ALLAN VERSUS THE COUNTY ASSEMBLY OF MIGORI
1. Introduction
The complaint before this Office concerns Allan’s grievance against the County Assembly of Migori on the publication of his curriculum vitae on its public website without his consent, exposing his personal and sensitive data. This action is incompatible with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant submitted his CV as part of his application for the position of Speaker of the Migori County Assembly. The Respondent published the CV on its official website without his consent, making it publicly accessible. The CV contained his full names, identification number, phone number, referees’ information, and sensitive personal data including religious beliefs and marital status.
3. Analysis of Evidence
Complainant’s Position
- Submitted his curriculum vitae to the Migori County Government as part of his application for the position of Speaker
- Without his consent, the Respondent published his CV on its official website, making it publicly accessible
- The publication has exposed personal and confidential information to the public
- Confidential information of individuals listed as referees has also been compromised
- Adduced pictures/screenshots of the Respondent’s website and a copy of the CV displayed online
Respondent’s Defense
- Maintained it had a lawful basis for processing the Complainant’s personal data
- Stated the Complainant subjected himself to the provisions of Section 9A(1) of the County Government Act, 2012
- Claimed the Complainant accepted to be governed by Standing Order 5(5) of the County Assembly of Migori
- Relied on Section 51(2)(c) of the Act which exempts processing where disclosure is required by law
- Adduced the Migori County Assembly Standing Orders as evidence
4. Issues for Determination
- Whether the Respondent processed the Complainant’s personal data in accordance with the principles of personal data
- Whether the Respondent had a lawful basis for processing the Complainant’s personal data
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent published the Complainant’s CV on its public website without obtaining his consent.
- Standing orders requiring sharing of CVs do not authorize public publication on websites.
- The Respondent failed to protect the Complainant’s sensitive personal data, including religious beliefs and marital status.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 900,000 to the Complainant.
- The Respondent is directed to delete all CVs published on its website within 7 days.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Public Sector Data Protection
- Establishes that public institutions must comply with data protection principles even when acting under standing orders
- Standing orders that require sharing of CVs must be interpreted consistently with the Act
Sensitive Personal Data
- Reinforces the heightened protection required for sensitive personal data
- Religious beliefs and marital status cannot be processed without a lawful basis
Broader Impact: This decision highlights the tension between public sector transparency and individual privacy in recruitment processes. It sends a clear signal that government entities cannot hide behind standing orders to justify the wholesale publication of applicants’ personal data on public websites, and must adopt proportionate approaches that respect candidates’ privacy rights.