| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25 & 26 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | No Violation |
| Started: | 22 November 2023 |
| Decided: | 24 January 2024 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | Mark Ross vs. GGaeme Thompson |
| Case No.: | 2431 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Graeme Thompson, (referred to as 'the Respondent’), was deemed not responsible for violating Mark Ross's rights, (referred to as 'the Complainant’) under the Data Protection Act of 2019. This decision was made by the Office of the Data Protection Commissioner due to the manner in which Thompson installed CCTV cameras on his property.
The Complainant alleged that the Respondent installed CCTV cameras at the entrance to his house, which monitored movements on the road and into the Complainant's residence, thereby violating the Complainant's right to privacy, movement, and residency.
The Respondent denied the allegations and clarified that the CCTV cameras at his entrance gate only collected data of persons and movement into and out of the Respondent's residence and movements directly along and across the frontage of the road outside his gate, stating that they could not collect any data relating to movements into or out of the Complainant’s residence.
The Office conducted an impromptu site visit at the Respondent's premises and was granted access to review the CCTV cameras in real time as well as the stored data.
The investigators observed the two subject CCTV camera installations at the Respondent's entrance gate and took photographs of the cameras as well as screenshots of the real-time views captured on the CCTV cameras.
The issues for determination were whether the CCTV cameras were processing personal data.
The holding of the ODPC was that the use of CCTV by the Respondent to capture video and sound recording within his premises was a purely personal or household activity, and therefore exempt from the provisions of the Data Protection Act. The CCTV cameras did not point towards the Complainant's residence or monitor movements into and out of the Complainant's residence. As a result, the processing of personal data by the CCTV cameras was exempt from the provisions of the Act.
The Regulator relied on an interpretation of personal use by the CJEU.
The full text of the ruling is available below.