| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25, 30, 45, 65 of the Data Protection Act, 2019; Regulation 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021; Section 9A(1) of the County Government Act, 2012; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 18 July 2024 |
| Decided: | 14 October 2024 |
| Published: | Yes |
| Fine: | KES.900,000 |
| Parties: | Allan Chacha vs. The County Assembly of Migori |
| Case No.: | 1080 of 2024 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
A Complainant applied to be Speaker of Migori County Assembly. The County Assembly published his CV on its website, without consent. The Complainant alleged this was unlawful and violated his right to privacy. The Respondent claimed lawful basis for processing the data under the County Government Act, 2012 and Migori County Assembly Standing Orders. The ODPC determined the Respondent's actions violated data protection principles and awarded the Complainant a KES.900,000 compensation.
The Complainant applied for the position of Speaker of the Migori County Assembly and submitted his curriculum vitae as part of his application.
The Respondent, the County Assembly of Migori, published the Complainant’s curriculum vitae on its official website without his consent. The Complainant argued that this publication was unauthorised, exposed his personal and confidential information to the public, and violated his right to privacy.
The Complainant stated that the curriculum vitae contained confidential information of individuals listed as references, compromising their privacy as well.
The Respondent argued that it had a lawful basis for processing the Complainant’s personal data.
The Speaker of the County Assembly, citing the County Government Act, 2012, and the Migori County Assembly Standing Orders, asserted that the curriculum vitae of all candidates for the position of Speaker should be made public.
The Respondent claimed that Section 51(2)(c) of the Data Protection Act exempts the processing where disclosure is required by or under any written law.
The Respondent pleaded that it did not occasion an infringement on the Complainant or any other applicant.
The ODPC reviewed the Complainant’s curriculum vitae, the Respondent’s website, the relevant provisions of the County Government Act, 2012, and the Migori County Assembly Standing Orders.
The ODPC found: