The Office of the Data Protection Commissioner (ODPC) has ordered Wananchi Group Limited which trades as “Zuku” to pay Ksh500,000 to a Kenyan who stopped being its client years ago but was still receiving promotional messages.
The Office in a determination seen by The Kenya Times found Wananchi Group Limited liable for failing to give effect to the data subject’s right to erasure as per section 40 and the right to object to the processing of personal data as defined in Section 36 of the Act.
Further, the Office found that the company failed to implement a mechanism for data subjects to exercise their rights as the method stated in their privacy notice was not operational.
“This Office therefore finds that the Respondent was denied an avenue to exercise his right to object to the processing of his personal data by the Respondent and his right to deletion of misleading data provided in Section 26(a) of the Act and Section 26 (e) as read with Section 40(1)(b) of the Act, respectively, thereby violating his aforementioned rights,” read part of the ODPC determination.
Case against Zuku
The complainant claimed that Zuku failed to erase his data despite multiple requests having stopped being a client years ago.
However, the company continued to send him promotional messages despite his verbal, phone, and email requests for deletion of his personal information from its systems and databases.
Also Read: Court Rules Azimio is the Rightful Majority Party- Here are the Challenges Ahead
The complainant stated that on November 16, 2024, he attempted to escalate the issue formally via email to the address listed on their website, but the email address was invalid, and his message was undelivered.
He further stated that the repeated unsolicited calls and communication have caused inconvenience and distress, and a lack of responsiveness erodes trust in the company’s data handling practices.
“The complainant also contends that the ongoing retention and misuse of his personal data violates his rights under the Data Protection Act, 2019, including the right to erasure and the right to object to the processing of personal data for marketing purposes. To him the continued retention of his personal information increases the risk of unauthorized access or misuse, exposing him to potential fraud or identity theft,” adds the determination.
To further demonstrate his fruitless attempts, the complainant stated that he has attempted to address the matter directly with the company multiple times, but no meaningful action has been taken.
The complainant contended that as late as 15th December 2024, when the complaint had already been lodged, he received an email from Wananchi Group titled “Service Auto Suspension Notification”.
Compensation
As part of his evidence, the complainant adduced proof of an attempted data deletion request via the email posted on the website.
Also Read: Britam Pays Club Ksh71 Million in Fire Compensation
Zuku was found liable for violating the complainant’s right to object to the processing of his personal data and his right to erasure.
Having found that by denying the complainant the opportunity to exercise his data protection rights, the respondent violated the complainant’s right.
Consequently, the respondent was directed to compensate the complainant Ksh500,000.
ODPC further ordered Zuku to delete the complainant’s personal data from its systems, stop contacting him and avail proof thereof to this Office within 7 days from the date of this determination.
Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.
At the same time, ODPC has ordered Geosky Service Limited to pay a complainant Ksh450,000 as compensation for using his personal and professional documentation while submitting a bid for tender to the Central Bank of Kenya for professional valuation services of fixed assets.
According to this submission, Geosky fraudulently used the complainant’s personal and professional documentation, including his curriculum vitae, academic certificates, professional certificates, and professional membership number, falsely representing him as their employee.
ODPC found the company liable for using the complainant’s personal data without a lawful basis and for denying him an opportunity to exercise his right to be informed before processing of his personal data.
Follow our WhatsApp Channel and join our WhatsApp Group for real-time news updates
