Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC concluded that UMBA Microfinance Bank Ltd (the Respondent) violated the Act by sending direct marketing messages to the Complainant without first obtaining her express consent. The Respondent's claim that they were entitled to collect and use the Complainant's phone number because it was publicly available was rejected by the ODPC. The ODPC emphasised that the law requires express consent for using personal data for direct marketing, even when the data is publicly available.

Facts

The Complainant filed a complaint on 7th June 2024 alleging that the Respondent (Umba Microfinance Bank) sent her a direct marketing message without her knowledge or consent. The Complainant provided a screenshot of the message as proof.

The Respondent acknowledged sending a message to the Complainant on 4th June 2024. They claimed that the Complainant's number was publicly available on her public Facebook page, where she provided a link to a car hire service known as "Rent my Ride".

The Respondent stated that they relied on Section 28(b) of the Act, which states that personal data may be collected indirectly where the data subject has deliberately made the data public. In this instance, the Respondent argued that the Complainant had displayed her phone number publicly and the information was still publicly available as at 18th July 2024.

The Respondent further stated that, in respect of data subjects' rights, as provided under the Act, they promptly informed the Complainant why she was being contacted and prompted her to join the WhatsApp group if she was interested in further engagement.

The Respondent noted that the Complainant did not take any action after the receipt of the message and did not send her any further messages. They also claimed that the Complainant did not want to be contacted by it and promptly deleted her information from its database and did not send her another promotional message.

The Respondent stated that it held a meeting with the Complainant on 15th July 2024 and agreed that it will delete her data and never contact her again. However, parties were not able to agree on the Complainant’s demand for compensation. The Respondent stated that it did not breach any of the rights of the Complainant.

The Office of the Data Protection Commissioner (ODPC) established that the Complainant received a direct marketing message from the Respondent.

The ODPC was not able to ascertain that the Complainant’s mobile phone number was publicly available at "Rent my Ride" Facebook page as the link provided returned the following message from Facebook, "This content isn’t available at the moment. When this happens, it’s usually because the owner only shared it with a small group of people or changed who can see it, or it’s been deleted."

The ODPC determined that the Respondent admitted to having sent a marketing message to the Complainant. It found that the Respondent's claim that personal data may be collected indirectly where the data subject has deliberately made the data public does not apply in this case.

The ODPC concluded that the Respondent proceeded to send marketing messages to the Complainant without her express consent, contrary to Section 37 of the Act.

The ODPC emphasized that using publicly available personal data for marketing purposes without obtaining express consent from the data subject constitutes a violation of Section 37 of the Act and is therefore unlawful.