Para 20 may well cover it. I've never quite understood the substantial public interest requirement for what is essentially a private contract. Presumably there is a SPI in allowing people to insure and recover otherwise many activities would grind to a halt?
For scenario 1 I suggest you cover this contractually so that 9(2)(b) is available.
For both scenarios I would suggest 9(2)(f) may apply - clearly you have a valid legal claim against your insurer for whatever they have covered and you need to supply evidence to support it.
In neither scenario can I see consent working - it flounders on 'freely given'. Fairly obvious for employees. But can you say to a complainant - "we will only process your claim if ... " and still say freely given? *
That's GDPR - don't forget medical confidentiality may also bite you
* For this reason in health we do not process information for patient complaints "by consent" but under our statutory duty in https://www.legislation.gov.uk/uksi/2014/2936/regulation/16/made
However if no consent is provided and the complaints team cannot access the records (it is a non-care purpose) the complaint will get nowhere.
All archives of messages are stored permanently and are
available to the world wide web community at large at
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)