Background
In Catherine Wairimu Gabriel v Penda Health Limited the Complainant lodged a complaint with the Office of the Data Protection Commissioner (ODPC), alleging that the Respondent used her personal data for promotional purposes without her prior consent and continued to do so even after she had expressly opted out of the
Specifically, the Complainant averred that on 19th June 2024, she exercised her statutory right to object to the processing of her personal data for promotional purposes. The Respondent received and acknowledged this message. However, on 7th August, 2025, the Respondent continued to send her unsolicited marketing communications.
The Respondent’s Response
The Respondent stated that:
- The Complainant was a subscriber to the Grace Health App, which the Respondent acquired in November 2023.
- Following the acquisition, all subscriber data was lawfully transferred to the Respondent together with the consents previously granted to Grace Health. Thus, the Respondent contended that the consent previously granted to Grace Health constituted a lawful basis for indirect collection and subsequent processing under section 28 (2) (c) of the Act.
- On 17th June 2024, the Respondent contacted the Complainant via WhatsApp to inform her that she could continue accessing similar reproductive health services through its platform.
- On 30th October 2025, a single automated general check-in message was sent to the Complainant as a result of an operational error. The message triggered an automated follow-up message titled “New Chat na Penda Consent,” which sought explicit consent in line with the Act’s requirement for a clear affirmative action and also contained an opt-out option.
- The Complainant did not expressly opt out by sending the word “STOP” or otherwise clearly communicate an intention to disengage.
- In the circumstances, it was reasonable to issue a follow-up message for the purpose of obtaining explicit consent.
Determination
The Data Commissioner held as follows:
- The lawful acquisition of personal data through a corporate acquisition does not extinguish the independent and continuing obligation under section 29 of the Act to notify the data subject.
- Upon acquiring the Complainant’s personal data, the Respondent became a new data controller and was required to inform the Complainant, in clear and unambiguous terms, of:
- the fact that her personal data was being processed;
- the specific purposes of such processing;
- her rights under Section 26 of the Act, including the right to object to direct marketing;
- the identity and contact details of the Respondent as the data controller;
- any third parties to whom the data would be disclosed; and (vi) the safeguards in place to protect her personal data.
- The duty to notify is proactive and continuous and cannot be satisfied retroactively through automated messages seeking consent after unsolicited communications have already been transmitted.
- Contrary to Section 29 of the Data Protection Act, the Respondent failed to demonstrate that, upon acquiring the Complainant’s personal data, it provided the mandatory information required under the Act.
- The Respondent communications were intended to promote its services and induce the Complainant to purchase, join, or subscribe. This constituted the use of personal data for commercial purposes which required express consent, under sections 30(1)(a), 32, and 37(1) of the Act.
- Having relied on consent as the lawful basis for processing the Complainant’s personal data for marketing purposes, the Respondent bore the burden of proving that such consent had been obtained. The Respondent failed to discharge this burden, as it did not provide evidence to show that the Complainant had given express consent.
- Consequently, the Data Commissioner directed the Respondent to pay the Complainant a sum of Kenya Shillings Fifty Thousand (KES 50,000) as compensation for failure to fulfil the duty to notify.
