Authority: ODPC - Kenya
Jurisdiction: Kenya
Relevant law: Section 25, 26 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya
Type: Complaint
Outcome: Non-Violation
Started: 13 August 2023
Decided: 8 November 2023
Published: Yes
Fine: N/A
Parties: Wycliffe Keya vs. KCB Bank Kenya Ltd
Case No.: 1461 of 2023
Appeal: N/A
Original Source: ODPC
Original contributor: MZIZI Africa

Contents

  1. Summary
    1. Facts
    2. Holding
  2. Comment
  3. Further resources
  4. The Decision

Summary

KCB Bank Kenya Ltd (the “Respondent “)

Facts

Wycliffe Keya (the “Complainant”) was a customer of KCB Bank Kenya Ltd (the “Respondent “) a financial institution engaged in interalia lending business.

The Complainant took out a credit facility with the Respondent bank. He repaid the facility in full and was subsequently issued with a Clearance Certificate by Metropol Ltd, a credit reference bureau.

He avers that subsequently he was surprised to receive a demand from a third party debt collection agency as regards an alleged outstanding facilities with the Respondent. The debt collection agency persisted in its demands for payment even after the Respondent shared with them evidence of repayment of the debt and the Clearance Certificate necessitating the complaint to the ODPC.

The Processor averred that it was acting under instructions from the Respondent as regards the outstanding amount.

The Respondent on the other hand averred that it instructed the Processor to close the file on the Complaint and produced evidence to this effect. The Processor did not honor those instructions.

The ODPC found that the Complainant had initially reached out to the Respondent to instruct the Processor to cease further contact with the Complainant thereby exercising his right to rectification which was done. The Respondent duly communicated the resolved status in respect of the Complainant's account to the Processor. The Processor's failure to abode by the instructions of the Respondent violated the DPA,19.

Holding

The ODPC held that:

Comment

The ODPC did not name or enjoin the data processor in the matter, a move which differs from its action taken in [insert case ref]