Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Grass International Ltd was found liable for violating the Data Protection Act, 2019 by failing to provide opt-out mechanisms for the Complainant after sending her unsolicited marketing messages and continuing to send them despite her requests to stop.

Facts

Agnes Kimanzi (the “Complainant”) alleged that Grass Internation Ltd (the “1st Respondent”) continously sent her direct marketing messages notwithstanding her request for them to stop doing so.

The 1st Respondent averred that the messages emanated from Solomon Muthui (the “2nd Respondent”), a distributor of the 1st Respondent. The 1st Respondent averred that following its intervention, the 2nd Respondent had initiated concilliation with the Complainant and believed the issue to have been settled amicably between them when the two parties agreed to block each others contacts.

The Complainant disputed that the matter had been subjected to arbitration. Without an arbitration agreement, the office of the ODPC therefore got fully involved in the matter.

The ODPC found that the Respondents:

• did not obtain the Complainant’s contact directly from her,
• Did not obtain the Complainant’s consent prior to the use of her personal data in direct marketing,
• did not notify the Complainant of the use of her personal data,
• Did not provide a opt out mechanism for use by the Complainant.
• Blocking is not provide for in law as a way of honouring an erasure request.

Holding

The ODPC held that: