Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged The Legend Hotel unlawfully processed his personal data by sending promotional messages without consent, even after he opted out. The ODPC found the hotel liable for infringing his right to be informed. The final ruling ordered the Respondent to pay KES 250,000 as compensation.

Facts

The Complainant alleged that the Respondent, The Legend Hotel, unlawfully processed his personal data by sending him promotional messages without his consent. He maintained that this conduct amounted to a failure by the Respondent to respect his statutory right to object to the processing of his personal data for direct marketing purposes, constituting a breach of the principles of lawfulness, fairness, and transparency under the Data Protection Act. Crucially, the Complainant claimed that despite receiving a confirmation that he had successfully opted out of receiving promotional messages, the Respondent continued to send marketing communications. He pleaded that the opt-out mechanism provided in the messages was non-functional, resulting in continued unsolicited marketing, and asserted that his rights were violated because his personal data was processed without a lawful basis.

The Respondent, The Legend Hotel, pleaded that it lawfully collected contact details directly from data subjects during payment transactions, specifically via mobile banking. They asserted this data was used solely for the purpose of sending promotional messages to inform clients of upcoming events that might be of interest, without any malicious or unlawful intent, and affirmed that the data was not shared with third parties. While acknowledging that such promotional messaging is a common and accepted practice, the Respondent claimed that every promotional message included an advisory allowing recipients to opt out. Furthermore, they suggested that the Complainant’s continued receipt of messages following an opt-out request could only result from technical anomalies beyond their control. The Respondent emphasized that they took the Complainant’s feedback seriously and promptly removed his phone number from their system to prevent further communication.

Following investigations, the Office of the Data Protection Commissioner (ODPC) established that the Respondent had processed the Complainant's personal data for commercial purposes without consent. The ODPC found that the Respondent failed to provide evidence that they had obtained the Complainant’s express consent to process his personal data for commercial or promotional purposes. Furthermore, the Respondent failed to discharge the burden of proving that they informed the Complainant of the use to which his personal data was to be put at the point of collection, thereby violating his right to be informed under Section 26(a) of the Act. The ODPC determined that retaining contact details after payment for a product and subsequently processing such data for promotional or marketing purposes, without obtaining additional and specific consent, constituted a breach of the purpose limitation principles (Section 25(c)) and the storage limitation principles (Section 25(g)) under the Act. Although the Respondent attributed the continued messaging to technical issues, they failed to provide evidence to substantiate this claim. Ultimately, the ODPC found that the Complainant’s rights under Sections 26(a) and (c) of the Act were violated by the Respondent.

• Legal Provisions Reviewed

Holding

The Data Commissioner made a final determination, finding The Legend Hotel liable for infringement of the Complainant’s rights as a data subject. The Respondent was ordered to compensate the Complainant KES 250,000 (Two Hundred and Fifty Thousand Kenya Shillings). Additionally, an Enforcement Notice is to be issued to the Respondent. The determination also informed the parties of their right to appeal the decision to the High Court of Kenya within thirty days.

Comment

The full text of the ruling is available below.

Further resources

Share blogs or news articles here!