Consent and data protection

Home›Policies›Consent and data protection

Understanding William Russell’s consent and data protection requirements. Last updated 24 August 2026.

How we protect our insured members’ data

Why this information is important to you?

At William Russell, protecting personal data, including health and other sensitive data, is not only a legal and regulatory requirement; it is also one of our highest priorities. Health, and often protection insurance, requires the collection and processing of sensitive personal data to provide quotes for cover, administer policies, manage claims, and support access to healthcare services.

Our insured members, their employers, HR teams, brokers and other authorised representatives all play an important role in protecting this information.

This page explains:

• How William Russell protects the personal and sensitive information we collect and process;
• Why consent directly from the data subject (the insured member to whom the data relates) is important and when it is required;
• Who can access an insured member’s information;
• The responsibilities of our insured members, their employers, brokers and other third-party representatives; and
• How authority (consent) can be granted to a third party to access an insured member’s personal data when support is needed.

 

What is GDPR and why does William Russell apply it globally?

The General Data Protection Regulation (GDPR) is a data protection framework designed to protect individuals’ personal and sensitive information (such as health data).

Although GDPR originates in the European Union and has been adopted in the UK under the UK GDPR, William Russell applies these principles globally because:

• The personal and health data of our insured members deserves a consistently high level of protection
• Our insured members expect their information to be protected wherever they live or access our services
• One global standard helps reduce privacy risks and supports consistent service delivery

In practice, these principles help ensure that personal and sensitive information is only shared with authorised individuals and used for legitimate insurance purposes.

 

The importance of data accuracy

Every insured member’s insurance journey begins with the provision of their personal data to us at William Russell. Accurate information is essential to ensure that:

• Applications are assessed fairly and consistently
• Policy terms and documents are issued correctly
• Members receive communications intended for them
• Claims and treatment requests can be processed fairly and efficiently
• Personal information remains protected

The provision of inaccurate data, or failure to promptly update data, can lead to data protection breaches. For example, information intended for one person is disclosed to another due to inaccurate contact details. Unauthorised disclosures may result in privacy breaches, discrimination, emotional distress, delays in accessing care and increased risk of fraud or identity theft.

Insured members, employers, brokers and other third party representatives must take care to ensure that all information provided to William Russell is accurate, complete and up to date. Please ensure you only share information necessary for the performance of the insurance contract. 

 

Claims Performance Reporting and Member Privacy

Employers and Brokers may sometimes request claims performance information to better understand insurance scheme utilisation, claims trends or overall programme performance. While William Russell recognises the value of such reporting, we must also ensure that individual members cannot be identified, either directly or indirectly.

Even where names and other direct identifiers have been removed, it may still be possible to identify an individual from information such as:

• The nature of a medical condition or treatment;
• The timing of a claim;
• The value of a claim;
• The member’s location, role or demongraphic profile; or
• A combination of multiple data points.

This risk may be increased within smaller groups of employees or insured members, where knowledge of insured members’ circumstances could make it easier to associate information with a specific individual.

For this reason, William Russell carefully assesses all requests for claims performance information and may aggregate, anonymise, restrict or withhold certain or all data where there is a risk that an individual member could be identified.

In some circumstances, where William Russell has an appropriate legal basis, including insured member consent where required, additional information may be shared. However, all requests are assessed on a case by case basis to ensure compliance with applicable data protection requirements and to protect insured member confidentiality.

 

Who can access an insured member’s information

Adult insured members aged 18 and over control access to their own personal and sensitive information. For dependents under the age of 18, responsibility and control of their personal and sensitive data rests with the insured member who holds parental responsibility, legal guardianship, or other recognised legal authority to make decisions on the dependent’s behalf.

Employers, HR representatives, brokers, family members and other third parties do not automatically have any authority to access, receive or discuss an insured member’s personal or medical information.

This applies even where:

• The employer or another third party pays the insurance premium
• A broker arranged the policy and provided us with the personal data in question
• A family member is assisting the insured member
• A parent has previously had access to the information prior to a child turning 18 years old
• Information has already been shared between parties
• An employer or broker is helping resolve a query or claim

To protect the privacy of all insured members, William Russell will require evidence of authority/consent before discussing or sharing insured member information with any third party.

 

How our insured members can authorise a third party to access their data

If an insured member would like William Russell to communicate with another person on their behalf, they must provide authorisation by completing our Third Party Consent Form and identifying the individual or organisation with whom William Russell may communicate.

Examples may include:

• A spouse or partner
• A family member
• An employer or HR representative
• A Broker or intermediary
• Another trusted represenative

Key points to note:

• A separate consent form is required for each adult member aged 18 and over
• Insured members decide with whom William Russell is authorised to communicate with
• Consent remains valid in accordance with the terms of the Third Party Consent form, until it is withdrawn or the policy is cancelled
• Insured members may update or revoke their consent at any time and do not need to inform or seek permission from the third party
• Completed forms should be submitted in accordance with the instructions provided on the form

 

Responsibilities of all parties

Protecting personal information is a shared responsibility.

Insured members should:

• Provide accurate information
• Keep their contact details up to date
• Provide consent where they wish another person to act on their behalf
• Notify William Russell if previously granted authority should be removed

Employers, HR teams and other third party representatives should:

• Ensure membership information provided to William Russell is accurate
• Avoid sharing sensitive member information without appropriate authorization
• Support members in providing consent where required
• Respect member confidentiality at all times.

Brokers and intermediaries should:

• Obtain appropriate authority before requesting access to sensitive information
• Handle personal and medical information securely
• Comply with applicable data protection requirements
• Respect William Russell’s consent requirements when acting on behalf of members.

Key points:

• A separate form is required for each adult member (18+)
• Consent remains valid until revoked or the policy is cancelled
• The completed signed form should be returned as instructed on the form

William Russell will not share any personal or sensitive data about its insured members without appropriate consent.

Important scenarios explained

Employer assistance

Where an employer offers or an employee seeks support from their employer or HR team regarding policy administration, claims or treatment matters, William Russell will require confirmation that the insured member has authorised the employer representative to act on their behalf before sharing any sensitive information.

This applies regardless of whether or not the employer is the Policyholder paying the premium.

Broker assistance

Where a broker assists an insured member with policy or claims related matters, William Russell will require evidence of the insured member’s consent before discussing personal or medical information.

A broker receiving information from insured members does not automatically provide authority for William Russell to discuss that member’s case with the broker.

Family assistance

Family members, including those with parental responsibility, do not automatically have access to an  insured member’s personal or sensitive information. Where a family member wishes to communicate with William Russell on behalf of an insured member, appropriate consent will be required.

 

Once consent is in place

Once valid consent has been provided and recorded, William Russell may communicate directly with the authorised representative regarding matters covered by that consent. Unless requested by the member, the member does not need to be copied into every subsequent communication.

 

Emergency situations and exceptional circumstances

In rare situations where an insured member is unable to provide consent, such as a serious medical emergency, loss of capacity, or where the insured member has died, William Russell may share limited information with appropriate individuals where necessary and permitted by applicable law and data protection requirements. Any such disclosure will be carefully assessed and limited to what is necessary for the specific circumstances.

 

What this means for everyone

To avoid delays and protect all parties:

• Ensure personal information is accurate and up to date
• Provide clear consent when another person needs to act on an insured member’s behalf
• Avoid forwarding sensitive information without appropriate authority
• Expect William Russell to seek clarification where authority is unclear
• Contact William Russell if additional guidance is required

Our teams will always help clarify what information or authorisation is needed and support consent being put in place as efficiently as possible.

 

Summary

Strong data protection practices benefit everyone:

• Our insured members can be confident that their personal and health information is protected
• Employers and intermediaries can support our insured members while reducing privacy risks
• William Russell can provide secure, consistent and compliant services worldwide

By working together and ensuring that appropriate consent is in place, all parties can help safeguard personal and health information.