Usage-Based Insurance: Data Scope, Subcontractors, and Secondary Use
Summit Auto launched a usage-based insurance program in 12 states using a mobile app plus an OBD-II dongle that collect GPS location, hard-braking events, time of day, and phone-handling signals. Enrollment is 62,000 policyholders, 71% opt-in, with a 5-25% discount. Four issues have surfaced. First, the app collects location continuously, including when the policyholder is a passenger or riding in another vehicle. Second, the vendor's SDK transmits raw GPS to a third-party analytics firm under a subcontract the privacy notice never mentions. Third, a state insurance department has asked for the actuarial justification for using phone handling as a rating variable and whether it proxies for age or occupation. Fourth, marketing wants to use driving data to generate life insurance leads through an affiliate. Telematics rules vary: one state requires opt-in consent and annual re-consent; another treats driving data as consumer report data.
1. Prioritize these four issues and explain the regulatory reasoning behind your order.
Read the worked answer
Prioritize by immediacy of legal exposure and ease of cure, not by business value.
First: the undisclosed subcontractor. Raw GPS flowing to an unmentioned third party contradicts the privacy notice and likely the vendor contract, and it is the fact most likely to convert a compliance question into a deception or unfair-practice allegation. It is also the cheapest to stop: suspend the SDK data flow, obtain the data-flow map, and confirm deletion or return. Do it this week.
Second: continuous location collection. This is a purpose-limitation and minimization failure. Collecting location when the person is a passenger, or not driving, exceeds the stated purpose and, in opt-in states, exceeds the consent given. Fix the app to collect only during confirmed driving sessions, update the notice, and re-consent where the state requires it, including the annual re-consent state.
Third: the rating-variable justification. This is a substantive actuarial and unfair-discrimination question with a regulator waiting, but it is answerable with methodology and testing rather than by an immediate operational shutdown.
Fourth: the affiliate marketing proposal. Nothing has happened yet, so the decision is preventive: decline or redesign.
Note the interaction: the consumer-report classification in one state raises FCRA-style obligations, including adverse-action handling if a discount is denied, which must be built into the rating answer.
2. The department asks whether phone handling is a defensible rating variable. How do you analyze and respond?
Read the worked answer
Defensibility rests on three tests: measurement validity, statistical relationship to loss, and absence of prohibited proxy effects.
Measurement validity. A phone sensor cannot reliably distinguish driver from passenger, and the dongle-plus-phone pairing only partly solves this. If the variable systematically captures passenger trips or rides in other vehicles, it is measuring the wrong thing, which undermines both fairness and actuarial soundness. Correct the data first: attribute events only to confirmed driving sessions, and quantify the misattribution rate.
Relationship to loss. Show correlation with claim frequency and severity in Summit's own book, with credibility disclosed, and confirm the variable is not simply duplicating mileage or time of day. Provide the filed algorithm and the sensitivity of the discount to the variable.
Proxy analysis. Test phone-handling rates against age, occupation, income proxy, and geography. Occupations that involve driving or hands-free work calls could be penalized, and if those occupations correlate with protected characteristics, the carrier has an exposure even with accurate sensors.
Response to the department: present the measurement correction, the loss relationship, the proxy testing, and a mitigation. A credible mitigation is to offer an alternative rating path that does not require phone sensors, such as mileage plus hard braking, so no insured is forced to accept a variable they cannot control. If the proxy test shows material disparity that cannot be explained by loss, drop the variable rather than defend it.
3. Design the governance model for the program and give a recommendation on the affiliate life-insurance lead proposal.
Read the worked answer
Governance. Establish a cross-functional data governance group with legal, privacy, actuarial, product, and security authority, owning: a data inventory and use register that maps each element (GPS, braking, time of day, phone handling) to permitted purposes by state; a consent matrix reflecting the opt-in and annual re-consent state and the consumer-report state; contractual controls over subprocessors including approval rights, purpose limits, deletion, and audit; a documented retention schedule; and an annual privacy impact assessment. Report data-flow changes to the group before release, not after. Add a monitoring test that compares actual SDK transmissions against the published notice quarterly.
Affiliate lead proposal: recommend no, or a strictly redesigned yes. Using telematics data to generate life insurance leads is a new purpose the policyholder did not consent to. It raises GLBA privacy and affiliate-sharing issues, FCRA affiliate marketing rules, state insurance privacy rules, and, if the driving data influences life underwriting, adverse-action obligations. It also creates a coercion problem: if the discount feels conditioned on marketing consent, the original opt-in becomes questionable.
If the business wants it, the design is: separate, explicit, unbundled opt-in describing the specific use; no conditioning of the UBI discount on that consent; use of de-identified or aggregate data only; legal review of every state; and a clear record that declining the marketing consent has no effect on price. Absent that, keep rating data siloed from marketing.