Article 19
Retention of records
1.
Without prejudice to the application of Regulation (EU) 2016/679 of the European Parliament and of the Council (
4
), insurance intermediaries and insurance undertakings shall maintain records of the assessment of suitability or appropriateness undertaken in accordance with Article 30(1) and (2) of Directive (EU) 2016/97. The records shall include the information obtained from the customer and any documents agreed with the customer, including documents that set out the rights of the parties and the other terms on which the insurance intermediary or insurance undertaking will provide services to the customer. Such records shall be retained for at least the duration of the relationship between the insurance intermediary or insurance undertaking and the customer.
2.
In the case of an assessment of suitability undertaken in accordance with Article 30(1) of Directive (EU) 2016/97, the record shall further include the following:
(a)
the result of the suitability assessment;
(b)
the recommendation made to the customer and the statement provided in accordance with Article 14(1) of this Regulation;
(c)
any changes made by the insurance intermediary or insurance undertaking with regard to the suitability assessment, in particular any change to the customer's risk tolerance;
(d)
any changes to the underlying investment assets.
3.
In the case of an assessment of appropriateness undertaken in accordance with Article 30(2) of Directive (EU) 2016/97, the record shall further include the following:
(a)
the result of the appropriateness assessment;
(b)
any warning given to the customer where the insurance-based investment product was assessed as potentially inappropriate for the customer, whether the customer asked to proceed with concluding the contract despite the warning and, where applicable, whether the insurance intermediary or insurance undertaking accepted the customer's request to proceed with concluding the contract;
(c)
any warning given to the customer where the customer did not provide sufficient information to enable the insurance intermediary or insurance undertaking to assess the appropriateness of the insurance-based investment product, whether the customer asked to proceed with concluding the contract despite the warning and, where applicable, whether the insurance intermediary or insurance undertaking accepted the customer's request to proceed with concluding the contract.
4.
The records shall be retained in a medium that allows the storage of information in a way accessible for future reference by the competent authority. The competent authority shall be able to access them readily, to reconstitute each element in a clear and accurate manner and to identify easily any changes, corrections or other amendments, and the contents of the records prior to such modifications.
( 4 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).