Allen Waiyaki Gichuhi & 2 other vs. Florence Mathenge & Ambrose Waigwa

Cases Detail

Cases

Allen Waiyaki Gichuhi & 2 other vs. Florence Mathenge & Ambrose Waigwa

Country: Kenya
Court: ODPC
Status: Determination
Tags: privacy breaches,debt collection,personal data,consent,data protection

Case Summary

The Complainants, Allen Waiyaki Gichuhi and Charles Wamae, lodged a complaint against Florence Mathenge (1st Respondent) and Ambrose Waigwa (2nd Respondent) alleging that their personal data had been unlawfully processed. The core of the complaint stemmed from the Respondents' alleged sharing of the Complainants' details, including phone numbers and association with a company called "Lisoni," with third parties without consent. This unauthorized disclosure was reportedly in connection with an alleged debt owed by a separate entity, "Lisoni Holdings Limited," where the Complainants claimed they were not personally liable. The Complainants asserted that this constituted a breach of their right to privacy under the Data Protection Act, 2019, leading to harassment and reputational damage. The Respondents, particularly the 2nd Respondent, denied any direct processing of the Complainants' data, stating their actions were limited to forwarding information received from their client, I&M Bank, to the Complainants' advocates. They maintained that the data was shared in the context of debt recovery efforts for Lisoni Holdings Limited and that the Complainants, as directors, were linked to the company's affairs.

Issues for Determination

The Office of the Data Protection Commissioner identified the following key issues for determination:

  1. Whether the 1st and 2nd Respondents were Data Controllers or Data Processors in the context of the alleged unlawful processing of the Complainants' personal data.
  2. Whether the processing of the Complainants' personal data by the Respondents was lawful.
  3. Whether the Complainants are entitled to the remedies sought.

Determination

The Office of the Data Protection Commissioner (ODPC) made the following determinations:

The 1st and 2nd Respondents were acting as Data Processors for their client, I&M Bank Limited, in relation to the personal data obtained from I&M Bank Limited.

The processing of the Complainants' personal data by the 1st and 2nd Respondents was lawful, as it was carried out for a legitimate interest, specifically the recovery of a debt owed by Lisoni Holdings Limited, a company of which the Complainants were directors. The processing was found to be necessary for the performance of a contract to which the data subject is a party (impliedly, the debt owed by Lisoni Holdings Limited and the Complainants' connection to it) and for the legitimate interests pursued by the data controller or by a third party to whom the data is disclosed.

The ODPC found that the Complainants are not entitled to the remedies sought, namely an apology, compensation for damages, and orders restraining the Respondents from further processing their data, as the processing was deemed lawful.

Analysis

The ODPC's analysis hinged on the definition of a "Data Controller" and "Data Processor" under the Data Protection Act, 2019. It was determined that the Respondents, acting on instructions from I&M Bank (the Data Controller), were indeed Data Processors.

Crucially, the determination delved into the conditions for lawful processing of personal data as stipulated in Section 30 of the Data Protection Act. The ODPC highlighted Section 30(1)(b) which allows processing if it is "necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract," and Section 30(1)(f) which permits processing for "the legitimate interests pursued by the data controller or by a third party to whom the data is disclosed, except where the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms of the data subject."

The ODPC found that the Complainants, as directors of Lisoni Holdings Limited, had a direct connection to the debt owed by the company. Therefore, the sharing of their contact details within the context of debt recovery efforts was considered a necessary and legitimate interest for the purposes of the Data Protection Act. The Commissioner emphasized that individuals cannot hide behind the corporate veil to avoid legitimate communication related to a company's financial obligations if they are personally linked as directors and recipients of official communications. The determination underscored that while privacy rights are fundamental, they are not absolute and must be balanced against legitimate interests, particularly in the context of contractual obligations and debt recovery processes where reasonable attempts to contact relevant parties are made. The ODPC concluded that the Respondents' actions did not amount to an unlawful processing of personal data given the circumstances.

Frequently Asked Questions

Frequently Asked Questions

A data subject is a natural person who is the subject of personal data held by a controller and who can be identified, directly or indirectly, through that personal data.

Each data subject has the right:

  • to be informed whether or not his or her personal data is being processed,
  • to request information about the processing, if data has been processed,
  • to be informed of the purpose of the processing and whether the data is being used in accordance with those purposes,
  • to be informed about third parties who receive personal data in Kenya and abroad,
  • to request the rectification of incomplete or inaccurate processed data, and
  • to request the erasure or destruction of personal data.

Data processing refers to any operation performed on personal data, either entirely or partially, automatically or manually. This includes collection, recording, storage, preservation, modification, revision, disclosure, transmission, assignment, making available, classification, or prevention of use.

Data controller: is a natural or legal person who determines the purposes and means of personal data processing and is accountable for the data filing system's establishment and administration.

Data processor: is a natural or legal person that processes personal data on the basis of a data controller's authorization.

The data controller or processor is required to provide the following information: the purpose of the processing, the recipients of the processed data and the purpose of the transfer, the method used to collect personal data and its legal basis, and any other rights granted to the data subject by law.

The principles governing data processing are as follows: it must be processed fairly and lawfully, it must be accurate and up to date, it must be processed for specified, explicit, and legitimate purposes, it must be adequate, relevant, and not excessive in relation to the purposes for which it is processed, and it must be retained for the duration specified by law or for no longer than is necessary for the subsequent processing.

A Data Protection Impact Assessment can be used to identify and mitigate high risks associated with data processing that may impact the rights and freedoms of data subjects.

A data controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data. On the other hand, a data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.