Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged receiving unwanted messages from Sunking Limited consistently for the past year, despite her requests to be opted out, and not being a client. The Data Commissioner found that the Respondent infringed the Complainant's right to be informed of the use of her data and to object to processing.. Sunking Limited was ordered to pay KES 250,000 in compensation

Facts

Risper Onyango complained about receiving unwanted messages from Sunking Limited at least twice a week consistently for the past year despite not being their client and having never engaged with them for any services or products.

The Complainant stated that the messages revolve around the allegation by the Respondent of the outstanding balance of particular products, which she has never purchased. She asserted that she has been unable to reach out to the Respondent as no opt-out option is provided in the messages. The Complainant requested to be opted out of the messaging list and for the Respondent to adhere to data protection regulations.

Sunking Limited did not submit a response to the notification of complaint dated 25th November 2024. Therefore, the allegations were treated as uncontroverted.

The Office found that the Respondent was sending unsolicited messages to the Complainant, who is not their client, concerning outstanding balances for products she had not purchased. The Office determined that the Respondent processed the Complainant's personal data (mobile phone number) for direct marketing purposes without her consent and without providing an opt-out mechanism.

The Respondent failed to inform the Complainant how they obtained her mobile number and for what purpose it was being used. The Respondent also failed to provide a mechanism for the Complainant to opt out of receiving these messages, thus infringing on her right to object to direct marketing as contemplated under Section 37 of the Act.

Evaluation of Applicable Laws

The Data Commissioner reviewed several legal provisions. These include:

• Article 31(c) and (d) of the Constitution of Kenya, which provides for the right to privacy.
• Section 5 of the Data Protection Act, 2019, which establishes the Office of the Data Protection Commissioner and outlines its mandate, including regulating personal data processing and protecting individual privacy.
• Section 8(1)(f) of the Data Protection Act, 2019, which grants the Office the power to receive and investigate complaints regarding infringements of rights under the Act.
• Section 25 of the Data Protection Act, 2019, which sets out the principles guiding the processing of personal data.