ROSE EMMA MUTHONI VERSUS SAMASOURCE KENYA EPZ LTD
1. Introduction
The case is in respect to the complainant, Rose Emma Muthoni against Samasource Kenya EPZ Ltd, on the processing of her personal data during an investigation without her consent, which led to an adverse investigation report and subsequent termination from employment. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant was subjected to an investigation into allegations of conflict of interest and receiving kickbacks from suppliers. The complainant alleged that the Respondent allowed a forensic company to access her personal Gmail accounts, personal bank account, and Mpesa statements without obtaining explicit consent, and processed her personal data without her consent, leading to an adverse investigation report and subsequent termination.
3. Analysis of Evidence
Complainant’s Position
- She had been employed by the Respondent for about 8 years until termination on 24th July 2023
- Preceding termination, she was subjected to a disciplinary hearing regarding allegations of conflict of interest and receiving kickbacks
- The investigation involved obtaining her laptop and resulted in a ‘Project Sync-Final Report’ dated 15th June 2023
- The report contained financial data extracted from her Mpesa account statement and Standard Chartered Bank Kenya Limited bank account
- Alleged that the forensic company accessed her personal Gmail accounts and financial statements, exceeding what was necessary for the investigation
Respondent’s Defense
- Confirmed the employer-employee relationship and that it is a duly registered Data Processor
- Stated the Complainant was under investigation internally and subsequently subjected to a disciplinary hearing
- Obtained express written consent from the Complainant on 8th May 2023 authorizing access to personal data contained in her work laptop relevant to the investigation
- Contracted a duly registered Data Processor and Forensic Auditor (Stealth Africa Consulting LLP) to conduct the forensic audit
- All documents relied upon were obtained solely from the Complainant’s work laptop and were collected and processed solely for the purpose of investigating the allegations
- The investigation report was only shared with Respondent’s officials involved in the investigation and disciplinary process
4. Issues for Determination
- Whether the Complainant’s personal data was processed in accordance with the law
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent obtained express written consent from the Complainant on 8th May 2023 authorizing access to personal data contained in her work laptop relevant to the investigation.
- The forensic auditor contracted by the Respondent acted as a data processor and processed data solely for the purpose of the investigation.
- The investigation report was only shared with Respondent’s officials involved in the investigation and disciplinary process.
- The complaint lacks merit and is hereby dismissed.
Orders:
- No compensation awarded as the complaint was dismissed.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Employer Investigations and Employee Consent
- Establishes that employers can conduct investigations into employee misconduct with proper consent
- Valid consent must be express, freely given, and specific to the investigation
Data Controller-Data Processor Relationship
- Confirms that engaging a forensic auditor as a data processor is lawful when they act on the controller’s instructions
- Forensic auditors processing data on behalf of the employer are not considered third parties
Broader Impact: This determination addresses a critical issue in Kenya’s workplace investigations, where employees often store personal data on company-issued devices. It establishes that employers can lawfully process personal data during investigations provided they obtain proper consent and limit processing to the scope of the investigation.