Many insurance companies have been in business forhundreds of years. Their brands are often household names and evokea sense of tradition consistent with their long histories. However,the ways in which insurance products are designed, advertised,underwritten, sold, and administered are undergoing rapidchange—the business of insurance, like almost every other majorindustry, is increasingly a high-tech venture. The impact of thesehigh-tech changes on the global economy, including the use ofartificial intelligence (AI), big data, the internet of things,augmented reality, and robotics, has been hailed by some as the“Fourth Industrial Revolution.”

This coming revolution is conspicuous in some industries.Self-driving cars are already navigating publicstreets in California; our homes are becoming populated withinternet-connected devices like the Nest, the Amazon Echo, and smart TVs; and, of course, our trusty smartphones areincreasingly integrated into every minute of our professional,personal, and social lives.

While its effects are perhaps not as conspicuous as with someother industries, the Fourth Industrial Revolution is changing theinsurance industry, too. Major insurancecompanies now have an information conduit into your living roomthrough Amazon Echo “skills” (i.e., software akin to smartphoneapps). Insurers or other third parties have an information conduitinto your car when on-board computers, OBD-IIdongles, or your smartphone collect telematics informationabout your driving habits. And, with their fintech partners,insurers literally have their finger on the pulse of insureds whenthey collect biometric information through Fitbits and otherwearable devices.

Insurance companies and their business partners, as well as theconsumers they serve, can benefit greatly by standing at the nexusof these new information streams. Telematics information flowingfrom smart cars can lead to premium discounts for consumers withsafe driving habits, while simultaneously helping insurers avoidclaims fraud. The biometric information from Fitbits provides a wayfor physically active consumers to get premium discounts or rebates,while simultaneously helping insurers incentivize healthy behaviorand reduce the cost of risk they insure.

Further, predictive analytics and machine learning algorithms(forms of AI), can “mine” the vast amount of data generated bythese technologies to assess underwriting risk in new ways. Whether we see it ornot, these innovations are pushing the insurance industry to thecutting edge of the Fourth Industrial Revolution.

However, notwithstanding these considerable benefits to bothinsurers and consumers, the fact that such vast and varied amountsof consumer data are being collected, housed, and used introducesnew risks to consumers’ privacy and to the security of theunderlying information systems managing the data. These risksaffect both consumers and insurance companies, along with theirfintech and other business partners. This article will address someof these risks in three areas: cybersecurity risks, big dataanalytics, and online behavioral advertising.

Cybersecurity Risks

The most overt and highest-profile risk in this space is therisk of a cyber incident leading to a data breach, data destructionor corruption, or ransomware attack. Over the last few years,several major insurers have suffered cyberattacks resulting in thebreach of sensitive consumer information. In 2015, for example, acyberattack led to the release of information forup to 91 million policyholders at Anthem Blue Cross Blue Shieldand Premera Blue Cross. Full names, addresses, social securitynumbers, personal health information, and other data werecompromised in these breaches.

Cyberattacks on insurance companies and their business partners,and associated data breaches, are extremely costly in terms ofremediation, class action litigation, regulatory enforcementactions, enhanced cyber-regulatory standards, more spending oncyber defenses, and brand damage. Further, the legal landscapearound cybersecurity is rapidly evolving, which creates ongoingcompliance risks. However, the complex attribution, enforcement,and litigation issues raised by cyber incidents can also bemitigated by appropriate contractual measures and otherprotections.

Big Data Analytics

Big data programs also raise privacy risks and legaluncertainties as insurance companies increasingly rely on big dataand AI to offer accelerated underwriting, to create finelysegmented risk profiles to price insurance, or to targetadvertisements for insurance products. While these methods have thepotential to reduce costs and increase efficiencies for insurersand their service providers, as well as some classes of insureds,companies using big data programs should be mindful of the complexlegal landscape in which they operate.

First, big data programs should ensure they provide transparencyabout what data is collected and how it is stored, analyzed, usedand shared. For example, machine learning algorithms may be able tofind novel correlations between consumer behavior and lowerunderwriting risk profiles. However, due to the way thosealgorithms are designed and processed, the humans relying on themmay not be able to explain why such correlationsexist.

Many machine learning algorithms are, in that sense, “black boxes” that leave the humans using themin the position of having to simply trust that the correlationsproduced by the algorithms are not spurious, or worse, that they donot have unlawful discriminatory effects. The relevance of certainunderwriting criteria, such as credit scores, have long been questioned by consumeradvocates, while today, critics question how counterintuitivefactors, such as web browsing behavior, purchasing behavior, andonline reputational data from websites like Yelp are being used in pricing and underwritingprocesses.

Further, the quality of the outputs of machine learningalgorithms is limited by the quality of the data inputs theyreceive. While the Fair Credit Reporting Act provides consumerssome protection against the use of inaccurate data in insurancedecision-making, not every kind of data, nor every aspect of theinsurance process, is covered. This can lead to, for example,accelerated underwriting being unavailable to some applicants dueto incomplete or inaccurate information in the data profiles thatdata brokers have compiled for them.

Online Behavioral Advertising

Increasingly prevalent concerns have also arisen from the use of online behavioraladvertising (OBA) by insurers and their business partners. OBAis “the practice of tracking an individual’s online activities inorder to deliver advertisements tailored to the individual’sinterests.” While many consumers appreciate targeted advertisingbecause it increases the relevance of the ads they see, others findthe tracking, collection, and analysis of data about their onlinebehavior to be unsettling. OBA is also increasingly able to track users acrossdevices.

With the ongoing proliferation of the internet of things(including the smart TV and Amazon Echo in consumers’ living rooms,connected cars on the road, and everything in-between), thistracking is becoming nearly ubiquitous, and raises questions aboutwhether appropriate consents for the collection, retention andsharing of personal information have been obtained. For example,most privacy policies strictly limit and control the use ofpersonal data to the purposes for which it was originally collectedunless user consent is obtained.

OBA also presents risks for insurance companies. For instance,companies are exercising more caution with their use of OBA after astring of incidents in which the advertisements of major brandsappeared near troubling and offensive content on a website. Forexample, Allstate had to reconsider some of its OBA practices afterone of its banner ads was displayed on a website claiming the Sandy Hook massacre was a hoax.When the user is being directly tracked and targetedthrough OBA, the ads can follow them wherever they go. Insurancecompanies are still grappling with the risks associated with thatpractice.

Insurers and their business partners need to carefully considerwhether their current practices involving the collection, storage,and use of personal data need to be upgraded to enable theirhigh-tech programs to proceed. These companies should be taking ahard look at their data security practices, data transparency,allocation of responsibilities among themselves and vendors, datasharing and anonymization practices, all while analyzing whethertheir multifaceted uses of consumer data are lawful.

The Fourth Industrial Revolution is already leading to realbenefits for both insurers and consumers. However, a robustunderstanding of the technologies driving this Revolution isessential to coping with the new risks that come along with it,both for consumers and the insurance companies serving them.