| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 56 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 12 October 2023 |
| Decided: | 9 January 2024 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | George Maina Mwangi vs. Customs Manager, ICMS Licensing - KRA |
| Case No.: | 2052 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
The Customs Manager, ICMS Licensing - KRA (the “Respondent”) did not breach the requirements of the Data Protection Act 2019 as he did not expose the personal data of the Complainant to a third party, having already initiated and completed a user change request to remove the Complainant's personal details from the system after he left employment.
The case involves a complaint filed by George Maina (referred to as "the Complainant") under Section 56 of the Data Protection Act. The complaint was made pursuant to alleged infringements of the Complainant's rights under the Act. The Respondent in this case is accused of failing to disable or revoke the Complainant's profile in a timely manner, as per the Complainant's request.
The Complainant provided evidence in the form of a screenshot and a copy of the impugned profile's user information, as well as a letter dated 12th May 2021 requesting the Respondent to disable and/or revoke his profile. On the other hand, the Respondent presented evidence including a letter dated 7th May 2021 and an email thread capturing the resolution of the complainant's request.
The issues for determination include whether the Complainant's rights were infringed upon and whether the Complainant is entitled to any remedy under the Act. The analysis conducted by the Office of the Data Protection Commissioner focused on the actions taken by the Respondent in response to the Complainant's request and the timeline of events.
The analysis of the evidence led to the finding that the Respondent had initiated the process of revocation, deletion, and change of the Complainant's profile as a super user on 7th May 2021. It was also noted that the Respondent had changed the user rights from the Complainant to another person as requested by the factory manager and the managing director of the company associated with the profile. The Respondent argued that by the time the Complainant was exercising his right, they had already deleted and/or disabled his account from its system.
The ODPC's determination and analysis revolved around the actions taken by both parties, the timeline of events, and the rights of the data subject under the Data Protection Act.
The ODPC held that the complaint lacked merit and dismissed it.
The full text of the ruling is available below.
Share blogs or news articles here!