Background
In Peter Macharia Waithira v LOLC Kenya Microfinance Bank Limited, the Complainant lodged a complaint with the Office of the Data Protection Commissioner (ODPC), alleging that the Respondent published his personal data in public notices on its social media platforms without his prior consent.
The Complainant was engaged by the Respondent on a contractual basis and, on 28th July 2025, formally tendered his resignation via email, which was duly received by the Respondent. Despite the resignation, the Respondent proceeded to publish highly sensitive public notices on its social media platforms indicating that the Complainant was no longer associated with the organisation. The notices further warned members of the public against engaging in any transactions with him.
The Respondent’s Response
The Respondent did not submit a response to the Notification of Complaint issued by the ODPC. Therefore, the allegations made by the Complainant remained undisputed.
Determination
The Data Commissioner held as follows:
- It was undisputed that the Respondent posted the Complainant’s images on their Facebook platform. b) Section 25 (a) of the Data Protection Act (the Act) requires data controllers or processors to ensure that personal data is processed in accordance with the right to privacy of the data subject. Further, Section 25
- requires every data controller or data processor to ensure that personal data is processed lawfully, fairly and in a transparent manner in relation to the data subject.
- Section 30 (1) of the Act states that a data controller or data processor shall not process personal data unless the data subject consents to the processing or for one or more specified purposes set out in Section 30 (1)(b) of the Act. The Complainant maintained that he had not consented to the processing of his personal data. The Data 1 www.mutie-advocates.com Commissioner held that, by failing to respond to the Notification of Complaint, the Respondent failed to demonstrate the lawful basis for processing the Complainant’s personal data.
- Section 61(b) of the Act provides that, “a person who, in relation to the exercise of a power conferred by Section 9 fails to provide assistance or information requested by the Data Commissioner; commits an offence and is liable on conviction to a fine not exceeding five million shillings or to imprisonment for a term not exceeding two years, or to both.”
- The ODPC had issued a Notification of Complaint to the Respondent requiring it to respond to the complaint in accordance with Regulation 11 of the Enforcement Regulations. The Respondent either negligently or intentionally failed to respond to the Notification of Complaint. Consequently, the Data Commissioner held that the Respondent’s failure to respond amounted to obstruction of the Data Commissioner in the exercise of her powers under the Act and, in the circumstances, recommended the prosecution of the Director(s) of the Respondent company for obstruction contrary to Section 61(b) of the Act.
- In addition, the Respondent was directed to erase the Complainant’s personal data from their online media within 14 days hereof, failure to which an Enforcement Notice to be issued against the Respondent.
