Things the Insurance Sector needs to know about data protection. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 1

Transcription

1 Things the Insurance Sector needs to know about data protection. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 1

2 Introduction W h o W e A r e D a t a P r o t e c t i o n B a s i c s The D a t a P r o t e c t i o n A c t, 2012 ( A c t 843) P e r s o n a l D a t a Why does data privacy m a t t e r f o r i n s u r a n c e f i r m s? Data Processing Obligations Rights o f I n d i v i d u a l s D a t a P r o t e c t i o n P r i n c i p l e s Registration 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 2

3 Who we are The Data Protection Commission (DPC) is an independent statutory body established under the Data Protection Act, 2012 (Act 843) to protect the privacy of the individual and personal data by regulating the processing of personal information. Our Functions Implement and monitor compliance with Act 843. (Sec 3) Investigate and determine complaints under the Act. (Sec 3) Register data controllers and processors. (Sect 46) Provide Guidelines and promote good practice to ensure compliance. (Sec 86) Conduct public education and awareness on data protection. (Sec 86) Keep and maintain the Data Protection Register. (Sec 3) 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 3

4 What is Data Protection? Technical term relating to specific information management practices. It also means the legal protection of personal data/information. Data Protection is the relationship between collection and dissemination of data, technology, the public expectation of privacy, and the legal and political issues surrounding them. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 4

5 Data Protection Act, 2012 (Act 843) The Data Protection Act, 2012 (Act 843) sets out the rules and principles governing the collection, use, disclosure and care for your personal data or information by a data controller or processor. Why data protection? In Ghana, the recognition of the right to privacy with respect to the processing of personal data or information led to the passage of the Act 843 to further guarantee the right to privacy enshrined under Article 18(2) of the 1992 Constitution. How does Act 843 work? The Act provides standard principles that must be complied with by all who process personal information across the country and beyond. The law applies to all forms of personal data or information stored on both electronic and non-electronic platforms. When Does the Act come into effect? The Act was assented to in May 2012 and came into force in accordance with Section 99 on 16 th October on 16th October th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 5

6 Data Protection Act, 2012 (Act 843) cont d Data Protection Principles (sec 17) The Act also sets out the principles governing the processing of personal information. Data Protection Register The Act sets out modalities for the establishment of the Data Protection Register and the application process for registration. Exemptions The Act defines areas for exemption from strict implementation of the Act. These include information given for purposes of public order, public safety, public morality, national security, public interest, education, regulatory activity, etc. 16 th Regulation, sanctions and enforcement The Act defines the methods for enforcement of its provisions. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 6

7 What is Personal Data (Sec 96) Personal data means information on an individual or from which an individual may be identified. Examples of personal data Employment records Pictures, videos and related images Legal records Records of consultants one works with from time to time. Names, telephone numbers and address of visitors to premises Financial records Licensing records Administrative records Medical/Health Records Security records Investigation records Education/childcare records 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 7

8 The 8 data protection principles (s17) o Accountability o Lawfulness Of Processing Ensure it is adequate, relevant and not excessive Obtain and process information fairly Keep it only for lawful and specified purposes o Specification Of Purpose ocompatibility Of Further Processing With Purpose Of Collection Give a copy of personal data on request 8 Principles Use and disclose it only in ways compatible with these purposes oquality Of Information oopenness odata Security Safeguards Keep it for no longer than necessary Keep it safe and secure odata Subject Participation. Keep it accurate and up-to-date 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 8

9 Why does data privacy matter for insurance firms? Insurers, like all institutions operating in Ghana, are subject to the Data Protection Act, 2012 (Act 843). There is a heightened regulatory focus over how businesses collect and handle personal data, with adverse reputational and legal implications. Insurers and intermediaries collect and use vast amounts of personal data about their customers, and some of it is very sensitive data. The underwriting and claims stages are particularly data rich, and insurers use data collected for fraud prevention, marketing, claims management and pricing risk. The volume of data held by insurance firms, combined with product distribution chains that are often complex, has forced firms to take data protection compliance seriously. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 9

10 Things to know Data protection issues must be given a Board-level priority. Insurers and intermediaries collect and use vast amounts of personal data Insurers must have a clear understanding of what personal data is collected and from where, the nature of such data and who it belongs to (that is, policyholders or employees). Sufficient consents and effective protocols should be in place for collecting, handling and processing all data an insurer controls. Outsourcing agreements must also include provisions to ensure compliant sharing of data, including obligations and restrictions on how data is used. Insurers, as controllers of large quantities of personal and sensitive data, should be mindful of subject access rights and the cost and administrative burden of such rights. Information collected on policy holders, underwriting and claims processes must be disclosed, regardless of whether it was sourced from the insured or elsewhere. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 10

11 Things to know cont d Insurers need to make sure that any information used in the underwriting process which was not sourced from the insured is clearly set out in the proposal documentation so as to ensure that the insured agrees to the insurer having and using such information. Insurers must introduce more stringent compliance programmes to take into account data handling formalities, profiling, consent and processing requirements and the responsibilities and obligations of controllers and processors. Compliance measures must be reviewed to include things such as the details of personal data processing; data retention periods; grounds for data processing and export; and undertaking a risk assessment in order to implement appropriate security. Opportunities for the industry - For example, the implementation of more stringent data protection laws in the US has seen the cyber insurance market develop into a $1bn industry, with around 30 insurers competing for business. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 11

12 Data Processing Obligations Processing of Personal Data (Sec 18) Minimality (Sec19) Consent, justification and objection (Sec 20) Collection of personal data (Sec 21) Retention of records (Sec 24) Data processed by data processor or an authorised person (Sec 29) Collection of data for specific purpose (Sec 22) Data subject to be made aware of purpose of collection (Sec 23) 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 12

13 Data Processing Obligations Further processing to be compatible with purpose of collection (Sec 25) Quality Of Information (Section 26) Registration of data controller (Sec 27) Security measures (Sec 28) Data processor to comply with security measures (Sec 30) Notification of security compromises (Sec 31) Access to personal information (Sec 32) Correction of personal data (Sec 33) Transfer of data outside Ghana Right to compensation 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 13

14 Rights of Individuals Access to personal information Right to amend your personal information Right to prevent processing of your personal information. Rights to freedom from automated decision making Right to prevent processing of personal data for direct marketing purpose Right to seek compensation through the courts Right to complain to the Data Protection Commission 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 14

15 Registration The Data Protection Act, 2012 (Act 843) requires data controllers and data processors who control or process and use personal data to register with the DPC. Section 47 of Act 843 provides the process for registration. Required details: Who you are. The type of personal data you keep. The nature or manner in which personal data is processed. The purpose/purposes for keeping it. To whom the information is disclosed. How you protect the personal information. Who to contact when there are data protection issues; etc. Parts of these details will be made available to the public for viewing and inspection (Public Register) as required under Section 54 of the Data Protection Act, 2012 (Act 843). 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 15

16 Registration (continued ) 1. Who is required to register? 2. Separate/Multiple Registrations Section 47 (3) 3. Public Register Section How do I renew my registration? 5. Failure to Register/Renew Registration Section 53 & Section Duty to Notify Changes Section Refusing your Application for Registration - Section Completing the Registration Application Process NOTE: Registration of Data Controllers and Data Processors is ongoing 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 16

17 What you need to know about registration TIN Requirement: The Ghana Revenue Authority, GRA, has ordered institutions to acquire the new Taxpayers Identification Number (TIN) and our Registration System only accepts the new TIN. In order to complete your registration, we urge you to register for the new eleven (11) digits TIN with GRA if you haven t. Why we will refuse an application for registration: The commission will refuse an application for some reason. Being that applicant didn t provide all the necessary information required. Examples are: refusing to provide information on the following: Whose information do you process? What are your reasons for processing the data? Measures put in place to protect data For information on the kind of information required especially on Measures put in place to protect data please follow the link below and download our Registration Guide. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 17

18 Amending registration application details: To edit your rejected application, please visit our registration page again and do the following: 1. Go to the check status tab and click on it. 2. Put in your Application Number or TIN. 3. Click on the edit button by your application name and input the required information. 4. Resubmit application Browser compatibility Our Registration System is currently not compatible with Internet Explorer browser. We advise that you kindly use either Google Chrome or Mozilla Firefox browser to access the link to the registration portal. 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 18

19 Find out more Website: Telephone: +233-(0) Fax: +233-(0) Write: Room No. 51, First Floor Ministry of Communications Blk Ministerial Enclave, P.O.Box CT7195, Accra 11th May, 2016 GHANA INSURANCE BROKERS ASSOCIATION 19