Yes, but they should not ask for more personal data than necessary to determine the premium. And, of course, it must not violate the right to equal treatment and the prohibition of discrimination in the Constitution.
For example, insurers can ask for personal data on the basis of "performance of a contract" for the purpose of determining the premium. They may not collect more data than is strictly necessary for this purpose. Nor may they use the data for any other purpose than that for which it was collected.
To illustrate:
A car insurance company can use objective accident statistics to justify why they ask for your age. For example, because young drivers are more likely to be involved in an accident than older drivers. The same goes for the number of claim-free years. From this, a car insurer can deduce how high the risk is that you will be involved in an accident.
Does a car insurance company ask for personal data that is not necessary to perform a contract? If so, they must have consent or some other basis for doing so.
Insurers must comply with rules in the Constitution in addition to the Privacy Act. For example, the right to equal treatment and the prohibition of discrimination.
