Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Applicant, a proprietor of a law firm complained that her personal details contained in her mobile money statement was illegally processed by being released by an employee of the Respondent, a telco, to a third party without her knowledge and consent. The Respondent was absolved from liability and the employee recommended for prosecution in her personal capacity.

Facts

The Complainant alleges that in the course of certain court proceedings, she discovered that she (and her law firm) had been placed under investigation in the course of which her personal data, contained in MPESA statements, were released to third parties by the Respondent. She was not made aware of the investigations and neither did she consent to the statements being released to the third party.

The Respondent objected to the filing alleging that the matter was res judicata having been referred to arbitration previously and further that the ODPC had solicited the Complainant to make the complaint.

As regards the substantive complaint, the Respondent stated that they have instituted robust measures (which they outlined) to comply with the DPA,19 and the breach was out of its control having been orchestrated by an employee playing truant. They also indicated that they had instituted disciplinary actions against the employee and filed a criminal case against her for the actions. The Respondent averred that it should not be held responsible for the actions of the employee, who acted ultravires (outside the scope of) her duties. The ODPC ruled on the objection in the decision.

Holding

The ODPC held as follows:

• The ODPC had jurisdiction to hear the matter. The parties who had earlier submitted themselves to arbitration did not file the outcome thereof with the Office.
• The ODPC has powers to advice citizens of their rights under the DPA,19 who would then exercise the right to follow or ignore that advice. The ODPC's action in advising the Complainant to file a complaint cannot in the circumstances, be construed as solicitation.
• The Respondent is not responsible for the actions of its employees conducted outside the scope of her duties. The Respondent is therefore not vicariously liable for those actions.
• The ODPC recommended that criminal prosecution be instituted against the employee.

Comment

The issue of vicarious liability is reviewed and a separation drawn between the actions of the employee and employer. There is something to be said about the fact that the Respondent did not disclose a breach to the ODPC but to the police. Compare this decision to the Lucy Kinyanjui vs. Easy Coach Ltd - Complaint No. 0537 of 2023, as regards employee training. A full text of the ruling is available below.