| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Legal Provisions Reviewed |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 15 November 2024 |
| Decided: | 10 February 2025 |
| Published: | Yes |
| Fine: | KES.450,000.00 |
| Parties: | Ayub O. Naburi vs. Geosky Service Ltd |
| Case No.: | 1844 of 2024 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Ayub Odanya Naburi complained that Geosky Service Limited unauthorisedly used his data for a tender, misrepresenting him as an employee. Geosky did not respond to the complaint. The ODPC found Geosky liable for unlawful data use and non-fulfilment of duty to notify. Geosky was ordered to pay KES 450,000 in compensation.
The complainant, Ayub Odanya Naburi, alleged that Geosky Service Limited (the respondent) unauthorisedly processed his personal data to apply for a tender at the Central Bank of Kenya.
The complainant asserted that the respondent misrepresented him as their employee and falsely included his professional membership details to enhance their bid's credibility.
The complainant stated that the respondent's actions constituted multiple violations of data protection laws, including unauthorised disclosure of personal and professional data, false representation of employment status, unlawful processing of personal data without consent, and unauthorised use of personal information for commercial gain.
The respondent did not submit a response to the notification of the complaint.
The ODPC noted that Regulation 11(2) states that "where a respondent does not take any action as contemplated in the notification of complaint, the Data Commissioner shall proceed to determine the complaint in accordance with the Act and the Enforcement Regulations.
The ODPC determined that the respondent violated the complainant's right to be informed under Section 26(a) of the Data Protection Act.
The ODPC found that the respondent did not establish a lawful basis for processing the complainant's personal data.
The ODPC determined the respondent didn't meet the threshold for indirect collection of personal data.
The ODPC also found that the respondent did not fulfil their duty to notify the Complainant as required by the Act.
Legal provisions reviewed
In determining the matter between Ayub Odanya Naburi and Geosky Service Limited, the Office of the Data Protection Commissioner (ODPC) reviewed several legal provisions. These include: