Who Owns the Data in Your Pension Fund?

Imagine receiving a call from someone who knows your full name, your employer, your pension fund, your salary, your contribution history and perhaps even details about your spouse or beneficiaries. You did not give that person the information. Your first reaction would probably be simple; how do they know this? And who gave them my information?

For a pension-fund member, this is not merely a question of privacy. It raises a much bigger question about who controls, holds, uses and is ultimately responsible for the information sitting inside a retirement fund's systems.

Retirement funds hold some of the most valuable personal and financial information about individuals. Membership records, identification details, employment information, salaries, contributions, beneficiary nominations, banking details, benefit values and correspondence are all part of the information ecosystem that makes pension administration possible.

As retirement-fund administration becomes increasingly digital, information can move between the fund, its administrator, employers, technology providers, insurers, consultants and other service providers. This creates an obvious question, Who actually owns the data?

The answer is more complicated than simply saying “the member” or “the fund”.

The law gives us part of the answer

FIMA provides an important starting point. Administration services expressly include the maintenance, safekeeping and preservation of members' records and data management. An administrator is therefore not merely processing paperwork; managing member and fund information is part of the regulated administration function.

FIMA further requires an administrator to maintain proper records and ensure that they are kept secure, continuously backed up and separately from the administrator's other records. This establishes that information management is not simply an operational matter. It is a regulatory and governance responsibility.

The NAMFISA Retirement Funds Standards provide an even more direct answer. Paragraph 57(c) of Part 3 of Chapter 5 provides that “fund information such as its membership record and investment belongs to the fund.” The provision further requires that, where such information is held by a service provider, the service provider must preserve its confidentiality and return it to the fund when the relationship ends

This is important because it helps distinguish between ownership and custody.

An administrator may hold, maintain, process and secure information on behalf of a fund, but holding the information does not, by itself, make the administrator the owner of the fund information. Equally, it would be too simplistic to conclude that a member “owns” all information relating to them in the proprietary sense.

The better distinction is between the fund's information, the administrator's obligations as a service provider, and the member's legally protected interests in personal information concerning them.

But what about the member?

This is where the legal position becomes more interesting.

Namibia's Constitution protects the right to privacy. There are also provisions in other legislation dealing with confidentiality and access to information. However, Namibia does not yet have a comprehensive dedicated data-protection statute in force. The Data Protection Bill remains within the legislative process.

A modern data-protection framework could provide greater clarity around questions that retirement funds increasingly face: what information may be collected, why it may be processed, who may access it, when it may be shared with third parties, how long it may be retained, what rights individuals have over their information, and what must happen when information is compromised.

But the absence of a comprehensive Data Protection Act does not mean that retirement funds and administrators operate without obligations. FIMA and the NAMFISA Standards already impose requirements around confidentiality, record-keeping, security, information management and IT governance.

So, who owns the data?

Perhaps the better question is not simply “Who owns the data?”

The more important question is: Who owns the responsibility for it?

The fund may appoint an administrator. The administrator may use sophisticated administration platforms, cloud services and other technology providers. Information may therefore pass through several systems and entities while remaining fundamentally connected to the fund and its members.

The regulatory framework increasingly points to a shared but clearly defined chain of responsibility. The fund's board cannot simply outsource its governance responsibility. Equally, an administrator cannot regard itself as merely holding information without responsibility for how that information is managed and protected.

And for the member, the fact that the information is held within a fund's systems does not mean that the member's privacy interests disappear.

Perhaps, therefore, the real question for the retirement-fund industry is not who owns the data, but who owns the risk when the data is lost, altered, disclosed, misused or compromised?

As pension administration becomes increasingly digital, that is a question that boards, administrators, service providers and regulators will need to answer with increasing precision.