Italy implements the ‘oncological right to be forgotten’: IVASS Order No. 169 and its impact on insurance

With Order No. 169 of 15 January 2026 (the Order), the Italian Insurance Supervisory Authority (IVASS) implemented Law No. 193 of 7 December 2023. The law covers “Provisions for the prevention of discrimination and the protection of the rights of persons who have been affected by cancer.”

The law implements Articles 7, 8, 21, 35 and 38 of the EU Charter of Fundamental Rights. It introduces the “oncological right to be forgotten.” This is the right of people who’ve recovered from cancer not to provide information or undergo investigations regarding their previous medical condition. It applies to cases concerning banking, financial, investment and insurance services.

In implementing this principle, IVASS was the first supervisory authority in the sectors affected by the law to issue detailed provisions.

The Order introduces amendments to IVASS Regulations nos. 40 and 41. They concern, respectively, the distribution and disclosure of information, advertising and the creation of insurance products, replicating the provisions of the law.

The amendments establish that:

• requests for information on the policyholder’s past health status for the purposes of entering into or renewing an insurance contract (or other contract) are not permitted if more than ten years have elapsed since the last active treatment of the condition without any recurrence;¹
• at all stages of access to services (including insurance services), distributors must provide adequate information about the above right;
• no additional costs, limits or charges can be applied to people who have been in the above-described circumstances compared to the general public of policyholders;
• companies are prohibited from requesting medical examinations for the purpose of entering into new contracts; and
• any information previously acquired on the policyholder’s state of health can’t be used to assess the policyholder’s solvency, who may take steps to request certification of their current state of health to request the deletion of previous health data held by the distributor/insurance operator.

With regard to the above and with reference to Regulation 40, the Order introduces a series of additional information/operational obligations for distributors, in addition to those already contained in the Regulation. The obligations include:

• The obligation to provide pre-contractual information at the time of conclusion or renewal of an insurance contract on the existence of the oncological right to be forgotten – this article has resulted in the addition of a provision to the Single Pre-Contractual Form (MUP), delivered by distributors to potential policyholders, with the inclusion of wording indicated by the Supervisory Authority.
• The prohibition on acquiring, through health checks/use of information (including previously acquired information) on the state of health of the policyholder/insured person, if more than ten years have elapsed since the last active treatment of the disease.
• The prohibition on the application of limits, costs and additional charges compared to the general public of contractors.
• The prohibition on the use of information on previous oncological pathologies, if already acquired, for risk assessment.

With reference to Regulation 41, IVASS clarifies in the Order that introducing additional information requirements determines the natural derogation from the principle set out in the previous IVASS Order no. 147/2024. According to this previous order, the maximum length of the Additional DIPs couldn’t exceed three pages. IVASS has clarified in the results of the consultation on the Order that the information requirements apply to all insurance products, except those relating to motor vehicle liability insurance. Even with regard to the Additional DIPs, IVASS has indicated specific wording to be included in new sections of the document.

Neither the law nor the Order clarify the impact of the new regulatory provisions on existing contracts.

The law merely requires the (insurance) operator to delete data relating to the customer’s previous state of health at the customer’s request and not to take the data into account when assessing the customer’s solvency, without providing further guidance, which may be expected from the implementing measures.

The Order doesn’t clarify these aspects.

It’s clear that – once it enters into force on 10 February – the law will apply to insurance contracts entered into or renewed after that date. But there’s no guidance on how operators should act regarding existing contracts – outside of cases of new contracts or renewals – when they receive confirmation that the condition has been met.

One of the aims of the law is to avoid individuals who have recovered from an illness being treated differently compared to the general public. But the Order doesn’t provide any operational guidance on this point. For example, should a portion of the premium be refunded in the event of advance payment in a single instalment, once certification of recovery has been received?

The authorities whose areas are affected by the law should – in consultation with the Data Protection Authority – provide clear guidance to avoid any unequal treatment between users of banking, financial and insurance services covered by the law.

---

¹The time limit is reduced to five years if the condition arose before the age of 21