JOHN THUO VERSUS THE BOARD OF KENYA SPORTS FEDERATION LTD & MAINA MUTURI
1. Introduction
The complaint before this Office concerns John Thuo’s grievance against The Board of Kenya Sports Federation Ltd and Maina Muturi on the diversion of his personal data to unknown third parties without his knowledge or consent. This action is incompatible with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant provided his and his wife’s passport details to apply for passes to the Mexico Formula One races. The 2nd Respondent, as Chairperson of the 1st Respondent federation, forwarded the Complainant’s unredacted personal data to unknown third parties without his knowledge or consent. The 1st Respondent’s secretariat became aware of the breach but failed to report it to the ODPC.
3. Analysis of Evidence
Complainant’s Position
- He applied for 2 passes to the Mexico Formula One races for himself and his wife
- Provided passport details as required by the world governing body for Motor Sports
- Unknown to him, the 2nd Respondent offered the same passes to persons unrelated to motorsport
- He became aware when an email copied to the secretariat and to the persons was forwarded to him containing a pdf of his original email
- His and his wife’s unredacted personal data was sent to third parties without his knowledge, authority, or consent
Respondents’ Defense
- The secretariat received the Complainant’s email with authority to share the information with FIA for issuance of passes
- The email was copied to all directors as required by internal transparency rules
- The secretariat did not share the details with anyone else apart from FIA
- Became aware of the data breach on 19th July 2024 when a director shared the information with a third party
- Did not inform the ODPC due to an oversight in interpreting the law
4. Issues for Determination
- Whether the Respondents fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The 2nd Respondent shared the Complainant’s unredacted passport details with third parties without his consent.
- The 1st Respondent became aware of the breach but failed to report it to the ODPC within 72 hours.
- Internal transparency rules do not override data protection obligations.
- The Respondents are liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondents.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Breach Notification Obligations
- Reinforces the obligation to notify the ODPC within 72 hours of becoming aware of a breach
- Failure to notify constitutes a violation of the Act
Director Liability and Board Governance
- Establishes that individual directors can be held liable for data breaches
- Boards must ensure directors are trained on data protection obligations
Broader Impact: This case underscores the vulnerability of personal data within sports governance structures, where internal transparency practices can inadvertently expose sensitive information. It establishes that neither board protocols nor oversight justify non-compliance, and that individual directors must be held accountable for their role in data breaches.