The right to be forgotten in Portugal: health and insurance law considerations

Tuesday 11 February 2025

Ricardo Costa Macedo

Ferreira Pinto Cardigos, Lisbon

rcm@fpclegal.pt 

The right to be forgotten plays a crucial role in both insurance law and health law, particularly when addressing sensitive health-related information.

The right to be forgotten allows individuals to request the deletion of personal data that is no longer relevant or necessary for processing, in line with the European Union’s General Data Protection Regulation (GDPR). It is particularly significant in contexts where outdated or sensitive data – like health records – can negatively impact a person’s life.

The right to be forgotten manifests strongly in insurance law: insurers rely on health data to assess risks and set premiums. However, past health conditions, even when no longer relevant to current risk levels, can lead to unjust discrimination. In Portugal, as in some other jurisdictions (eg, France), individuals who have recovered from cancer and other illnesses can invoke the right to be forgotten, ensuring their past illness does not affect their ability to obtain insurance.

Health law, on the other hand, emphasises patient confidentiality and the ethical handling of health data. The right to be forgotten aligns with the principle of autonomy in health law, allowing individuals control over their health information. It is also linked to mental health and wellbeing, as individuals may experience stigma or discrimination from outdated health records.

Insurance and health law intersect on a number of aspects, for example when it comes to access to services: the right to be forgotten right ensures fair access to insurance for individuals with a history of serious illnesses, balancing privacy rights and actuarial fairness. Moreover, both health and insurance laws aim to prevent discrimination based on irrelevant health data.

In parallel, insurers must comply with health data protection regulations under both GDPR and health-specific laws, promoting ethical use of sensitive information.

Since 2021, Portugal has issued legislation that enshrines the right to be forgotten for people who have overcome or mitigated situations of aggravated risk of health or disability (Law No 75/2021).

People who have overcome or mitigated situations of aggravated risk or risk of aggravated health or disability have, as consumers, the right to be forgotten when taking out contracting mortgage loans and consumer credit, as well as contracting compulsory or optional insurance associated with these loans, guaranteeing that they cannot be subjected to an increase in premiums or exclusion from insurance contract guarantees.

In fact, under Law No 75/2021 on the right to be forgotten, no health information relating to aggravated health risk or disability may be collected by credit institutions or insurers in a pre-contractual context or insurers in a pre-contractual context as long as an uninterrupted period of time has elapsed as follows:

  • ten years since the end of the therapeutic protocol, in the case of aggravated health risk;
  • five years since the end of the therapeutic protocol, in the event that the pathology occurred before the age of 21; or
  • two years of continuous and effective therapeutic protocol, in the case of aggravated health risk or mitigated disability.

The Portuguese Insurance and Pension Funds Supervisory Authority (Autoridade de Supervisão de Seguros e Fundos de Pensões or ASF,) has recently released a draft regulation on the right to be forgotten and prohibition of discriminatory practices.

The purpose of this draft regulation is to regulate Law No 75/2021, in particular the exercise of the right to be forgotten and the prohibition of discriminatory practices.

Under this draft regulation, insurance companies cannot collect or process health information relating to situations of aggravated health risk or disability from people who have overcome or mitigated these situations within the scope of the initial declaration of risk – namely identification and description of the pathology and therapeutic protocol. Draft rules are also proposed to address specific situations that may arise in the process of concluding the insurance contract, in particular the completion of a questionnaire delivered by the insurance company.

Under this draft regulation, the insurance company is prohibited from requesting health information regarding the possibility or mitigation of a situation of aggravated health risk or disability within the scope of the initial risk declaration.

In any case, if, as part of the initial declaration of risk, the answer to the questionnaire implies the communication of health information relating to situations of aggravated health risk, and/or the insured person has overcome or mitigated these situations, the draft regulation states that the policyholder or the insured person may answer negatively to these questions.

Despite the prohibition laid down in this draft regulation regarding the collection of health information relating to overcoming or mitigating a situation of aggravated health risk or disability, if the insurance undertaking is aware of information relating to this situation, this draft regulation establishes that the insurance undertaking may not use that information.

With regard to information duties on the right to be forgotten, this draft regulation establishes that the insurance company, prior to concluding the contract, must inform the policyholder about the right to be forgotten regime. The management body of the insurance company will be responsible for defining and approving a code establishing principles and rules of conduct.

On the other hand, the aforementioned Law No 75/2021 has amended the existing rules applicable to the prohibition of discriminatory practices. This regime identifies discriminatory practices on the grounds of disability or aggravated health risk, and prohibits practices that discriminate between physical health.

This draft regulation establishes that contractual conditions may not be proposed on the grounds of disability or aggravated physical, mental or psychological health risk of the insured that are less favourable than those that would be offered to an insured person in a comparable situation, such as increasing the premium or providing for exclusions.

Portugal has taken significant steps to legally implement the right to be forgotten in insurance law, focusing on protecting individuals who have recovered from serious illnesses. Institutions must now adapt their data collection and risk assessment practices to comply with this legal framework, emphasising privacy and fairness​.