Today, the Office of the Data Protection Commissioner has formally issued determinations against Wananchi Group Limited trading as “Zuku,” and against Geosky Service Limited, for breach of the Data Protection Act both companies have been liable under the failure to observe the rights of data subjects when processing personal data.
Wananchi Group Limited was found in violation of Section 40, failing to respect the right of data subjects to erase their data, as well as Section 36, by not providing a mechanism for individuals to object to the processing of their personal data. The company’s privacy notice included an invalid method for individuals to exercise these rights.
Geosky Service Limited was also found guilty of illegally using the complainant’s personal data without lawful consent and also denying him the right to be informed before any processing as required under section 26(a) of the Act.
On top of that, ODPC said, they should adhere to orders or notices in connection with investigation activities. The requests were therefore ignored by the two, along with Wananchi Group Limited refusing to obey a court-ordered search warrant in violation of Sections 60 and 61 of the Act. Because of that, the Data Commissioner recommended for the prosecution of the directors of both companies for non-compliance.
The Office of the Data Protection Commissioner emphasized that such data controllers and processors must have in place technical and organizational measures to ensure lawful, secure, and minimal processing of personal data. They should also honor investigations as required of them by law.
Such will be prevention from the use of any unlawful means, whereby, the intrusive process can infringe on the privacy of the other person and will result in a punishing act under law. Kassait, MBS the Data Commissioner, therefore, insisted on compliance with the provisions of the Data Protection Act, especially in relation to processing personal data and sensitive personal data. The data controllers and processors were invited to ensure adherence to the provisions of the Act in processing personal data. Enforcement action will follow if the provisions are not respected.
More so, compensation orders have also been made against the two companies with instructions to allow the complainants to exercise their rights to erasure and to object to the processing of their personal data.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke
