Introduction 

Every year on 28 January, the world observes International Data Privacy Day to commemorate the signing 41 years ago of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, popularly known as Convention 108, the only international convention on data protection. 

This year’s celebration fell shortly after Kenya’s fifth anniversary of its privacy and data protection law (The Data Protection Act, Chapter 411C of the Laws of Kenya (DPA)) which came into force on 25 November 2019.

The Office of the Data Protection Commissioner (ODPC/Data Commissioner) marked International Data Privacy Day this year under the theme “Safeguarding Personal Data to Spur Digital Transformation and Economic Development.” This theme emphasises the vital role data privacy plays in supporting sustainable growth in today’s digital world. By protecting personal data, businesses can foster trust, drive innovation and create secure digital environments, especially in an era increasingly dominated by artificial intelligence. 

As part of commemorating International Data Privacy Day, we highlight emerging trends from the Data Commissioner’s enforcement actions which provide valuable insights to persons handling personal data to assess their current privacy practices, identify potential compliance gaps and take proactive steps towards ensuring full compliance with the DPA.

The Data Commissioner has been actively taking actions to enforce the DPA. Some of the key actions taken include:

Enforcement actions: The ODPC’s approach to enforcement has been robust, with a focus on holding entities accountable for data protection violations. The following actions highlight the seriousness with which the ODPC initially addressed non-compliance:

• In December 2022, the ODPC imposed its first fine of KES 5 million (approximately US$39,000) against Oppo Kenya. This was following failure by Oppo Kenya to comply with an enforcement notice issued in connection with a data subject’s complaint that Oppo Kenya had used the data subject’s photo on its Instagram account without consent. The enforcement notice required the company to put in place a data protection policy and provide proof of an internal complaints mechanism for addressing data subjects’ grievances.
• In April 2023, the ODPC imposed fines of KES 5 million (approximately US$39,000) against both Whitepath and Regus Kenya. The ODPC took the action against Whitepath after receiving about 150 complaints against the company in relation to its mobile apps, which accessed users’ phone contacts and sent unsolicited messages. The fine was imposed on Regus Kenya following complaints of persistent automated spamming, despite the complainant’s requests to stop. 
• In September 2023, the ODPC imposed fines against Mulla Pride Limited, Casa Vera Lounge and Roma School. Mulla Pride Limited was fined KES 2.975 million (approximately US$23,000) for obtaining names and contact information of the complainants from third parties and using such personal data to contact the complainants without the complainants’ consent. Casa Vera Lounge was fined KES 1.85 million (approximately US$14,000) for posting a customer’s image on its social media page without consent. Roma School was fined KES 4.55 million (approximately US$35,000) for sharing a minor’s image on its social media page without parental consent.

Audit and inspections: The ODPC reports that it has so far conducted 58 compliance audits, which included an inspection at Naivas Supermarkets following a data breach, and on Whitepath (mentioned above). In addition, the ODPC has responded to widespread public complaints on the handling of personal data by conducting audits on entire sectors. For example, in 2022, the ODPC audited 40 digital credit providers due to numerous complaints relating to DPA violations received by the ODPC in relation to the sector.

Alternative dispute resolution: The ODPC states it has resolved 21 cases through its alternative dispute resolution (ADR) framework, providing a faster and more efficient method for addressing data protection disputes outside formal court proceedings.

Guidance and awareness: The ODPC has also published guidance notes on critical data protection topics such as consent, data protection impact assessment, and the registration of data controllers and processors. In addition, sector-specific guidelines have been issued for sectors such as health, education and communications. To further support businesses, the ODPC has provided manuals for complaints management and ADR procedures.

Emerging trends in enforcement 

We provide below some emerging trends from determinations made by the Data Commissioner in connection with complaints filed by data subjects: 

• Consent for use of personal data for commercial purposes 

The majority of the complaints filed with the ODPC against companies have been on the use of personal data for commercial purposes without consent.

Under the Data Protection (General) Regulations 2021, personal data is used for commercial purposes where the personal data is used toadvance economic interests including inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction.

In Hellen Muthoni v. Solpia Kenya Limited T/A Sistar Kenya (ODPC Complaint No. 1963 of 2023), the ODPC was called upon to determine whether the use of the complainant’s personal data amounted to a commercial purpose. In this case, the complainant posted her photo on her social media page after using the respondent’s products, whereupon the respondent reposted the complainant’s photo and made comments directed at other social media users, encouraging them to purchase its products and directing them to its nearest distributor.

The ODPC determined that, by reposting the photo and making promotional comments, the respondent used the complainant’s personal data for commercial purposes, specifically internet marketing. The ODPC ruled that this use required the complainant’s consent. As a result, the respondent was ordered to compensate the complainant KES 500,000 (approximately US$3,900).

Further, a number of credit providers have been held liable for sending promotional messages to potential customers without first securing their consent and without providing for opt-out mechanisms before using personal data for direct marketing purposes. 

For instance, in Tom Ruto and another v. Premier Credit Limited (ODPC Complaint No. 830 of 2023), the complainants alleged that the respondent was sending them promotional messages about its loans without their consent and despite them requesting the respondent to stop. The ODPC held the respondent liable for this contravention and issued an enforcement notice against it.

• Employer’s vicarious liability for employee’s breach of data protection law

The ODPC’s position on vicarious liability is that an employer will be held vicariously liable for their employee’s actions that breach the DPA if the actions complained of were in the ordinary course of the employee’s employment. 

In John Onkangi v. National Bank of Kenya Limited and Keysian Auctioneers (ODPC Complaint No. 1766 of 2023), the complainant alleged that the respondents had disclosed his loan statement, bank account details and customer account information to a third party without his consent. In its defence, National Bank argued that it should not be held liable for the actions of its employee, who had knowingly violated the bank’s policies regarding the handling of customer data.

Download the Article