Employee of an insurance company reveals sensitive personal data (2022-07-20)

Summary

This is a published case summary from the Cayman Islands Ombudsman describing an informal resolution of a data protection complaint against an insurance company. It illustrates how the Ombudsman treats unauthorized disclosure of sensitive personal data by an employee, rather than setting out new rules.

• What happened: An insurance company employee, while helping process a health insurance application, inadvertently disclosed to the applicant's ex-husband that the applicant was pregnant.
• Company response: The insurance company suspended the employee following the incident.
• Regulatory outcome: The matter was selected for possible criminal investigation under section 54 of the Data Protection Act for an apparent reckless disclosure of personal data.

The case serves as an example for compliance officers, particularly in insurance and other sectors handling sensitive personal data, of the risk that careless internal handling of applications can trigger both regulatory scrutiny and potential criminal liability under section 54 of the DPA.

Applies to

insurance companies, data controllers, data processors