Cases
Sammy Muchane vs. Airtel Networks Kenya Ltd
Case Summary
This determination addresses a complaint filed by Sammy Muchane against Airtel Networks Kenya Limited, alleging a breach of privacy under the Data Protection Act, 2019. Muchane claimed that Airtel shared his phone number with debt collectors despite him having no outstanding debt. The complaint, lodged on September 7, 2023, followed ongoing issues with service suspension and erroneous debt collection.
The key facts include Muchane's request to suspend services in February 2021, the settlement of all invoices by January 2023, and continued erroneous debt collection efforts by Airtel. Despite Muchane's attempts to resolve the issue directly with Airtel, the problem persisted, leading to the filing of the complaint with the Office of the Data Protection Commissioner (ODPC).
Upon investigation, the ODPC found that Airtel had failed to properly close Muchane’s account, resulting in a breach of privacy. The determination evaluates whether this breach occurred and if Airtel adequately addressed the complaint.
Issues of Determination
- Whether there was an infringement on the Complainant’s right to privacy under the Act
- Whether the complaint was sufficiently addressed by the Respondent
Determination
The ODPC finds that Airtel Networks Kenya Limited infringed on Muchane’s right to privacy as outlined in Sections 25 and 26 of the Data Protection Act, 2019. The failure to correctly close Muchane’s account and the subsequent sharing of his data with debt collectors violated the principles of data protection, particularly the requirements for accuracy and timely correction of personal data.
The ODPC determines that Airtel sufficiently addressed the complaint once notified. Airtel took corrective measures by suspending debt collection activities, reconciling and closing the account, and updating its systems. The Respondent’s actions, including recalling instructions to debt collectors and improving its data protection policies, resolved the issues to Muchane’s satisfaction.
Analysis
On whether There Was an Infringement on the Complainant’s Right to Privacy Under the Act
The Data Protection Act, 2019, enforces strict guidelines for the processing of personal data to ensure privacy (Section 25). Specifically, it mandates data controllers to maintain accurate and up-to-date data and to rectify inaccuracies without undue delay (Sections 26 and 40). In this case, Airtel Networks Kenya Limited’s failure to properly suspend and close Muchane’s account constituted a breach of these principles.
The Respondent's initial failure to act on Muchane's request and the continuation of erroneous debt collection activities demonstrated a violation of Muchane's right to privacy. Despite the Complainant’s clear instructions and payment records, Airtel’s actions led to a breach of personal data protection principles.
On whether the Complaint Was Sufficiently Addressed by the Respondent
After receiving the complaint, Airtel took several corrective steps. These included suspending debt collection, reconciling and closing the account, and updating its systems to reflect these changes. Airtel also recalled instructions to debt collectors and communicated the resolution to Muchane.
The ODPC's investigation confirmed that Airtel’s response addressed the complaint effectively. The steps taken by Airtel such as improving its data protection procedures and handling the issue promptly satisfied the requirements under the Data Protection Act. Thus, while there was an initial breach, Airtel's subsequent actions were deemed adequate in resolving the complaint.