Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Abraham Owen Gumba Otieno claimed 360 Degrees Court Apartment Resident Association sent unsolicited emails despite his repeated objection, violating his right to object. The Respondent failed to respond. The ODPC found the association liable for disregarding rights and processing inaccurate data. They were ordered to pay KES 250,000 compensation.

Facts

According to the Complainant, the Respondent consistently sent him unsolicited emails. Despite making multiple requests via email, text messages, and attempted phone calls demanding that the Respondent halt these messages and remove his email address from their mailing list, the unsolicited communications persisted without fail. The Complainant further alleged that the Respondent had granted him access to transaction details belonging to another individual, which purportedly disclosed personal information in violation of that individual’s privacy rights. This failure to update records meant the Respondent continued processing inaccurate data related to the Complainant. The Complainant had made several attempts to communicate with the Respondent instructing them to stop contacting him. The remedies sought by the Complainant included compensation for the continued emailing and failure to remove his address, and a directive compelling the Respondent to cease all further communication and remove his email address from their mailing list.

The Respondent, upon being notified of the complaint, was entirely non-responsive. The Respondent did not submit a response to the Notification of Complaint, which meant that the allegations presented by the Complainant remained undisputed. Since the Respondent failed to take any action, the Data Commissioner was empowered by Regulation 11(2) of the Enforcement Regulations to proceed to determine the complaint.

The ODPC determined that there were two primary violations of the Data Protection Act:

1. The Respondent's continued processing of the Complainant’s personal data, despite repeated and clear objections, infringed upon the Complainant’s right to object to the processing of all or part of his personal data, as protected under Section 26(c) of the Act. This conduct demonstrated the Respondent's failure to uphold the Complainant’s rights.
2. The Respondent breached their obligations under Section 25(f) of the Act, which requires personal data to be accurate and kept up to date. The Respondent failed to take every reasonable step to ensure inaccurate personal data is either erased or corrected without delay. The evidence showed that the Respondent sent the Complainant transaction information relating to the individual who purchased the Complainant's house, revealing that the Respondent failed to update their records following the change in ownership. Consequently, the ODPC concluded that the Respondent failed to meet its statutory obligations and disregarded the Complainant's lawful right to object to the processing of his data.

• Legal Provisions Reviewed

Holding

The Respondent was found liable. As compensation for failing to honour the Complainant's right to object to the processing of his personal data, the Respondent was ordered to pay the Complainant Kenya Shillings Two Hundred and Fifty Thousand (KES. 250,000/=). Furthermore, an Enforcement Notice was ordered to be issued to the Respondent, pursuant to the Act and attendant regulations. This Enforcement Notice would compel the Respondent to erase all data relating to the Complainant and furnish proof of compliance. Parties were informed they retain the right to appeal this determination to the High Court of Kenya within thirty days.

Comment

The full text of the ruling is available below.