Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. Decision

Summary

NITA-U took enforcement action against Guinness Transporters Limited T/A Safeboda (the “Respondent”) on the basis that the company unlawfully disclosed data to third parties. NITA-U directed that the Respondent make changes to its manner of handling personal data, in particular their information notices and data sharing practices.

Facts

A complaint was made to NITA-U that SafeBoda, a platform that connects motorcycle taxi riders with passengers, was sharing users' data with third-parties (Meta) and illegally selling the data without the consent of users.

It is alleged that the Respondent disclosed its users’ personal data to CleverTap (a data processor based in the United States that offered Software as a Service for customer lifestyle management and mobile marketing) in contravention to the Data Protection and Privacy Act. The consents’ relied upon for the disclosure were not specific neither were they informed, given that a) The users were not informed of the extent of the personal data collected, and b) the potential disclosure of their personal data with Clever Tap.

Holding

NITA-U held as follows. The Respondent:

• Did not disclose to the data subjects the recipients of the data collected from them as required by law.
• Shared users’ personal data with an analytics company called CleverTap without their consent in breach of the DDPA.
• Entered into a contract with which included a commitment to maintain confidentiality and security of the data collected. However, there were no safeguards to ensure confidentiality and integrity of the data collected.
• The Respondent had designated a Data Protection Officer as required by the DPPA.
• The Respondent did not have well documented procedures for breaches in security which affected its ability to detect and immediately notify the Data Protection Officer and NITA-U of breaches.
• The Respondent did not sell users’ data.

The Respondent was asked to make reforms as regards the sharing of personal data, so that people can be provided with an opportunity to give specific and informed consent, in particular, to clearly inform its customers of the third parties it may disclose their personal data to, in accordance with the principle of fairness. NITA-U further requires SafeBoda to specify safeguards in place for cross-border transfer of personal data. The reforms to be implemented within 4 months of the ruling.