CATHERINE WAIRIMU GABRIEL VERSUS UMBA MICROFINANCE BANK
1. Introduction
The grievance in this matter emanates from Catherine Wairimu Gabriel’s complaint against Umba Microfinance Bank on the sending of a direct marketing message without her knowledge or consent. This action is inconsistent with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant received a direct marketing message from the Respondent without her knowledge or consent. She alleged that she had not directly contacted the Respondent and did not want to receive marketing messages from them.
3. Analysis of Evidence
Complainant’s Position
- Received a direct marketing message from the Respondent without her knowledge or consent
- Provided a screenshot of the message as proof
- Stated she did not want to receive marketing messages as she had not directly contacted them
Respondent’s Defense
- Acknowledged sending a message to the Complainant on 4th June 2024
- Claimed the Complainant’s number was publicly available on her Facebook page where she operates a car hire service
- Relied on Section 28(2)(b) of the Act that personal data may be collected indirectly where the data subject has deliberately made the data public
- Promptly informed the Complainant why she was being contacted and prompted her to join a WhatsApp group if interested
- Deleted her information from its database after she indicated she did not want to be contacted
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent sent a direct marketing message to the Complainant without obtaining her consent.
- Public availability of a phone number does not constitute consent for commercial marketing purposes.
- The Respondent deleted the Complainant’s data upon objection, but the initial contact was unlawful.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- The Respondent is directed to erase the Complainant’s personal data from its records/database within 14 days.
- The Respondent is directed to stop sending direct marketing messages to the Complainant.
- An Enforcement Notice shall issue upon failure to comply.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Publicly Available Data and Direct Marketing
- Clarifies that even if personal data is publicly available, express consent is still required for commercial use
- Public availability does not constitute consent for marketing purposes
Direct Marketing Obligations
- Reinforces that data controllers must obtain consent before sending direct marketing messages
- Data controllers must provide opt-out mechanisms in marketing communications
Broader Impact: The decision serves as a warning to financial institutions and businesses across Africa that scraping publicly available contact information for unsolicited marketing is not a lawful practice. Organizations must treat commercial outreach as a privilege requiring explicit consent, not an entitlement derived from public visibility.