Zuku Fibre, Geosky Service fined Sh950,000 for violating personal data privacy
Zuku had argued that it has maintained its system to ensure compliance with the Data Protection Act and prioritise the rights of data subjects, including the right to erase
The Office of the Data Protection Commission (ODPC) has fined Wananchi Group (K) Ltd and Geosky Service Ltd Ksh 500,000 and Ksh 450,000 for violating personal data privacy without lawful basis.
In the first case, ODPC received a complaint from Yasin Abukar that he had asked Wananchi Group T/A Zuku Fibre Ltd to delete his personal data but it failed to do so despite repeated request.
Abukar submitted that he had stopped being Zuku’s client years back but it continued to send him promotional messages despite his verbal, phone and e-mail requests to Zuku to delete his personal information from its systems and databases.
Abukar had argued that the ongoing retention of his personal information increases the risk of unauthorised access or misuse exposing him to potential fraud or identity theft.
But when given the opportunity to respond, Zuku stated that they conducted a comprehensive review of their records and systems and found out that they did not receive any data deletion requests from individuals bearing the name of the complainant through any of their communication channels.
It further maintained that it has maintained its system to ensure compliance with the Data Protection Act (DPA) and prioritise the rights of data subjects, including the right to erase.
However, when the ODPC visited Zuku’s offices to conduct the investigations, the respondent was uncooperative and refused to comply with the court order granting them access to search the respondent premises, digital and manual records, systems, and databases.
Having found that by denying Abukar the opportunity to exercise his data protection rights the respondent violated the complainant right to object and right to erase. Therefore, taking into account the respondent’s refusal to allow them investigate the matter, the ODPC had no option to award the complainant Ksh 500,000 for violating his privacy and right.
Regarding the second case, Geosky Service Ltd was found liable for processing Ayub Odanya Naburi’s personal data without a lawful basis and denying him an opportunity to exercise his right to information before processing his personal data.
ODPC revealed that Naburi lodged a complaint that Geosky without authorisation processed his personal data to apply for tender at the Central Bank of Kenya.
“The complainant asserts that the respondent misrepresented him as their employee and falsely included his professional membership details to enhance their bid’s credibility,” ODPC said.
Interestingly, when given the opportunity to defend itself from the accusations, Geosky chose not to respond.
ODPC noted that Article 31(c) and (d) of the Constitution of Kenya provides for the right to privacy, which is similarly guaranteed under the Data Protection Act.
Subsequently, it awarded Naburi Ksh 450, 000 for violation of his data privacy.
