The article was drafted by Vasiliki Kalogirou, Associate & Andreas Papastathis, Partner for Lexology on August 27, 2026
Across Europe, a history of cancer can affect access to financial services, loans, mortgages and insurance. This discrimination arises because past diagnoses are potentially treated as ongoing financial risk, thus it becomes more difficult for cancer survivors to take out insurance, they are subject to higher premiums and more limited coverage, while they are also often excluded from premium services. Article 17 of the General Data Protection Regulation (GDPR) provides for the right to erasure, pursuant to which the data subject may request that the controller erase his or her personal data without undue delay, where one of the grounds set out therein applies. These grounds include, inter alia, circumstances where the personal data are no longer necessary in relation to the purposes for which they were collected, and where the erasure of the personal data is necessary for compliance with a legal obligation to which the controller is subject under Union law. However, in the present case, the issue is not one of data erasure; rather, the matter is that such information ceases to have legal reference, may no longer be relied upon after a specified remission period. The request for information about the policyholder’s oncological medical history is not permitted, nor is it possible to acquire such information when it comes from other sources. Likewise, if this information is in any case available to the operator or financial intermediary, it cannot be used to determine the terms of the contract.
The Data Protection Dimension
In cases involving cancer, the “right to be forgotten” does not necessarily entail the physical deletion of medical records from a hospital’s or healthcare provider’s systems, since such records may legitimately need to be retained for medical, healthcare and other legally recognised purposes. Rather, in this context, the concept primarily concerns restrictions on the use and processing of such health data by insurers and financial institutions, so as to prevent an individual’s previous cancer diagnosis from being used as a basis for unjustified discrimination or adverse decision-making. In any event, from a data protection perspective, health data and medical history are afforded enhanced protection under the GDPR and, more precisely, constitute “special categories of personal data” within the meaning of Article 9 GDPR. In cases such as those involving cancer survivors, because medical data cannot be completely deleted from the healthcare system (for reasons of public health and medical history), the right to erasure (“right to be forgotten”) may operate alongside the right to restriction of processing under Article 18 GDPR. In practical terms, this means that the data are “locked”, while their further processing or use for the purpose of making decisions adversely affecting the individual may be restricted.
The Emerging EU Regulatory Framework
Τhe EU Consumer Credit Directive, published in October 2023, was the first European law to include provisions that personal information, including health data such as past cancer, should not be used to determine creditworthiness. Τhe information used to assess creditworthiness should be necessary and proportionate to the nature, duration, value, and risks of the credit to the consumer, in accordance with the data minimization principle set forth in Regulation (EU) 2016/679, and should be relevant, complete, and accurate. Under the Directive, Member States can set the period after treatment during which health data can still be used, but this cannot exceed 15 years. Later, in September 2024, the European Commission adopted a non binding Code of Conduct on fair access of cancer survivors to financial services, a self regulatory commitment by insurance undertakings to guarantee the right to be forgotten in the context of life insurance policies linked to loans. While this sets a universal framework, some national provisions can still be stricter than medically necessary. Member States will begin applying the Directive from 20 November 2026.
Therefore, the Directive introduces the right to be forgotten (oncological oblivion), which grants cancer survivors the right to not disclose their prior history when applying for life insurance. The Directive has been adopted so far by several member states, among which there is variation in the time period used for the right to be implemented (5-10 years). The said period is shorter in some Member States in case the survivor was underage when diagnosed, provided there is no relapse, as well as in case of diagnosis of non-invasive cancer. Other countries have adopted non-legislative frameworks which work as conventions between the government and the insurer, and regulatory Codes of Conduct.
The Greek Framework: From Self-Regulation to Statutory Protection
Specifically, as far as Greece is concerned, Law No. 5317/2026, which transposes said Directive, sets a five-year period starting from the completion of treatment, after which the use of personal data related to a consumer’s cancer diagnosis is prohibited, in the context of an insurance contract linked to a credit agreement. The authority responsible for supervising and enforcing this provision is the Hellenic Data Protection Authority. Previously, in 2024, a Code of Conduct had been issued, which served as a voluntary commitment by Greek insurance companies. The Code applied to life insurance policies linked to mortgage, business, or consumer loans, with a maximum total insured amount of 300,000 euros. Therefore, the Code of Conduct continues to apply in cases not covered by the scope of the Directive.
The enactment of Law 5317/2026 marks the transition from self-regulation and the Code of Conduct to statutory protection. The use of personal data relating to a consumer’s diagnosis of an oncological disease for the purposes of an insurance contract linked to a credit agreement is prohibited, provided that five (5) years have elapsed since the completion of treatment without any recurrence of the disease. The purpose of this legislative framework is: (i) equal access, (ii) fair insurance premiums, in the sense that a history of cancer may not be used as justification for excessive increases in life insurance premiums, and (iii) the protection of personal data, in the sense that insured persons are no longer required to disclose their medical history once the above-mentioned period has elapsed.
However, in order for the purpose of a legislative provision to be effectively achieved, it is also necessary to provide for legal consequences in the event of its infringement. The unlawful processing and use of such data by a bank or insurance company may trigger, on the one hand, administrative fines and, on the other hand, civil liability for damages.
Since Law 5317/2026 constitutes consumer protection legislation, the General Secretariat for Commerce & Consumer Protection may impose significant administrative fines. Furthermore, as medical data constitute “special category data”, the Hellenic Data Protection Authority may also independently impose an administrative fine. The Bank of Greece, in its capacity as the supervisory authority for insurance companies, also appears to have the power to impose sanctions in cases of non-compliance with the applicable statutory obligations and the relevant Code of Conduct. Furthermore, the consumer has the right to bring proceedings before the civil courts, seeking compensation for non-pecuniary damage resulting from the unlawful processing of their sensitive personal data and the violation of the “Right to be Forgotten”. Finally, potential criminal sanctions cannot be excluded, as Greek data protection legislation (Law 4624/2019), which is also applicable, expressly provides for criminal sanctions. Therefore, Law 5317/2026 establishes the prohibition on such use under Article 16, while the criminal prosecution of company officers or other responsible persons who violate this prohibition is based on the general criminal provisions of Article 38 of Law 4624/2019 (which constitutes the Greek implementing legislation supplementing the GDPR).
You can read the full analysis here: The Right to be forgotten and its impact on the insurance market – Lexology