Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The complaint concerned the Respondent's failure to delete the Complainant's personal data despite repeated requests. The Data Commissioner determined that Wananchi Group had infringed on the Complainant's rights regarding their personal data. They were ordered to delete the data, cease processing it, and pay KES 500,000 in compensation.

Facts

The Complainant claimed that the Respondent had failed to delete their personal data despite multiple requests.

The Complainant contended that they had ceased to be a customer of the Respondent years ago and had since made verbal, phone, and email requests for the erasure of their personal information, which the Respondent had ignored.

The Complainant further stated that on 16th November 2024, they attempted to escalate the issue formally via email to the address listed on their website, but the email address was invalid, and their message was undelivered16 . They also alleged the ongoing retention and misuse of their personal data violates their rights under the Data Protection Act, 2019, including the right to erasure and the right to object to the processing of personal data for marketing purposes.

In its response, the Respondent stated that upon receiving the complaint, they conducted a comprehensive review of their records and systems and found that they did not receive any data deletion requests from the Complainant through any of their official communication channels. The Respondent contended that they have maintained robust systems to ensure compliance with the DPA and prioritize the rights of data subjects, including the right to erasure.

They stated that they would be pleased to reassess the matter promptly. However, in the absence of a record or a formal deletion request, they regretfully conclude that the allegation is not substantiated.

Subsequent to the site visit conducted by the Office, the Respondent provided a response confirming that the Complainant subscribed to their services on 2nd June, 2016 and that the last payment made by him was on 10th December, 2022.

They stated that their records indicate that the Complainant has never visited their offices to lodge any request for service termination or data deletion nor has he ever formally requested the deletion of their personal data, either physically or through any of their official communication channels. The Respondent maintained that the email addresses provided on their official website are accurate, operational, and regularly monitored.

The Office found that:

• the Complainant had written to the Respondent on 16th November 2024, asking the Respondent to stop sending him unsolicited communications and to immediately delete his personal data which was no longer necessary for the purpose for which it was collected. The Complainant was unable to do so due to the Respondent's defective e-mail contact channel. The Office considered that despite the investigations conducted by this Office proving the Complainant's rights aforementioned, the investigations conducted by the Office proved that the electronic communication channels provided, the Office attempted to use the channels but the said channel was invalid and non-operational. Whilst the Respondent distances itself from the infringement of the Complainant's rights aforementioned, the investigations conducted by this Office proved that the electronic communication channels provided, the Office attempted to use the channels but the said channel was invalid and non-operational.
• that the Respondent was denied an avenue to exercise his right to object to the processing of his personal data by the Respondent and his right to deletion of misleading data provided in Section 26(a) of the Act and Section 26 (e) as read with Section 40(1)(b) of the Act, respectively violating his aforementioned rights.
• the Respondent obstructed the Data Commissioner as the Office was not able to verify the Respondent's assertions with regards to the complaint. As such, the Respondent's response to the complaint herein remained to be mere denials. No evidence was adduced to support its assertions.