Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Yasin Abukar complained that Zuku Fibre Kenya failed to erase his data despite requests, violating his data protection rights. Zuku claimed no deletion request was received and that their systems are robust. The ODPC ruled Zuku denied Abukar's rights, ordering them to delete his data, stop contacting him, and pay KES 500,000 in compensation. The ODPC also recommended prosecuting Zuku's directors.

Facts

Yasin Abukar claimed that Wananchi Group (Kenya) Limited T/A Zuku Fibre Kenya (referred to as the Respondent) failed to erase his personal data despite multiple requests.

Abukar claimed he stopped being Zuku's client years ago, but the Respondent continued sending him promotional messages, despite verbal, phone, and email requests to delete his personal information from their systems and databases.

Abukar stated that he tried to escalate the issue via email on 16th November 2024, but the email address listed on the website was invalid, and his message was undelivered.

Abukar contended that the ongoing retention and misuse of his personal data violated his rights under the Data Protection Act, 2019, including the right to erase and object to processing his data for marketing. He believed this increased the risk of unauthorized access or misuse, exposing him to potential fraud or identity theft.

Abukar stated that repeated unsolicited calls and communication caused inconvenience and distress, and a lack of responsiveness eroded trust in the company's data handling practices. He further demonstrated his fruitless attempts to address the matter directly with the company multiple times, but no meaningful action had been taken.

Abukar added that he attempted to escalate the issue via email, but the address provided on their website was invalid. Abukar contended that on 15th December 2024, he received an email from Wananchi Group (Zuku) titled "Service Auto Suspension Notification". Abukar stated that an attempted data deletion request was posted via email on the website.

The Respondent stated that upon receiving the complaint, they conducted a comprehensive review of their records and systems and found that they did not receive any data deletion requests from an individual bearing Abukar's name through any of their communication channels.

The Respondent contended that they have maintained robust systems to ensure compliance with the Data Protection Act and prioritize the rights of data subjects, including the right to erasure. The Respondent stated they would be pleased to reassess the matter promptly. However, in the absence of a record or formal deletion request, they regrettably concluded that the allegation was not substantiated.

The Respondent provided a response confirming that Abukar subscribed to their services on 2nd June 2016, and his last payment was on 10th December 2022. They stated that records indicate Abukar never visited their offices to lodge any request for service termination or data deletion, nor has he formally requested deletion of his personal data, either physically or through their official communication channels.

The Respondent maintained that the email addresses provided on their official website are accurate, operational, and regularly monitored. They stated that the same channels were successfully used by the Office to contact them, and they duly responded.

In a letter dated 31st January 2025, the Respondent reiterated their position, requesting additional information to enable them to identify Abukar within their systems.