Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Jacqueline Njoki alleged My Dawa sent unsolicited promotions repeatedly despite explicit opt-out requests. My Dawa was non-responsive. The Data Commissioner found the Respondent liable for infringing the right to object (Section 26(c)) and unlawful processing (Section 25). An enforcement notice was issued against the Respondent.

Facts

The Complainant, Jacqueline Njoki Wanjohi, lodged the complaint on April 5, 2025. She asserted that the Respondent continued to send her numerous unsolicited promotional messages despite repeated requests for the activity to stop.

The Complainant alleged she received promotional text messages from the Respondent almost every day despite her explicit requests to be removed from their database. She substantiated her claims by providing a screenshot of the text messages and the related email correspondence. Furthermore, the Complainant stated that she exercised her right to object to the processing of her data by sending an email to the Respondent and by using the *456*9*5# opt-out mechanism, but these efforts were to no avail. The Complainant sought remedies, specifically praying for the deletion of all her details from the Respondent's contacts or database.

The Office of the Data Protection Commissioner (the Office) notified the Respondent of the complaint on April 15, 2025, and requested evidence supporting the lawful basis for data processing, along with proof that the Complainant consented to her personal data being used for promotional purposes. However, the Respondent was non-responsive and did not submit a response to the Notification of Complaint. Consequently, based on Regulation 11(2) of the Enforcement Regulations, the Data Commissioner proceeded to determine the complaint based on the available information. Because the Respondent remained non-responsive, the allegations made by the Complainant were deemed undisputed.

The Office of the Data Protection Commissioner (ODPC) determined that since the Respondent’s allegations remained uncontroverted, it was established that the Respondent continued to send unsolicited text messages despite the Complainant’s objections and requests for cessation.

The ODPC concluded that the Respondent’s continued processing of the Complainant’s data, despite the explicit objection, constituted an infringement of the Complainant’s right to object under Section 26(c) of the Data Protection Act.

Furthermore, the ODPC found that the Respondent failed to fulfill its obligations under the Act. Specifically:

1. The Respondent failed to demonstrate the legal basis for processing the Complainant’s personal data as required by Section 30 of the Act.
2. The Respondent failed to demonstrate adherence to the principle of purpose limitation.
3. The failure to respect the Complainant’s right to object, alongside the continued sending of promotional messages, was found to constitute unfair and unlawful processing in breach of Section 25 (Data Protection Principles).

• Evaluation of Applicable Laws