health insurance and employment.

However, its protections do not generally extend to life insurance, disability insurance or long-term care insurance.

Although ordinary wearable measurements are not necessarily genetic information, the legislation demonstrates the importance of specific legal protections for sensitive personal information.

6. Practical Examples of Restrictions

An insurer requests smartwatch data: informed consent and lawful collection must be considered.

An insurer increases premiums based on health readings: fairness and non-discrimination concerns arise.

An insurer accesses GPS history: privacy and authorisation requirements apply.

An insurer shares data with advertisers: unauthorised secondary use may arise.

An insurer rejects claims based on device readings: reliability and evidentiary standards must be examined.

An insurer stores data indefinitely: data retention and security requirements become relevant.

7. Legal and Ethical Challenges

Privacy Infringement: Continuous collection may reveal intimate details about individuals.

Discrimination: Individuals with disabilities or chronic illnesses may receive unfavourable insurance treatment.

Lack of Transparency: Customers may not understand how insurers calculate risk scores.

Algorithmic Bias: Artificial intelligence systems may produce inaccurate or discriminatory decisions.

Cybersecurity Risks: Databases containing health and biometric information may become targets of cyberattacks.

Consent Difficulties: Customers may feel compelled to share information to receive financial incentives.

Evidentiary Uncertainty: Device readings may be incomplete, manipulated or technically inaccurate.

8. Recommendations for Better Legal Regulation

Require clear and informed consent before collecting continuous monitoring information where consent is the applicable legal basis.

Establish strict limits on unnecessary health and location information collection.

Require insurers to disclose how monitoring data affects underwriting and premium calculations.

Prevent unfair discrimination based on disability or unrelated personal characteristics.

Introduce independent audits of automated insurance risk-assessment systems.

Provide customers with procedures to challenge inaccurate monitoring information.

Establish strict cybersecurity and confidentiality requirements.

Restrict unauthorised sharing of personal health information with third parties.

Require appropriate deletion or anonymisation when personal information is no longer legally required.

Strengthen regulatory supervision and grievance-redressal mechanisms.

9. Conclusion

Insurance use of continuous monitoring data is an important development in modern insurance law. Wearable devices, medical sensors, smartwatches and digital health applications allow insurers to evaluate risks more accurately and encourage preventive healthcare.

However, continuous monitoring creates serious concerns regarding privacy, discrimination, informed consent, data security and individual autonomy.

In India, Article 21 of the Constitution, the Digital Personal Data Protection Act, 2023, applicable IRDAI regulations and consumer protection principles provide important legal safeguards.

Judicial decisions such as K.S. Puttaswamy v. Union of India and LIC v. Consumer Education & Research Centre establish principles relevant to protecting individuals against unjustified interference and unfair insurance practices.

Ultimately, insurers should use continuous monitoring data only within lawful, transparent and proportionate limits. The purpose of insurance technology should be to improve risk management and healthcare outcomes without compromising the privacy, dignity and fundamental rights of policyholders.

10. References and Important Legal Authorities

Constitution of India – Article 21.

Digital Personal Data Protection Act, 2023.

Information Technology Act, 2000.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

IRDAI (Health Insurance) Regulations, 2016.

General Data Protection Regulation, 2016.

Health Insurance Portability and Accountability Act, 1996.

Genetic Information Nondiscrimination Act, 2008.

K.S. Puttaswamy v. Union of India (2017) 10 SCC 1.

Justice K.S. Puttaswamy v. Union of India (2019) 1 SCC 1.

District Registrar and Collector, Hyderabad v. Canara Bank (2005) 1 SCC 496.

LIC of India v. Consumer Education & Research Centre (1995) 5 SCC 482.

Reynolds v. State Farm Life Insurance Company (2025 IL App (2d) 240399).

Important Note: There is no general rule prohibiting all use of continuous monitoring data by insurers. Its legality depends on the type of information, purpose of processing, applicable insurance regulations, lawful basis and required safeguards.