Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC found Henner GMC liable for unlawfully using a minor’s personal data during a training session without consent. The Office ordered Henner to pay KES 800,000 in compensation and issued an Enforcement Notice for violating the Data Protection Act, 2019. Both parties retain the right to appeal.

Facts

Esther Mareka, acting on behalf of her minor son (M.N.), lodged a complaint with the Office of the Data Protection Commissioner (ODPC).

She alleged that Henner GMC used her son's personal data, specifically his full name, date of birth, and member ID, during a training session in Uganda without her knowledge or consent.

The issue arose when she received an alarming email from Henner GMC suggesting that her son had been hospitalized in Uganda, which confused and distressed her since she was abroad at the time and unaware of any such event. Upon inquiry, Henner GMC admitted that her son's real personal data had been used accidentally during a healthcare training exercise for a partner hospital.

The complainant accused Henner GMC of:

• Unauthorized use of her son's personal data.
• Minimizing the seriousness of the incident.
• Causing emotional distress.
• Failing to sufficiently address her concerns, even after legal communication through her advocates.

She sought an admission of liability and compensation for the infringement of her son’s data rights.

Henner GMC responded as follows:

• They clarified that Henner Kenya Limited had processed the data, not Henner GMC directly.