Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC dismissed the complaint against Credit Bank Ltd (the “Respondent”) for lack of proof that it was responsible for the leak of a customer's personal data.

Facts

Chantal Marisa Fande (the “Complainant”) was a customer of Credit Bank Ltd (the “Respondent”). She accused the Respondent of releasing or abetting the release of her personal data and that of her daughter to third parties to wit, a newspaper outlet, Kenya News Makers and a reporter, Peter Wambugu.

The Respondent denied that the information came from the Respondent or its employees. The Respondent indicated in its responce that the Complainant notified it that the information was released to the Directorate of Criminal Investigation by an unnamed whistleblower. Further, the Respondent averred that the news blogger indicated in the news article written on the same matter, that the information was obtained from an unamed whistleblower and not the Respondent.

Holding

The ODPC held that:

• There was no link between the breach and the Respondent.
• The Complainant failed to demonstrate the loss occassioned to her as a result of the data breach.

The Complaint was dismissed and the matter referred by the ODPC to the DCI for investigation.

Comment

Establishing causal link between the respondent and the complaint in disputes.

Further resources

Share blogs or news articles here!