MAINA JACKSON IRUNGU VERSUS FAMILY BANK LIMITED
1. Introduction
The complaint before this Office concerns Maina Jackson Irungu’s grievance against Family Bank Limited on the receipt of email statements for over a year despite not holding an account with the bank, and the Respondent’s failure to act on his requests to cease. This action is at odds with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant received email statements from the Respondent for over a year despite not holding an account with the bank. He alleged that despite visiting the Nyeri Branch and writing a letter requesting them to stop, the Respondent continued sending the emails and failed to respond to his letter requesting clarification and correction.
3. Analysis of Evidence
Complainant’s Position
- Over the last six months, he has been receiving email statements from the Respondent for an account he does not hold
- Visited the Respondent’s Nyeri Branch to get clarification but continued receiving emails
- Wrote a letter to the Respondent via official email requesting them to clarify but received no response
- Provided screenshots of the emails and the letter as proof
Respondent’s Defense
- Determined that the Complainant was not a Family Bank customer
- His email address was erroneously captured from a KRA PIN Certificate during customer onboarding
- Reached out to the Complainant on 13th May 2024 clarifying the error and confirming his data had been deleted
- Relied on performance of a contract as the legal basis for sending e-statements to customers
- Stated it immediately ceased all email communications and deleted his email address upon discovering the error
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent processed the Complainant’s email address without a lawful basis.
- The Respondent failed to respond to the Complainant’s requests to cease communications.
- The Respondent only deleted the Complainant’s data after the complaint was lodged.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 250,000 to the Complainant.
- The Respondent is directed to ensure personal data collected from customers is accurate and where necessary kept up to date.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to Erasure and Data Accuracy
- Reinforces the obligation of data controllers to act without undue delay on erasure requests
- Data controllers must ensure accuracy of personal data and correct errors promptly
Customer Onboarding and Data Capture
- Establishes that banks must verify the accuracy of personal data captured during onboarding
- Erroneous data capture leading to third-party processing constitutes a violation of the Act
Broader Impact: Banks across Africa must implement robust verification mechanisms during customer onboarding to prevent erroneous data capture. This determination establishes that financial institutions cannot rely on errors to justify unlawful processing of third-party personal data and must respond promptly to data subject requests.