Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Ruth Murugi Nyaga complained Megatank Solar Energy used her personal number for KRA eTims registration without express consent, leading to client harassment. The ODPC found Megatank liable for violating rights to information and objection, ordering KES 400,000 compensation while dismissing claims against Xinda Accounting.

Facts

The Complainant, Ruth Murugi Nyaga, was employed by Megatank Solar Energy Limited from April 2024 to April 2025. She alleged that during her employment, the company used her personal phone number to register for the Kenya Revenue Authority (KRA) eTims portal without her express consent. She further claimed that despite making inquiries at the company's offices, she was not provided with information regarding why her number was used. Consequently, her personal number appeared on the company's ETR receipts, leading to harassment from potential clients and customers who contacted her to inquire about products or request tax certificates. She discovered that her number was still being used for these receipts as late as January 2025, long after she had raised concerns.

Megatank Solar Energy Limited (1st Respondent) argued that the use of the Complainant’s personal line for the KRA eTims portal was orally agreed upon and undertaken with her implied consent. To support this, the 1st Respondent claimed the Complainant actively participated in the registration process by sharing verification codes (OTPs) and receiving the system's username and password. They also noted that when she requested a change of the registered number in November 2024, they effected the change on the same day she provided a replacement line. Xinda Accounting Firm (2nd Respondent), a third party engaged by Megatank to process tax data, did not respond to the notification of the complaint.

The Office of the Data Protection Commissioner (ODPC) determined that Megatank Solar Energy Limited failed to meet the legal standards for consent. The sources explain that under the Data Protection Act, consent must be express, unequivocal, free, specific, and informed; "implied consent" via the sharing of OTPs was deemed insufficient for the commercial use of personal data. Key findings included:

• Violation of the Right to be Informed: The 1st Respondent failed to inform the Complainant of the specific use of her data at the point of collection.
• Violation of the Right to Object: The Complainant’s request to replace her number on the system constituted an exercise of her right to object, yet evidence showed her data continued to be processed on receipts through January 2025.
• Commercial Use: Retaining her number on eTims, which resulted in clients contacting her for business purposes, constituted processing for commercial and tax regulatory purposes without the requisite express consent.
• Liability of 2nd Respondent: The ODPC found that Xinda Accounting Firm processed the data under the instructions of Megatank and was not independently liable for the breach.
• Legal Provisions Reviewed

Holding

In the final determination dated 11th August 2025, the Data Commissioner ruled as follows: