DR. BERNARD SHIAUNDA AETE vs. NCBA BANK KENYA PLC
1. Introduction
The case is in respect to the complainant, Dr. Bernard Shiaunda Aete against NCBA Bank Kenya PLC, on the receipt of false and misleading loan statements which were simultaneously sent to a third party despite numerous requests to have the third party’s contact removed. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The Complainant alleged that he received false and misleading information regarding his loan balances from the Respondent, and the said information was simultaneously sent to his former wife (third party) despite multiple written and oral requests to have her removed as an alternate contact from his account. The Respondent failed to implement the changes requested in his letter dated 4th April 2023 until 16th January 2024.
3. Analysis of Evidence
Complainant’s Position
- Took two loan facilities with the Respondent and provided his telephone number as well as an alternate number of his former wife, Ms. J****** N*****
- On 4th April 2023, wrote to the Respondent requesting removal of the alternate number and that all notifications be sent to his primary number alone
- Despite this, the Respondent continued sending notifications (containing false information) to Ms. N***** for a period of about eight months
- Received false information on loan balances including alleged arrears that did not reflect on his statements
Respondent’s Defense
- Confirmed the Complainant applied for two loan facilities and provided his former wife’s number as the alternative contact
- Claimed the former wife’s number was removed as alternative contact on 5th April 2023, a day after receiving the deletion request
- However, the number was still maintained in the system under the “employer’s contact” field, causing sync errors with their reporting system (NQUEST)
- Stated that on 17th January 2024, they notified the Complainant of the effected change and contacted the system vendor to provide a fix
- Contended that disputes about loan administration are matters of contract for the courts
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent continued sending loan notifications to the Complainant’s former wife despite multiple deletion requests.
- The Respondent sent false and misleading information regarding the Complainant’s loan balances for about eight months.
- The Respondent failed to implement the deletion request from 4th April 2023 until 16th January 2024.
- The Respondent is liable for violation of the Complainant’s right to object and right of erasure.
Orders:
-
Compensation of KES 700,000 to the Complainant:
- KES 200,000 for unlawful processing
- KES 250,000 for infringement of right to object
- KES 250,000 for infringement of right to erasure
- The Respondent is directed to ensure accurate bank balance information is sent to the Complainant.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to Object and Right of Erasure
- Reinforces the obligation of data controllers to act without undue delay when a data subject requests deletion or removal of personal data
- Establishes that a delay of eight months constitutes a violation of the right to erasure
Accuracy Principle in Banking
- Reinforces the obligation to maintain accurate personal data
- Establishes that banks must ensure loan statements and notifications are accurate
Broader Impact: This determination establishes that banks cannot hide behind system errors to avoid liability for continued disclosure of customer data to third parties. Customer deletion requests must be implemented promptly and accurately across all banking systems.
