Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Sincephetelo Motor Vehicle Fund was found liable for violating the provisions of Eswatini’s data protection law and fined E150,000/- , when it published personal information of 1,700 road traffic accident survivors in a 5 page spread in the Eswatini Observer. SMVA's mitigation efforts facilitated a reduction of the total fine payable.

Facts

The Eswatini Communications Commission investigated the disclosure of personal information by the Sincephetelo Motor Vehicle Fund in a print media publication, the Eswatini Observer.

The publication contained personal information of 1,700 road traffic accident survivors, including their claim number, full names, and National Identity Number or Graded Tax Number.

SMVA acknowledged its compliance failures and in mitigation pleaded that:

• The Notice was published to update records of claimants for contractual obligations related to medical care as recommended by doctors.
• Claimants lacked reliable contact numbers and postal addresses.
• SMVA's breach of the Act was inadvertent and stemmed from a misapprehension rather than ignorance.
• SMVA promptly sought guidance from the EDPA after demonstrating remorse.
• All directives from the EDPA were implemented within 24 hours.

The information regulator found as under:

• that SMVA disclosed personal information without lawful reason, affecting a significant number of data subjects.
• The disclosure of National Identity numbers also exposed claimants to identity theft and potential fraudulent activities.