Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Griffins Wekesa complained My Boda Limited sent unsolicited promotional messages and continued contact despite requests to stop. My Boda was found to have unlawfully processed his personal data. They were ordered to delete his data, cease contact, and an enforcement notice was issued.

Facts

The Complainant alleged that the Respondent had been sending him promotional messages despite him never having given the Respondent his contacts or allowed his contacts to receive messages from the Respondent. He stated that he had never been to any of the Respondent’s offices or enquired about them online. The Complainant also contended that he attempted to reach out to the Respondent but his calls were ignored.

The Office of the Data Protection Commissioner (ODPC) notified the Respondent of the complaint and requested a response to the allegations, relevant materials, the lawful basis for processing the Complainant's personal data, details on how the data was obtained and stored, evidence of consent, and information on an opt-out mechanism. However, the sources indicate that the Respondent was non-responsive and did not file a response to the Notification of Complaint. Consequently, the allegations made by the Complainant remained uncontroverted.

The ODPC made the following findings during its determination:

• The ODPC found that the Respondent failed to establish a lawful basis for processing the Complainant's personal data.
• The determination considered Section 30 of the Data Protection Act, which outlines lawful bases for processing personal data, such as consent, performance of a contract, legal compliance, vital interests, public interest, public authority tasks, legitimate interests, or for specific research purposes.
• Given the Respondent's lack of response, the ODPC concluded that the Complainant’s personal data was not lawfully processed.
• The ODPC further determined that, under Regulation 14 (2) of the Enforcement Regulations, the Complainant was entitled to remedies.
• Based on the evidence (or lack thereof from the Respondent), the ODPC found that the Respondent should be ordered to delete the Complainant's personal data.
• Evaluation of Applicable Laws

Holding

The final determination by the Data Commissioner held that:

• The Respondent is hereby found liable.
• The Respondent is ordered to delete the Complainant's personal data from its systems.
• The Respondent is ordered to stop contacting the Complainant.
• The Respondent must provide proof of compliance to the ODPC within 7 days from the date of the determination.
• An Enforcement Notice is being issued to the Respondent.
• The parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.

Comment

The full text of the ruling is available below.

Further resources

Share blogs or news articles here!

The Decision