INGA KIMARU VERSUS AMREF PENSION TRUSTEES
1. Introduction
The dispute in this matter involves Inga Kimaru’s complaint against Amref Pension Trustees on the sharing of her pension details to third parties, including a Sacco credit officer and her guarantor. This action is in contravention of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was employed by AMREF Kenya and was a member of AMREF Sacco. Upon leaving employment, she applied for her pension and allegedly received calls from her guarantor and a Sacco credit officer who were aware of her pension lump sum payment. She alleged that the HR officer she communicated with about her pension withdrawal also sits on the SACCO board, leading to unauthorized disclosure of her pension details.
3. Analysis of Evidence
Complainant’s Position
- Upon leaving employment, she made an application for her pension via email to the HR officer
- She received a call from a guarantor regarding follow up on her payments
- She was then called by the Sacco credit officer who knew about her lump sum payment
- The officer told her that one of the pension trustees had disclosed this information
Respondent’s Defense
- After thorough discussions with the HR officer and reviewing their processes, they believe the information was not released by him or themselves to any third party
- They requested to resolve the complaint through mediation
- Mediation was unsuccessful
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Complainant failed to provide sufficient evidence linking the Respondent to the alleged unauthorized disclosure.
- The Complainant did not exercise her rights by sending a cease-and-desist letter to the Respondent before lodging the complaint.
- The complaint is hereby dismissed for lack of merit.
Orders:
- No compensation awarded as the complaint was dismissed.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Burden of Proof on Complainant
- Reinforces the principle that he who alleges must prove
- Complainants must provide evidence to substantiate claims of unauthorized disclosure
Exercise of Data Subject Rights
- Establishes that data subjects must first exercise their rights before lodging a complaint
- Failure to send a cease-and-desist letter undermines the complaint
Broader Impact: Across Africa, data subjects must first exercise their rights and provide evidence before seeking regulatory redress. This determination reinforces the fundamental principle that complainants bear the burden of proof in data protection complaints.