Background
In Michael Rashid Mwakio v Kings Commodities Limited, the Complainant lodged a complaint with the Office of the Data Protection Commissioner (ODPC), alleging that the Respondent unlawfully continued to use his mobile phone number on its website as the company’s contact detail despite his objection and request for erasure.
The Complainant stated that in 2021, he purchased a Telkom wireless line for personal use and was allocated a telephone number. Approximately two weeks after activation, he began receiving numerous calls from individuals seeking to contact Kings Commodities Limited. He consistently informed the callers that the number was his personal line and was not associated with the Respondent or any other company.
Upon conducting a search on the Respondent’s website, the Complainant confirmed that his number had been published as the company’s contact detail. He further averred that several callers informed him that they had obtained the number from the Respondent’s website.
The Complainant assumed that the number had previously belonged to the Respondent before being reassigned to him by Telkom and, on that basis, allowed the Respondent sufficient time to rectify the issue. In mid- 2022, he contacted the Respondent and explained the matter. He was informed that the manager was abroad, which had allegedly contributed to the oversight, and was assured that the number would be removed from the website.
Despite these assurances, the Complainant averred that he continued to receive calls from the Respondent’s customers and business prospects for an additional year up to mid-2023. He thereafter formally wrote to the Respondent via email requesting the removal of his number from the website. According to the Complainant, the Respondent did not respond to the request and the number remained published.
The Respondent’s Response
The Respondent did not submit a response to the Notification of Complaint issued by the ODPC. Therefore, the allegations made by the Complainant remained undisputed.
Determination
The Data Commissioner held as follows:
- Section 26 of the Data Protection Act, 2019 grants a data subject specific rights in relation to the processing of their personal data, including the 1 www.mutie-advocates.com right to object to the processing of all or part of their personal data. The Complainant exercised this right by raising the matter informally in mid- 2022 and subsequently making a formal objection by email on 20th July 2023.
- Despite being placed on notice through both informal communication and a formal written request, the Respondent failed to act on the Complainant’s objection. The number remained listed on the Respondent’s website, and the Complainant continued to receive calls intended for the Respondent.
- The Respondent’s failure to respond to the Complainant’s formal request, or to demonstrate that steps were taken to remove the number or cease further processing, amounted to continued processing of the Complainant’s personal data in disregard of an express objection, contrary to the protections afforded under Section 26(c) of the Data Protection Act, 2019.
- Consequently, the Data Commissioner issued an Enforcement Notice against the Respondent and subsequently directed the Respondent to pay the Complainant a sum of Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000) as compensation for violation of the Complainant’s right to object to the processing of his personal data.
