GRIFFINS WEKESA VERSUS MY BODA LIMITED
1. Introduction
The grievance in this matter stems from Griffins Wekesa’s complaint against My Boda Limited on the receipt of promotional messages without his consent, despite never having contacted the Respondent or provided his personal data. This action is prohibited under the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant has been receiving promotional messages from the Respondent despite never giving his contacts, never visiting any of the Respondent’s offices, or making any online inquiries about the Respondent. He attempted to reach out to the Respondent but his calls were ignored.
3. Analysis of Evidence
Complainant’s Position
- Has been receiving promotional messages from the Respondent
- Has never given the Respondent his contact
- Has never been to any of the Respondent’s offices or enquired anything online about the Respondent
- Tried reaching out to the Respondent but they ignored his calls
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether the Complainant’s personal data was lawfully processed
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent processed the Complainant’s personal data for marketing without a lawful basis.
- The Respondent failed to demonstrate that it obtained consent from the Complainant.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- The Respondent is directed to delete the Complainant’s personal data from its systems within 7 days.
- The Respondent is directed to stop contacting the Complainant.
- The Respondent is directed to provide proof of deletion to the ODPC within 7 days.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Lawful Basis for Processing
- Establishes that data controllers must demonstrate a lawful basis under Section 30 for processing personal data
- Failure to establish a lawful basis constitutes unlawful processing
Unsolicited Marketing Messages
- Reinforces that sending promotional messages without consent is unlawful
- Data controllers must obtain consent before using personal data for marketing
Broader Impact: This decision confronts the widespread practice of bulk marketing without consent, where individuals’ data is acquired through opaque means. It establishes that the absence of a demonstrable lawful basis is sufficient to find liability, placing the burden squarely on data controllers to justify every instance of processing.