A motor claim is one of the most complicated data objects that exist in insurance. It mixes personal data from two drivers who do not know each other, contract data from two competing insurers, photographs taken by one party that matter to the other, a workshop quote, a loss adjuster's report and, when there are injuries, health data, which is a special category. And all of that data has to circulate between parties with different interests for the claim to be resolved.
The traditional way of managing that has been forwarding: the report is sent by email, copied to the workshop, attached for the loss adjuster, uploaded to the insurer's platform. Every forward is an uncontrolled copy, and every copy is a data protection problem waiting to happen.
Three questions a claim file has to answer
Who does each piece of data belong to? Not the claim file, each piece of data. Driver A's data belongs to A. B's belongs to B. The circumstances and the sketch are shared, because both parties sign them. The photographs belong to whoever took them. The policy and cover belong to the insurer and the policyholder. The quote and invoice belong to the workshop. The valuation report belongs to the loss adjuster or whoever commissioned it. And health data belongs to the data subject, under a separate regime.
Who can see each piece of data? The default answer has to be nobody. Access is an explicit grant, at segment level rather than claim-file level, given by whoever contributes the information and the parties to the claim file. A workshop sees what it has contributed and the reference; it does not see the other driver's data, because it does not need it.
Who saw what, and when? Every consent, every access, every delivery and every denial has to be kept in a log that cannot be altered, with date, requester and authoriser. When someone asks, and someone eventually does, the answer is already written.
Owner and contributor are not the same thing
There is a distinction most systems do not make, and it changes everything: whoever uploads a piece of data is not necessarily its owner. A fleet manager can attach a workshop invoice; the invoice still belongs to the workshop. A driver can upload a photograph of the other party's vehicle registration document; the data still belongs to the other party. If the system confuses contributor with owner, the fleet manager ends up owning data that is not theirs, and the permissions model stops meaning anything.
At Acciparte, the owner of each segment and whoever contributed it are two separate fields, and the permissions engine treats them as such.
Health data, kept apart
When there are injuries, health data appears: the injury, the medical centre attended, the medical report. This is a special category under Article 9 of the GDPR and cannot be treated like the rest of the claim file. The solution is not to protect it more within the same circuit; it is to take it out of the circuit. At Acciparte, special-category segments are isolated from the rest of the claim file, never fall under policy-based permissions, and only circulate with the data subject's explicit, case-by-case consent. A deployment can also be limited to material damage and leave health data out entirely.
Who is controller and who is processor
In a B2B deployment, the company that contracts (the fleet, the dealership, the broker) is the data controller, and Acciparte is the processor, with a contract signed before the service is activated. Third parties onboarded into the claim file, workshop, loss adjuster, clinic or external agent, accept terms at registration with purpose limitation, a duty of confidentiality and a ban on commercial use of the data. It is a small contractual link, but it is what allows a party who is nobody's customer to contribute documentation with proper safeguards.
Why this is not just compliance
A data governance model like this is not built to pass an audit. It is built because it is what allows parties with different, sometimes opposing, interests to share the same claim file. The other party's insurer, the dealership's workshop and the fleet's broker can all work on the same claim precisely because none of them sees more than what concerns them. The infrastructure's neutrality is a consequence of the permissions model, not a statement of intent.
The detail of the model, the roles and the infrastructure is on the security and data governance page.
This article describes Acciparte's design and does not constitute legal advice on data protection.