horwich farrelly

Intervention schemes and the General Data Protection Regulation (GDPR)

May, 22, 2018

Since judgment in Copley v Lawn was handed down on 2009, intervention has been one of the strongest, if not the strongest, weapon in an insurer’s fight against credit hire. There have been many failed challenges in the subsequent years and it now appears that credit hire operators (CHOs) and their panels may attempt to use GDPR as a way of challenging intervention strategies.

Investigator at computer

Our view is that GDPR will not outlaw the practice of intervention.

Intervention relies upon the obligation of parties exchanging details at the scene of the accident, which are then passed on to the at fault driver’s insurers. The question now being asked is whether using that information could be a breach of GDPR when it comes into force this Friday, 25 May?

The main reason for concern may have resulted from the specific media focus upon the forthcoming change in rules for consent (to process a subject’s data), the ‘bar’ now set to be much higher in terms of lawful processing on that basis.

Our view is that GDPR will not outlaw the practice of intervention as GDPR has not materially changed the current position under Schedule 2 of the Data Protection Act 1998. Both provide a lawful basis for processing this type of data under a separate principle of ‘legitimate interest’.

An insurer availing itself of this provision will need to show:

  • What the legitimate interest is;
  • That processing the data is necessary to achieve it; and
  • That processing the data maintains a balance between the individual’s interests, rights and freedoms and those of the insurer.

Following a road traffic accident where details have been exchanged, the non-fault party can reasonably expect those details to be passed on to the at fault driver’s insurer. There is minimal impact on the potential claimant’s privacy and they are unlikely to suffer any harm. On the other hand, the insurer has a legitimate commercial interest in seeking to offer assistance to the innocent party, at a cost likely to be lower than if other providers become involved.

What the insurer must do, however, is ensure that any intervention scheme is properly set up and documented with GDPR in mind. This will include setting out clearly what the legitimate interest relied upon is (following an assessment); identifying that there is no reasonable alternative way to achieve the same end; that the innocent party’s data will be protected and used for no other purpose; and that when they are contacted they are offered the opportunity to opt-out should they not wish to accept the services offered.

This is clearly an issue that needs immediate consideration by insurers. Our experienced credit hire team will be willing to discuss the available options on any revision to your intervention process and the subject will be a topic raised at our summer credit hire forum which takes place on Wednesday 20 June 2018 in Manchester. For further details or to register your interest please contact our events team.

We use cookies to anonymously track the pages our visitors interact with. See our data policy and privacy policy for more information. Please click to indicate your acceptance

Contact us

If you would like further information about any of our specialists or the services we offer please get in touch.


Any information provided via this form will not be used for marketing purposes or shared with third parties without your prior consent