GEORGE MAINA MWANGI vs. CUSTOMS MANAGER, ICMS LICENSING – KRA
1. Introduction
George Maina Mwangi complains that the Customs Manager, ICMS Licensing at Kenya Revenue Authority (KRA) continued exposing his personal data in his ICMS profile to a third party who replaced him, despite his requests for its removal. He contends that this violated his right to object to processing and right to deletion under Section 26 of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant alleged that the Respondent continued exposing his ICMS profile to a third-party person who replaced him when he terminated his services, disregarded his requests for his profile to be pulled down and substituted with that of his replacement, and thereby violated his right to object to processing and right to deletion of his personal data under Section 26 of the Act.
3. Analysis of Evidence
Complainant’s Position
- Adduced a screenshot and copy of the impugned profile’s user information
- Provided a copy of his letter dated 12th May 2021 requesting the Respondent to disable and/or revoke his profile
- Submitted email correspondences between himself and Gone Fishing & iCMS
- Provided Gone Fishing’s letter dated 11th May 2021
Respondent’s Defense
- Stated that the Complainant’s request for his profile to be pulled down was effected on 7th May 2021, before receiving his letter dated 12th May 2021
- Confirmed that the Complainant’s profile was substituted with that of his replacement in the system, which was created on 7th May 2021
- Provided evidence that the Complainant’s profile (No. CSAP051236746GA) was deactivated, and profile No. MUBP051169840EA was rendered inactive
- Contended that the present complaint was moot, having been overtaken by events as the matter had been resolved
4. Issues for Determination
- Whether the Complainant’s rights were infringed upon
- Whether the Complainant is entitled to any remedy under the Act
5. Final Determination
The Data Commissioner found:
- The Respondent commenced the process of revocation and deletion of the Complainant’s profile on 7th May 2021.
- The Complainant was informed on 11th May 2021 that the deletion process had been initiated.
- The Complainant exercised his right to object and request deletion on 13th May 2021.
- By 13th May 2021, the deactivation had already been effected on 7th May 2021.
- Rights are only violated when they are exercised and the same are not effected.
Orders:
- The Complaint lacks merit and is hereby dismissed.
- Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.
6. Significance and Impact
Timing of Data Subject Rights
- Clarifies that the right to object to processing and request deletion must be exercised before the data controller takes action
- Establishes that data controllers are not liable for rights that are exercised after the processing has already ceased
Burden of Proof and Documentation
- Reinforces the importance of maintaining accurate records of when data subject requests are received and actioned
- Demonstrates that proper documentation can protect data controllers from liability where they have acted in good faith
Third-Party Processing and Data Controller Obligations
- Confirms that where a third party (Gone Fishing) initiates the deletion process, the data controller (KRA) is not liable if the request is already in progress
- Highlights the importance of clear communication between data controllers and data subjects when processing is being handled by third parties
Broader Impact: This determination underscores the need for robust data retention and deletion policies in public sector institutions. Citizens are often unaware of how long their data remains in government systems. Data protection must be designed into these systems, with clear mechanisms for citizens to exercise their data subject rights.