ODPC COMPLAINT NO. 1880 OF 2024
1. Introduction
This case involves a complaint by Yasin Abukar (Complainant) against Wananchi Group (Kenya) Limited trading as Zuku Fibre Kenya (Respondent) regarding failure to delete personal data despite repeated requests, in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant alleged that the Respondent failed to delete his personal data despite repeated requests, continued to send unsolicited communications, and maintained non-functional data protection contact channels.
3. Analysis of Evidence
Complainant’s Position
- Made multiple requests for data deletion which were ignored
- Received unsolicited communications including a “Service Auto Suspension Notification” after complaint was lodged
- Attempted to use Respondent’s provided email for data requests but found it invalid
- Experienced distress and potential risk of identity theft due to unauthorized data retention
Respondent’s Defense
- Claimed no record of receiving data deletion requests from Complainant
- Asserted they maintain robust systems for data protection compliance
- Failed to cooperate with ODPC investigation, including refusing a search warrant
- Provided conflicting and non-functional email channels for data requests
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act and its attendant regulations
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
- The Respondent was found liable for violating the Complainant’s right to object to processing and right to erasure under Sections 26(c), 26(e), 36, and 40(1)(b) of the Data Protection Act
- The Respondent was ordered to:
- Delete the Complainant’s personal data and stop all communications
- Pay compensation of KES 500,000 to the Complainant
- Recommended prosecution of Respondent’s directors for obstructing the Data Commissioner under Section 61 of the Act
- Parties retain the right to appeal the decision to the High Court of Kenya within 30 days
6. Significance and Impact
Data Subject Rights Enforcement
- Reinforces the right to erasure and right to object as fundamental data protection rights
- Establishes that organizations must maintain functional channels for data subject requests
Regulatory Compliance
- Demonstrates serious consequences for obstructing ODPC investigations
- Sets precedent for personal liability of company directors in data protection violations
Telecommunications Sector
- Highlights specific obligations for ISPs and digital service providers regarding customer data
- Emphasizes need for proper data retention and deletion policies
Broader Impact: This ruling strengthens enforcement of data subject rights in Kenya and serves as a warning against non-cooperation with regulatory investigations, particularly in the telecommunications sector.
For full determination, click 🗃️
