- The Federal Council should amend the KVG so that case management measures are part of the statutory duties of the responsible bodies.
- The revision must create a legal basis for the processing of personal data, including particularly sensitive data and personality profiles.
- If the revised DPA comes into force, the KVG should instead provide a legal basis for profiling and automated individual decisions.
- Without amendments to the KVG, case management measures would only be possible in exceptional cases and with consent, which would jeopardize their effectiveness.
Submitted text
The Federal Council is instructed to submit a draft amendment to the Federal Health Insurance Act of March 18, 1994 (KVG), with which Case management measures in the statutory tasks of the bodiesentrusted with the implementation of this Act or the Federal Act of 26 September 2014 on the Supervision of Social Health Insurance, the control or the supervision of the implementation. The amendment is also intended to create the legal basis required for the implementation of case management measures for the processing of personal data, including particularly sensitive personal data and personality profiles.
In the event that the revision of the Federal Data Protection Act (FADP) is adopted, instead of a legal basis for the processing of personality profiles, a legal basis for profiling and the making of automated individual decisions within the meaning of the future FADP must be provided. This applies to all statutory tasks of the aforementioned bodies.
Justification
Case management measures are not part of the catalog of tasks under the KVG. Consequently, the bodies entrusted with the implementation of this Act cannot rely on this Act for the processing of personal data with regard to these measures. In this case, exclusively Article 17(2)(c) DPA applicable. Thus, health insurers may only use personal data for case management measures in exceptionally and after obtaining the consent process the data subject in the individual case. These requirements impair the effectiveness of the measures and threaten to prevent their development and the associated benefits for the insurance companies and the persons concerned. For the case management measures, particularly sensitive personal data must be processed, but personality profiles must also be created. The legal basis for processing must consequently also include these special categories of personal data.
The draft revision of the FADP abolishes the concept of personality profiling and introduces the concept of profiling and automated individual decision-making. In the event that the draft revision is adopted, the legal basis in the KVG must be adapted and provision made for the competent bodies to be able to carry out profiling and issue automated individual decisions for case management measures and their other statutory tasks.