NAIC Tills the Accelerated Underwriting Garden

• January 23, during which Deloitte provided an overview of the insurance industry and accelerated underwriting.
• February 20, during which Birny Birnbaum of the Center for Economic Justice discussed the types of consumer data used by insurers in big data analytics, perceived issues in big data, and the regulatory modernization needed to address insurers' use of big data analytics.
• March 12, during which how consumer data is collected and consumers' online activity is tracked and individual privacy rights and privacy laws were discussed.

The regulators' questions and comments, and the statements made by consumer advocates, suggest future regulatory fences may address:

1. Data Points
2. Algorithms
3. Transparency to Consumers

Data Points

Regulators learned about the blossoming variety of available consumer data, including data that is not subject to the protections of the Fair Credit Reporting Act (FCRA), and that there are many unregulated data brokers sprouting up. Concerns were raised about the:

• Use of criminal records regardless of the disposition and the discriminatory impact.
• Use of genetic information.
• Accuracy of data used and the ability of consumers to correct inaccurate data if consumers are unaware that particular data points are being used.
• Use of data that is merely correlated to risk versus reflecting causation.
• Use of data that is a proxy for discriminatory data points.

Consumer advocates urged regulators to prune consumer data used in algorithms to:

• Data that is subject to the FCRA.
• Data that is "cost-based" — i.e., for which it can be demonstrated that the data reflects an increased cost to the insurer, such as smoking.

Consumer advocates also planted the ideas that:

• Insurers should be required to report to regulators the types, sources, and manner of their use of data.
• Data brokers should be subject to the FCRA or other regulations.

Algorithms

The presenters explained how insurers are using algorithms in underwriting and the types of algorithms being used. Regulators and consumer advocates raised concerns as to algorithms:

• Being used to make actual rate class decisions versus just being used to determine if fluids, a paramedical exam, or both are required as part of the underwriting decision.
• Based on correlation versus causation.
• Based on complex models, including models that use a multitude of data points. Consumer advocates asserted that these models deviate from the traditional actuarial concept of reliability and are unexplainable because there is no clear reason for assigning an insured to a particular rate class once the various variables are raked together.
• Being layered upon one another to determine the rate class.
• Using machine learning as it might mutate the algorithms, and unintended decisions may occur or the risk models may morph without the insurer's understanding or capability of explanation.
• Being cultivated by third parties that are not regulated. Birnbaum suggested that these third parties be regulated as "advisory organizations" as the models they provide impact the rate class and pricing of the life product. He also noted that he reviewed public data as to certain vendors' "risk score" products that use various consumer data to give a score immediately.

In addition, consumer advocates suggested that the algorithms may have a disparate impact and urged that they be tested against race and ethnicity to determine if the models are discriminatory. Some regulators acknowledged that insurance by its nature involves discrimination and that unfair discrimination is hard to separate from actuarial considerations.

Transparency to Consumers

Consumer advocates urged that consumers needed more transparency as to:

• What data is being collected about them and how that data is being used. This includes consideration of the scope of consumers' consent to collect and use the data and the consumers' ability to eradicate the use of incorrect data.
• How the data impacts the decisions made by the insurer. This includes revising the definition of “adverse action” to mean "failure to receive the best."

One consumer advocate noted that users of consumer data believe they are privacy compliant because they de-identify data by clipping the personally identifiable attributes, although the data maintains a unique identifier. The advocate asserted that de-identified data can be re-identified (i) in 87% of cases if the date of birth, gender, and zip code of the consumer are known; and (ii) in 90% of cases if four purchases of the consumer are known.

Next Steps

The AU WG will continue to harvest information about insurers' use of accelerated underwriting and is seeking presentations on:

• Data, including the sources of data, the legitimacy of the data, and embedded biases of the data.
• Transparency and development of algorithms.
• Controls and governance over data.

The chair is asking for guidance as to whether the AU WG's work product should be a white paper with best practices, identification of issues, and recommendations, or a new model law.