Who Decides Who Is Insurable? Data Governance of Flood Insurance Underwriting in Ireland

About one in twenty buildings in Ireland has limited or no access to flood insurance, and the gap is expected to widen as climate change brings heavier rainfall and more frequent storms. Whether a home can be insured is not decided by public flood maps but by insurers' own data, address- and property-level geocoding and private flood models, which homeowners cannot see or challenge. These decisions can affect the value of a home, its owner's ability to recover from a flood, and possibly access to mortgage credit. This paper examines how the data behind flood insurance underwriting in Ireland is governed. We map the data lifecycle from collection to cover decision and find that governance is strongest where data is public and weakest where decisions are made: no binding rule requires insurers to use, disclose or explain their flood models, the Central Bank has no remit over pricing, and the EU AI Act does not class property insurance as high-risk. We then analyse the privacy questions raised under the GDPR, including whether a model-driven refusal is an automated decision after the CJEU's SCHUFA ruling, and the ethical tension between risk-based pricing and solidarity, including the risk that location variables act as proxies for income. We propose six measures: a public flood-risk data platform, a right to an explanation and appeal, fairness audits, flood-risk certificates, two-way data sharing, and transparency conditions on any state-backed fund. Each is linked to Sustainable Development Goal targets 13.1, 11.5, 1.5, 10.3, 16.6 and 17.18.