JANUARIES ROBERT KIOKO & FERDINAND WANGA MAKANI VERSUS METROPOLIS STAR LAB KENYA LTD
1. Introduction
This consolidated complaint concerns the grievances of Januaries Robert Kioko and Ferdinand Wanga Makani against Metropolis Star Lab Kenya Ltd on the continuous sending of unsolicited promotional messages via WhatsApp despite their objections and the non-functional opt-out mechanism. This action is in gross violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainants alleged that the Respondent continuously sent them marketing messages via WhatsApp even after they had opted out using the “STOP” function, which was not functional. The 1st Complainant repeatedly responded “STOP” but messages persisted, while the 2nd Complainant received more messages the more he objected.
3. Analysis of Evidence
Complainants’ Position
- 1st Complainant: Has continuously been receiving marketing messages via WhatsApp despite opting out; has never given consent to receive marketing messages; followed the “STOP” option as advised but messages persisted
- 2nd Complainant: Has constantly been receiving WhatsApp marketing messages without consent; the “STOP” function was not functional; visited the Respondent’s lab once for specific service and did not consent to processing of his data for marketing
- Both provided certificates of electronic evidence
Respondent’s Defense
- Confirmed the 1st Complainant utilized its services and did attempt to stop messages, but the STOP functionality had operational challenges
- Claimed the Complainants were directed to respond to a WhatsApp link as a temporary solution
- Admitted the STOP functionality had operational challenges during the relevant period
- Stated they have engaged their service provider to ensure compliance
- Provided operational manuals and policies
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether there was an infringement of the Complainants’ rights under Section 26 of the Act
- Whether the Complainants are entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent’s opt-out mechanism was non-functional, violating the Complainants’ right to object.
- The Respondent continued sending marketing messages despite receiving opt-out requests.
- The Respondent failed to ensure its service provider implemented a functional opt-out system.
- The Respondent is liable for violation of the Complainants’ rights under the Act.
Orders:
-
Compensation totaling KES 500,000:
- 1st Complainant: KES 250,000
- 2nd Complainant: KES 250,000
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Functional Opt-Out Mechanisms
- Establishes that data controllers must ensure opt-out mechanisms are fully functional
- Non-functional opt-out mechanisms constitute a violation of the right to object
Data Controller-Processor Agreements
- Reinforces the requirement for written data processing agreements
- Service provider agreements must cover data sharing and processing aspects
Broader Impact: This ruling highlights a fundamental flaw in how African businesses adopt third-party marketing technologies without ensuring they are fit for purpose. A non-functional opt-out mechanism is not a technical glitch, it is a systemic failure that undermines consumer autonomy and exposes organizations to liability.