Non-disclosure scoring using commercial bureau data
A life insurer is developing a non-disclosure risk model for new protection applications. The model combines application data with a commercial data bureau that aggregates social-media activity, address stability and online retail behaviour. In a retrospective test on 20,000 applications, the model flags 3.1% as high risk; 42% of flags are later confirmed as material non-disclosure, but the false-positive rate is 1.8%. Flag rates are 2.4 times higher in the most deprived postcode decile and 1.6 times higher for applicants with non-UK birth country. The insurer plans to use the score to require additional medical evidence and, in some cases, to decline cover. The marketing team also wants to use it for cross-selling. The data protection impact assessment is incomplete. The actuarial function has been asked for an opinion.
1. Identify the ethical and professional issues and recommend whether the model can be used for underwriting.
Read the worked answer
Use for underwriting should pause; marketing use should be refused. The bureau data were not collected for insurance underwriting, so purpose limitation, data minimisation and lawful basis need clear documentation. A completed DPIA is a precondition, especially because the score may lead to extra medical evidence or decline. The model is not merely predictive: it allocates burdens and can produce false accusations. The 1.8% false-positive rate matters because it falls on applicants who may then face medical tests or refusal. Higher flag rates by deprived postcode and non-UK birth country require explanation: if they reflect proxy discrimination or different data coverage, using the score may be unfair and potentially unlawful. Underwriting could be defensible only with evidence of necessity and proportionality, human review of adverse decisions, explanations and no use for marketing. The actuarial opinion should separate predictive validity from ethical and legal acceptability.
2. Design fairness and explainability testing for the score, and describe possible mitigations.
Read the worked answer
Define protected and proxy groups in advance, including postcode deprivation and birth country. Test flag rates, false-positive and false-negative rates, calibration and model lift by group, and check whether removing or constraining postcode and social-media variables materially changes them. Use SHAP or reason codes to see whether decisions are driven by proxies. Consider alternative data with better provenance. A fairness threshold should be agreed by the model risk and conduct committees, not chosen after seeing results. Where disparities remain, mitigations include human review, requiring corroborating evidence before adverse action, and not using the score as the sole reason. Document trade-offs. Monitor outcomes after deployment and allow appeals; explain to applicants in plain language what data are used and how to challenge errors.
3. Advise the insurer on the marketing team's request to use the score for cross-selling.
Read the worked answer
No for cross-selling. Using underwriting risk scores to target sales is a new purpose, likely incompatible with the original basis and damaging to trust. Consent obtained under pressure in an application is unlikely to be valid, and ePrivacy rules may apply to online behavioural data. Marketing use would also create a perverse incentive to sell to people flagged as risky. If the insurer still wants to explore it, it needs a separate lawful basis, a new DPIA, opt-in consent, independent oversight and evidence that vulnerable customers are not targeted. The safer professional recommendation is a clear purpose limitation: the score may be used only for underwriting, with human review, and not shared with marketing.