| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 40 (1)(a), of the DPA,19 |
| Type: | Complaint |
| Outcome: | No violation |
| Started: | 20 July 2022 |
| Decided: | 6 January 2023 |
| Published: | |
| Fine: | N/A |
| Parties: | Allen Waiyaki Gichuki & Anor vs. Florence Mathenge & Anor |
| Case No.: | 667 of 2022 |
| Appeal: | High Court Judicial Review Application No. E028 of 2023 Allen Waiyaki Gichuki & 2 Anor vs. ODPC |
| Original Source: | ODPC |
| Original contributor: | Margaret Odhiambo |
A law firm's (the “Complainant”) complaint against a former staff who mishandled client information was dismissed after it was established that they did not have locus to bring the claim - they had not shown how their own personal or sensitive data had been infringed in their capacity as data subjects. Alao, the documents the subject of the complaint, were public documents.
The law firm (the ‘Complainants') was acting on both the firm’s and its clients’ behalf. The Complainant alleged that one of its former employees (while still in employment), sent proprietory, personal data and confidential information to her personal email and also to another former employee (collectively, “the Respondents”).
The documents allegedly shared included court documents, legal opinions, bank statements, and correspondences. The Complainants alleged that the DPA,19 prohibits data controllers and data processors from unlawfully disclosing personal data to third parties and that the Respondents had breached this provision.
The Respondents contested that the firm was not registered as a data controller or a data processor at the time of filing the complaint and therefore the obligations of these roles did not apply in the present case. They also contended that the court documents cited by the Complainants were public documents. The Respondents also argued that the firm’s clients were not data subjects under the Act since they were not natural persons.
The ODPC held as under:
The complaint was dismissed on the basis that most of the documents cited by the Complainants were either not availed to the ODPC for inspection to determine the nature of the information disclosed or on the basis that most of the documents cited were already in the public domain. It was therefore impossible to determine whether there had been a breach as alleged by the Complainants.
The ruling emphasizes the need to correctly frame and support a claim. It also confirms that the DPA,19 only applies to natural persons who can be identified. A full text of the ruling is provided below.