MIRUKA DANIEL vs. TRIDENT INSURANCE COMPANY LTD
1. Introduction
The case is in respect to the complainant, Miruka Daniel against Trident Insurance Company Ltd, on the issuance of an insurance policy involving a tuk-tuk under his name and details without his knowledge or consent. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant received an email stating he had taken an insurance policy involving a tuk-tuk. The complainant alleged that the respondent processed an insurance policy under his name and details without his knowledge or consent, yet he has never bought a tuk-tuk or given his details to the respondent.
3. Analysis of Evidence
Complainant’s Position
- Received an email on 4th November 2023 stating he had taken an insurance policy involving a tuk-tuk
- Upon looking at the PSV insurance policy, it had all his details yet he had never bought a tuk-tuk or given his details to the Respondent
- Submitted his complaint via the Office’s website on 17th November 2023
- Attached the email message and a copy of the certificate of insurance as evidence
Respondent’s Defense
- The Respondent was notified of the complaint on 11th December 2023 and given 14 days to respond
- A reminder was sent on 24th January 2024, and the Respondent requested additional information which was provided
- To date, the Respondent is yet to respond to the allegations contained in the complaint despite being availed the requested additional information
- The Respondent has failed to cooperate with this Office and ignored all communication
4. Issues for Determination
- Whether the Complainant’s personal data was lawfully processed
- Whether the Complainant is entitled to any remedy under the Act
5. Final Determination
The Data Commissioner found:
- The Respondent processed the Complainant’s personal data to issue an insurance policy without his knowledge or consent.
- The Respondent failed to respond to the complaint or cooperate with this Office despite multiple notifications.
- The Respondent has not demonstrated any lawful basis for processing the Complainant’s personal data.
- An Enforcement Notice is issued against the Respondent for non-compliance.
Orders:
- The Respondent is directed to erase the Complainant’s personal data from its systems.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Unlawful Processing of Personal Data
- Clarifies that processing personal data to issue insurance policies without consent is unlawful
- Establishes that data controllers cannot process data for purposes unrelated to the data subject’s actual relationship with them
Consequences of Non-Cooperation
- Demonstrates that failure to respond to ODPC notifications results in default judgment against the Respondent
- Non-cooperation with investigations will not shield respondents from liability
Broader Impact: This determination addresses a significant problem in Kenya’s insurance sector, where personal data is processed to issue policies without the knowledge or consent of the data subjects. It establishes that insurance companies cannot process personal data for policies that individuals have not applied for, and that failure to cooperate with ODPC investigations will result in adverse findings.