Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The National Hospital Insurance Fund, a state parastatal providing medical insurance to its contributors and beneficiaries (the “Respondent”) was found liable for violating data accuracy and privacy by design principles of the data protection law, when it removed the Complainant's wife from his medical cover and added other unknown and unrelated third parties to it.

Facts

Simon Mukabane Okwomi (the “Complainant”) alleged that the National Hospital Insurance Fund, a state parastatal providing medical insurance to its contributors and beneficiaries (the “Respondent”), removed his wife from his medical cover and added other unknown and unrelated third parties to it. As a result, his wife could not access medical insurance and he had to pay for medical expenses out of pocket.

The issue only became known to him when he sought for rectification of the beneficiaries listed under the cover and compensation.

The Respondent attributed the issue to an error, and informed the ODPC that the Fund was in the process of adding a validation mechanism into the NHIF system to resolve future errors of that nature. The organisation reported that the unrelated persons had in the meantime, been removed from the Complainant's account.

The ODPC noted that the Respondent had not provided proof of the remedial measures taken to resolve the Complaint prior to the intervention by the data regulator, or the mechanisms to prevent future occurrence.

The data regulator also noted that the Complainant had not itemised his loss to facilitate computation of damages.

Holding

The ODPC held that:

• The Respondent is liable for violating the provisions of the Act.
• An enforcement notice to issue.

Comment