Outcomes - Selected Case Summaries
Categories
Employee of an insurance company reveals sensitive personal data
Informal Resolution | 20 July 2022
An insurance company employee disclosed personal data to a third party without authorization.
The affected data subject needed to obtain health insurance to complete her work permit application and avoid having to leave Cayman with her child. She applied for health insurance at the company, but the application took longer than expected, and she called her ex-husband (the son of a former employee) for help. He contacted a current employee recommended by his father, who did not routinely process this type of application. In the course of the conversation, the employee inadvertently revealed that the applicant was pregnant. The affected data subject and her ex-husband had long since divorced, and she was – understandably - distressed about the disclosure.
The company suspended the employee following the incident, and the matter was selected for possible criminal investigation under section 54 of the DPA for an apparent reckless disclosure of personal data.