N.O. VERSUS MALIBU PHARMACY
1. Introduction
The case is in respect to the complainant, N.O. against Malibu Pharmacy, on the delivery of prescription medicine with her personal and health data exposed on the outside of the package, and the sharing of her personal data with third parties without her knowledge and consent. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant ordered prescription medicine from the Respondent. The complainant alleged that the Respondent delivered the medicine with her personal and health data exposed on the outside of the package, made a wrong diagnosis without consulting her primary doctor, and sent an insurance claim form with the wrong diagnosis to the insurance company.
3. Analysis of Evidence
Complainant’s Position
- Produced pictures of how the medical package sent to her appeared with her personal and health data exposed on the outside
- Provided screenshots of conversations between herself and the Respondent’s employees
- Produced the Respondent’s settlement note sent to the insurance company containing the wrong diagnosis
- Raised a concern with one of the Respondent’s doctors about the wrong diagnosis but the insurance claim form was still sent with the erroneous information
Respondent’s Defense
- Stated the Complainant was their valued client for over two years and deliveries have been made using riders employed directly by the Respondent
- Denied that her personal information was exposed to multiple third parties
- Claimed the information was solely utilized for processing her prescription, arranging delivery, and initiating the insurance reimbursement process
- Stated the Complainant’s personal information was never utilized for promotional purposes
4. Issues for Determination
- Whether the Complainant’s health data was processed as per the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent exposed the Complainant’s sensitive health data on the outside of the delivery package.
- The Respondent made a wrong diagnosis without consulting the Complainant’s primary doctor and attached it to the package.
- The Respondent sent an insurance claim form containing the wrong diagnosis to the insurance company.
- The Respondent is liable for unlawful processing of the Complainant’s health data.
Orders:
- Compensation of KES 700,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Health Data Protection and Data Minimization
- Establishes that sensitive health data must be protected and not exposed unnecessarily during delivery
- Confirms that only information necessary for delivery (name, address, phone number) should be on the outside of packages, not medical diagnoses
Pharmacy and Healthcare Provider Accountability
- Holds pharmacies accountable for protecting patient confidentiality during delivery and insurance processing
- Medical diagnoses should not be visible on external packaging
Broader Impact: This determination addresses a critical gap in Kenya’s pharmaceutical delivery sector, where patient health data is often exposed during delivery due to inadequate packaging practices. It establishes that pharmacies must protect sensitive health information and only include necessary delivery information on the outside of packages.