The final constraint upon record-keeping practices in the insurance industry is provided by the common law actions of defamation and privacy. Defamation provides liability for damage to reputation caused by the publication of untrue information about an individual. The tort of invasion of privacy provides liability under certain circumstances for, among other things, public airing of private information about an individual. Insurance institutions and support organizations may be able to raise a qualified privilege in defense of such actions.
In recognition of the need for a free flow of information in commercial transactions, most States have recognized a qualified business privilege which provides a defense for otherwise defamatory statements when made to the proper parties, in a proper manner, and for a valid business purpose, except if the statement is false and made with malicious intent to injure the individual to whom it refers. Similarly, there is a qualified privilege for invasion of privacy actions. These limits on common law actions enable insurance institutions and support organizations to exchange information for legitimate purposes relatively free of legal restraints. As noted earlier, however, the privilege is available only when information is disclosed to someone deemed to have an interest in it. It is for this reason that insurance institutions and their support organizations are careful to guard against the disclosure of information to anyone outside of the industry.