Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

A Complainant was filed at the Office of the Data Protection Commissioner against Wananchi Group (K) Ltd (the “Respondent” or “Zuku”) for sending promotional messages to an individual without consent, and refusing to stop despite her request. The Office of the Data Protection Commission found Zuku in violation of the complainant's rights to erasure

Facts

The case involves a complaint against Zuku, where the complainant alleged that Zuku infringed on her data privacy rights by persistently sending her marketing messages and calling her despite her request to stop.

The complainant also claimed that Zuku's requirement for her to return the equipment as a condition for deleting her personal data was a violation of her rights to erasure.

Zuku, on the other hand, stated that the equipment issued to the complainant remained their property, and they had the right to recover it as per their terms and conditions.

Zuku informed the complainant that in order to delete her data, she needed to return the equipment to their offices or provide a collection point. They also claimed to have a lawful basis for retaining her information until the equipment was recovered. However, the complainant alleged that she had requested the deletion of her details and that Zuku had not provided sufficient proof of a lawful basis for retaining her data.

The Office of the Data Protection Commission found that Zuku violated the complainant's rights to erasure as stipulated under the Act. It was also noted that Zuku did not discharge the burden of proof that they had a lawful basis for retaining the complainant's details despite her request for deletion. The Respondent also failed to comply with the principle of data privacy by design or default.

• The Act stipulates that a controller could only retain personal information for the purposes for which it was processed / collected and had to delete anonymity or pseudomise it once the purpose was fulfilled.
• The Complainant having failed to fulfil the contractual terms of service, their services were automatically terminated under Zuku’s terms and conditions of service. The return of the equipment was not the indicator of termination and Zuku therefore failed to demonstrate a lawful basis for continuing to hold the personal information beyond the effective date of termination.

Holding

The ODPC held that:

• The Respondent was liable for infringement of the complainants rights and obligations under the Act.
• The Respondent to pay compensation in the sum of of Kes.250,000/=.