BHARAT THAKRAR VERSUS WPP SCANGROUP PLC, WPP PLC & CONTROL RISKS GROUP
1. Introduction
This complaint concerns Bharat Thakrar’s grievance against WPP Scangroup PLC, WPP PLC, and Control Risks Group on the denial of his data subject access requests, unlawful access and processing of his personal data, and sharing of his data with third parties without consent. This action is in gross violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant, former CEO of WPP Scangroup PLC, alleged that his DSARs were denied, his personal data (including private WhatsApp messages) was unlawfully accessed and shared with third parties without consent, and the Respondents improperly invoked legal privilege and public interest exemptions to evade compliance.
3. Analysis of Evidence
Complainant’s Position
- Founded Scanad Marketing Limited which grew into Scangroup PLC, listed on the Nairobi Securities Exchange
- Was suspended in February 2021 following misconduct allegations and resigned under duress on 23rd March 2021
- Submitted DSARs to all three Respondents on 25th and 26th April 2024, which were either denied or inadequately responded to
- CRG was commissioned to access his laptop and cloud data, including private WhatsApp messages, without his knowledge or consent
- The investigation report was shared with CMA, WPP, and Scangroup, causing significant professional and personal harm
Respondents’ Defense
- Scangroup and WPP: Argued the complaint is sub judice due to ongoing High Court suit (HCCOMM/E147/2024); claimed the DSARs were a “fishing expedition” and manifestly excessive; relied on legal privilege, public interest exemptions, and the Complainant’s employment contract as lawful bases; provided a redacted HR file on 27th August 2024
- CRG: Acted as a data processor on behalf of Scangroup through Coulson Harney LLP; claimed all investigative data is subject to legal privilege; denied illegally processing the Complainant’s personal data; argued the DSAR was manifestly excessive
- All Respondents confirmed responding to DSARs on 3rd May 2024 within the statutory seven days
4. Issues for Determination
- Whether this Office has jurisdiction to determine the complaint
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondents fulfilled their obligations under the Act
- Whether the Complainant is entitled to the remedies sought
5. Final Determination
The Data Commissioner found:
- The Respondents denied the Complainant’s DSARs without sufficient justification, violating his right of access.
- The Respondents unlawfully accessed and processed the Complainant’s personal data, including private WhatsApp messages.
- The Respondents improperly invoked legal privilege and public interest exemptions to evade compliance.
- The Respondents failed to demonstrate compliance with data protection principles.
- The Respondents are liable for violation of the Complainant’s rights under the Act.
Orders:
-
Compensation totaling KES 1,950,000:
- 1st Respondent (WPP Scangroup PLC): KES 700,000
- 2nd Respondent (WPP PLC): KES 700,000
- 3rd Respondent (Control Risks Group): KES 550,000
- The 1st and 2nd Respondents are directed to give the Complainant access to his employment-related personal data within 7 days.
- An Enforcement Notice is issued against all Respondents.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Subject Access Rights
- Clarifies that legal privilege does not override the right of access under Section 26(b) and data controllers must redact privileged information without denying access
- DSARs for policies and internal agreements fall outside the scope of the right of access
Public Interest Exemption and Lawful Processing
- Confirms that public interest exemptions are not blanket exemptions and data controllers must still comply with Section 51(1) principles
- Failure to demonstrate compliance with these principles voids the exemption
Broader Impact: This landmark determination establishes critical guardrails for workplace investigations, affirming that employers cannot use legal privilege or public interest exemptions to evade data protection obligations. Data subject rights must be respected even in disciplinary proceedings, setting a precedent for corporate governance across Africa.