| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25, 26 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Non-Violation |
| Started: | 13 August 2023 |
| Decided: | 8 November 2023 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | Wycliffe Keya vs. KCB Bank Kenya Ltd |
| Case No.: | 1461 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
KCB Bank Kenya Ltd (the “Respondent “)
Wycliffe Keya (the “Complainant”) was a customer of KCB Bank Kenya Ltd (the “Respondent “) a financial institution engaged in interalia lending business.
The Complainant took out a credit facility with the Respondent bank. He repaid the facility in full and was subsequently issued with a Clearance Certificate by Metropol Ltd, a credit reference bureau.
He avers that subsequently he was surprised to receive a demand from a third party debt collection agency as regards an alleged outstanding facilities with the Respondent. The debt collection agency persisted in its demands for payment even after the Respondent shared with them evidence of repayment of the debt and the Clearance Certificate necessitating the complaint to the ODPC.
The Processor averred that it was acting under instructions from the Respondent as regards the outstanding amount.
The Respondent on the other hand averred that it instructed the Processor to close the file on the Complaint and produced evidence to this effect. The Processor did not honor those instructions.
The ODPC found that the Complainant had initially reached out to the Respondent to instruct the Processor to cease further contact with the Complainant thereby exercising his right to rectification which was done. The Respondent duly communicated the resolved status in respect of the Complainant's account to the Processor. The Processor's failure to abode by the instructions of the Respondent violated the DPA,19.
The ODPC held that:
The ODPC did not name or enjoin the data processor in the matter, a move which differs from its action taken in [insert case ref]