Authority: ODPC - Kenya
Jurisdiction: Kenya
Relevant law: Section 2, 5(4), 26, 41(1) of the Data Protection Act, 2019; Regulation 9 (1), 9(1)(a) of the Data Protection (General) Regulations, 2021, Article 31 of the Constitution of Kenya
Type: Complaint
Outcome: Violation
Started: 10 June 2023
Decided: 15 December 2023
Published: Yes
Fine: KES.250,000
Parties: Jeremy Obano vs. Kenya Airways Ltd
Case No.: 1775 of 2023
Appeal: N/A
Original Source: ODPC
Original contributor: MZIZI Africa

Contents

  1. Summary
    1. Facts
    2. Holding
  2. Comment
  3. Further resources
  4. The Decision

Summary

The Data Protection Commissioner found that Kenya Airways Ltd infringed upon the complainant's right to access his personal data by refusing to provide access to a voice recording of a call he made to them. As a result, the airline was ordered to compensate the complainant with Kes.250,000/-.

Facts

The case involves a complaint against an airline carrier, Kenya Airways (KQ), regarding the recording of a telephone call made by the complainant to the airline.

The complainant alleged that despite requesting access to the telephone voice recording of the call, the airline refused to provide it. The complainant claimed that the refusal caused harm and distress to his mother in a busy and taxing environment.

The airline's response included the assertion that the complaint did not fall within the scope of the Data Protection Act and that internal resolution mechanisms were ongoing.

The ODPC determined that the complainant's right to access his personal data was indeed infringed upon.

It was established that the voice recording of the call constituted the complainant's personal data, and therefore, his right to access it was violated.

As a remedy, the airline was directed to compensate the complainant and facilitate his data access request within a specified timeframe.

The ODPC also outlined the complainant's right to appeal the determination to the High Court of Kenya within a specified period.

Holding

The final determination by the Office of the Data Protection Commissioner (ODPC) is as follows: