Contents

1. Summary
   1. Facts
   2. Holding
2. Holding
3. Comment
4. Further resources
5. Decision

Summary

The Kenya ODPC ordered a microfinance bank to release an Adverse Report gleaned from a reference check, containing the personal data of the Complainant. The Respondent was found to have violated the complainant’s right of access to his personal data.

Facts

On 17 April 2023, the ODPC received a complaint from Harrison Kisaka (the ‘Complainant’) concerning an alleged negative use of his personal data held by the Respondent.

The Complainant had submitted himself to a reference checking process by the Respondent which resulted in an Adverse Report (the ‘Report’). The Respondent wished to access this Report.

The Complainant made an access request in respect of the Report, which request was denied by the Respondent.

Holding

The ODPC held that:

• the background report which directly referenced the Complaint through the use of words such as “you,” constitutes personal data.
• The Respondent lawfully processed the Applicants data in line with Section 28 (2) (c) of the DPA,19 since an appropriate consent to conduct the reference check, was provided by the Complainant.
• The Complainant has a right to access his person data held by the Respondent under Section 26 (b) of the DPA,19. Further, Regulation 9 (3) of the Data Protection (General) Regulations, 2021 provides that a data processor shall provide access to the data subject's person data in its possession on request. The Respondent therefore had an obligation to provide access to the personal data requested for by the Complainant.
• In denying the Complainant access to his personal data as requested, the Respondent violated the Complainant’s rights.