Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC initiated a suo motu investigation into Nala Hospital following reports of unauthorized disclosure of a patient’s sensitive health data on social media. The hospital was found to have breached data protection laws. The ODPC issued an enforcement notice requiring corrective actions, including policy updates, staff training, and security improvements.

Facts

On May 13, 2024, the Office of the Data Protection Commissioner (ODPC) initiated a suo motu investigation against Nala Maternity & Nursing Home Limited, a medical facility based in Kakamega. The investigation was triggered by growing public concern over the facility’s data processing practices, particularly the handling of sensitive health data.

The ODPC raised five main areas of concern:

1. Lack of a lawful basis for processing: The facility processed patient data without adhering to the constitutional and statutory guarantees of privacy, allegedly using the data for illegitimate purposes and transferring it unlawfully.
2. Failure to ensure transparency and duty to notify: The facility did not properly inform patients about how their data would be used or if it was being repurposed.
3. Inadequate security safeguards: There were no proper technical or organizational measures, including absence of a Data Protection Impact Assessment (DPIA), and poor data governance policies.
4. Violation of the data minimization principle: The facility collected excessive data, not all of which was necessary for the provision of healthcare services.
5. Improper storage and retention practices: The facility lacked proper retention schedules, potentially storing patient data longer than necessary.

In its email dated May 20, 2024, Nala Maternity & Nursing Home defended its practices, asserting that:

• Data was collected strictly for providing medical services.
• Only authorized personnel were involved in data collection and storage.