Lucas* was upset that he had lost his wife during childbirth. He had brought his wife to the health facility in the afternoon where the midwife examined her and told him to go back home as it would be a while before the baby came.

Lucas went to his business premises and kept himself busy as he waited for the phone call that would tell him his baby was finally here. Instead, the only call he got that night was that his wife’s labour had failed to progress and she needed an emergency Caesarian section.

Lucas made his way to the hospital and asked to see his wife, only to find that she was already in surgery. After a while, a nurse came out from the operating room and asked to see Lucas. He was introduced to his newborn daughter and he escorted her to the newborn unit.

When he came back, he was told to wait outside the theatres to talk to the doctor about his wife. The doctor came and told him that his wife was not doing well. She had suffered complications during surgery and needed intensive care from the operating room. He needed to make a decision regarding the hospital where she would be transferred to.

The public hospitals’ ICU beds were full and he needed to raise money to make a deposit in the private hospital before his wife could be admitted. All this information was making his head swirl. He could not absorb it. He kept asking what happened to her but could not even comprehend what the doctor was telling him. He called his brother, who in turn, assembled the family.

Eventually after eight hours, an ICU bed was made available in a nearby public hospital and his wife was transferred there. Lucas rode with her in the ambulance, begging her not to leave him. Despite his most ardent prayers and those of their family members, she only lasted 48 hours before her spirit gave up the fight. Lucas was devastated. Throughout the funeral arrangements, he was numb. He would hold onto his newborn daughter tight, with the irrational fear that she, too, would leave him. She was all he had.

But weeks after the funeral, as the fog slowly lifted, Lucas began to question what had gone wrong. He went back to the hospital to find answers. He was directed to the hospital administrator, who scheduled a meeting with the team that cared for his wife. At the meeting, Peter felt that the explanations he was given were not satisfactory, especially as the doctor who first spoke to him was no longer working for the hospital and the hospital was not willing to disclose his contacts.

Without knowing where to turn, Lucas turned to social media. On Fathers’ Day, he posted a picture of himself and his baby, alongside a picture of his wife’s death summary sheet and the transfer letter to ICU. He lamented his loss, pouring out his heart at his loss; and how he was aggrieved by the fact that he did not know why his wife died.

Lucas is not alone. In many instances, a patient, or more often, the family, especially when the patient is deceased, in a desperate bid to get help or answers, post sacred patient information on social media, sharing sensitive personal data to the world.

This is a whole new dilemma that we must contend with, in the era of data protection. Long before the Data Protection Act (2019) came to life, the health profession has been guided by even more sacred oaths to maintain patient confidentiality; to always maintain our patient’s dignity, even in death. The Hippocratic Oath for doctors; and the Nightingale Pledge for nurses, have been our guiding principles of the profession.

The Data Protection Act has sought to introduce the same principles in all other aspects of life, where all personal data collected must be protected; and must be collected only under express consent by the data subject. Not only must one give consent for collection of this data but must also consent to what the data is intended to be used for.

With technology, the definition of personal data is also rapidly changing. Whereas before, we worried about the names, age, identification number, and medical information, now we worry about pictures, videos, body tissues, DNA, fingerprints, irises, online footprints, and many other personal identifiers that were never an issue before.

With this in mind, our Data Protection Act has heavily focused on its core mandate of protecting the data source, almost to the extent of boxing the data controllers and data processors into a corner, with no reprieve. This will likely hurt research sometimes, especially where the innovators may take advantage of already collected data, to build on new findings. This is because the use of that data will be considered as a breach of the Act because consent has not been sought for the additional use.

This came into play at some point during the Covid-19 where the development of a new test faced opposition and could not be licensed, as the regulator stated that the nasal swab samples used were from patients who did not consent to their specimen being used for research. These were nasal swabs of patients who had come in for Covid-19 testing. After the test, instead of discarding the swabs, the lab kept them and used them to develop new diagnostic technologies.

So, what happens when the data subject, or their handlers, themselves, breach the Act and plaster their own, or their relative’s personal data in public fora? Because by doing so, they have personally laid out their data for public engagement with it. The data can be accessed by anyone, and used in different ways, not all of them good.

Recently, a bereaved family could not even mourn in peace, because their kin’s medical data had been published and now everyone, from journalists to ambulance-chasing lawyers, was calling incessantly to get a scoop of the story, or prepare a civil suit.

Quietly somewhere, a potential employer will shy away from the patient as a potential employee in future, having judged their health and well-being from that single source of data. An insurance company may find you a liability and raise your premiums as a result of a medical record; or even use the data as an excuse to withhold payouts. A hospital may not want to treat you for fear of negative press in the media. The implementation of this Act will take time. It needs a whole culture change around how people perceive data and how they handle it, especially when third parties are involved.

Think of a simple instance of a development partner-sponsored workshop where the project manager has to have all attendees sign attendance sheets and provide personal information for purposes of reimbursement of transport expenses. Without establishing consent, the data is shared to the partner for accountability, and the payment data is shared with the bank for disbursement of funds.

Our lives just got a little complicated!

*Name changed to protect privacy.

Dr Bosire is an obstetric/gynaecologist practising privately in Nairobi.