ADELINE MUNEE MUNGUTI & LARRY OBINDI SISEI VERSUS MINT VILLAS LIMITED T/A MINT VILLA HOUSING
1. Introduction
This consolidated complaint concerns the grievances of Adeline Munee Munguti and Larry Obindi Sisei against Mint Villas Limited t/a Mint Villa Housing on the use of their personal data to register a company without their knowledge or consent. This action is in breach of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainants purchased houses from the Respondent and provided their personal data for that purpose. The Respondent subsequently used their names, ID numbers, KRA PINs, passport photos, signatures, and other personal data to register Twinfalls City Management Public Limited Company without their knowledge or consent. They were listed as directors and shareholders without having signed any document or provided consent for the registration.
3. Analysis of Evidence
Complainants’ Position
- They received an offer to purchase houses and accepted, providing their personal data for that purpose
- They were elected as estate officials alongside others in July 2023
- The Respondent sent emails requiring them to register an email address for an intended company and attached CR1, CR2, CR8 forms for execution
- They did not sign the documents and no one followed up
- On 14th December 2023, Twin Falls City Management Public Limited Company was incorporated with them listed as directors and shareholders
- When they raised the issue, the Respondent abandoned the company and registered another company
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainants’ rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainants are entitled to remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent used the Complainants’ personal data to register a company without their knowledge or consent.
- The Respondent failed to obtain fresh consent for a new purpose beyond the original property transaction.
- The Respondent was non-responsive and did not cooperate with the ODPC investigation.
- The Respondent is liable for violation of the Complainants’ rights under the Act.
Orders:
-
Compensation totaling KES 1,100,000:
- 1st Complainant: KES 550,000
- 2nd Complainant: KES 550,000
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Purpose Limitation and Consent
- Clarifies that personal data collected for one purpose (property purchase) cannot be used for another (company registration) without consent
- Data controllers must obtain fresh consent for each new purpose
Right to be Informed and Duty to Notify
- Reinforces the obligation to inform data subjects of the use of their personal data
- Data controllers must notify data subjects before processing personal data for new purposes
Broader Impact: This case lays bare a troubling practice in Kenya’s real estate sector, where customer data collected for property transactions is repurposed to register companies without consent. It establishes that developers cannot treat buyer information as a corporate resource to be deployed at will, and that purpose limitation is not a technicality but a fundamental safeguard against identity exploitation.