PHYLLIS OSORO KEMUNTO VERSUS ABSA BANK KENYA PLC
1. Introduction
The dispute in this matter concerns Phyllis Osoro Kemunto’s complaint against ABSA Bank Kenya PLC on the unlawful listing of her in the Credit Reference Bureau (CRB) based on a company credit card issued to her former employer, despite her objections. This action is in conflict with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Respondent issued a company credit card to the Kenya Association of Manufacturers (KAM) under the Complainant’s name as the nominated card user. Despite her leaving KAM in June 2022 and objecting to the processing of her personal data via email on 10th May 2023 and 3rd October 2023, the Respondent continued demanding payment and negatively listed her on the CRB.
3. Analysis of Evidence
Complainant’s Position
- She is a holder of a personal credit card with the Respondent which she has faithfully settled
- The Respondent issued a company credit card to KAM under her name as the nominated card user
- She left KAM in June 2022 and communicated this to the Respondent, referring them to KAM for payment follow-ups
- She objected to the processing of her personal data via email on 10th May 2023 and again on 3rd October 2023
- Despite her objections, the Respondent continued sending payment demands and negatively listed her on the CRB
Respondent’s Defense
- The Complainant was nominated by KAM and applied for the credit card facility which was issued in her name
- Monthly statements were issued and mailed to the Complainant and KAM
- On several occasions, the Respondent reached out to the Complainant informing her of outstanding amounts
- In May 2023, the Complainant was duly informed of the intention to negatively list her
- The listing was done in line with the provisions of the CRB Act
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent ignored the Complainant’s objection requests and continued processing her personal data.
- The Respondent listed the Complainant on the CRB for a company debt without proper justification.
- Corporate card liability rests with the principal cardholder (the company), not the individual card user.
- The Respondent failed to comply with the Complainant’s right to object under Regulation 8(3).
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 250,000 to the Complainant.
- The Respondent is directed to erase the Complainant’s personal data as KAM’s authorised card user within 14 days.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to Object and CRB Listings
- Establishes that data controllers must comply with objection requests
- Banks cannot ignore objections and continue processing personal data without justification
Corporate Cards and Individual Liability
- Clarifies that company credit card liability rests with the principal cardholder (the company)
- Individual card users cannot be held liable for company debts after leaving employment
Broader Impact: This determination confronts the misattribution of corporate credit card liabilities to individual employees, affirming that banks cannot use CRB listings as leverage against individuals for company debts. It establishes that objection requests must be respected, setting a critical standard for corporate banking practices across Africa.