Alcohol manufacturer Kenya Breweries Limited (KBL) is embroiled in a legal dispute with a Nairobi-based lawyer who alleges that the company violated his privacy by sending him unsolicited promotional text messages after he bought its products from an e-commerce platform.
The dispute escalated to the High Court after KBL filed an appeal challenging the decision of the Office of the Data Protection Commissioner (ODPC) to award the lawyer, Joseph Gathiru Muriithi, a sum of Sh650,000 as compensation for breach of personal data.
The High Court has since halted the payout pending determination of the KBL’s appeal against the ODPC decision.
Justice Anthony Mrima ordered KBL to deposit the money as security to forestall a scenario where Mr Muriithi is taken back to the drawing board to execute the fruits of the judgment in case the appeal fails.
“The court engages in a balancing act; not to deny an appellant the right to get its money back in the event of success and equally important, not to deprive a respondent the opportunity to conveniently realise its decree where the appeal fails,” said Justice Mrima.
Mr Muriithi, through Tana J Peter Advocates, had opposed KBL’s request to halt the payout, stating that the application was legally untenable, incurably defective and an abuse of the court process.
In the contested determination of the ODPC, the brewer was found liable for using Mr Muriithi’s personal data for commercial purposes without obtaining valid consent. It was also found liable for denying him the opportunity to object to the processing of his personal data.
“The office considers the fact that the respondent (KBL) either intentionally or negligently denied the complainant an opportunity to exercise his right to object to the processing of his personal data,” said Data Protection Commissioner Immaculate Kassait in the determination dated February 3, 2025.
Mr Muriithi filed the complaint in November 2024, alleging that he was receiving promotional messages from KBL despite the fact that he did not consent to the use of his personal data for marketing purposes.
He provided screenshots of the text messages as proof.
Additionally, he stated that the marketing messages did not have a simple opt-out mechanism for him to request not to receive direct marketing messages, thereby denying him the chance to exercise his right to object and right of erasure as provided for under the Data Protection Act.
He stated that the messages had caused him emotional distress because he could not opt out of receiving them. He also said that his reputation was at risk.
He narrated that in October 2023, he accessed the KBL’s e-commerce platform, ke.thebar.com, with the sole intention of purchasing a six-pack of Tusker Lager to receive tickets for the Oktoba Fest concert. At no point during this transaction did he opt in to receive future promotional materials or marketing messages from the company, he contended.
He said he provided his phone number and email address solely to facilitate the delivery of the beer to the designated location.
Mr Muriithi provided screenshots of the relevant sections of the website, including the purchase process and delivery information entry form as proof of the steps taken and the limited scope of the transaction.
He argued that since the completion of the purchase he had continuously received unsolicited promotional messages from KBL.
In response, KBL claimed that a short code opt-out mechanism was available. However, Mr Muriithi said that he was not made aware of this option in any of the promotional messages he received.
The brewer also said that Mr Muriithi had provided explicit consent for receiving promotional text messages via the ke.thebar platform.
The beer maker said the data had been collected with clear communication about its intended use and the same data had been used within its intended purpose, adhering to principles of purpose limitation and data minimisation.
Further, it stated that the complainant had yet to opt out of its e-commerce platform. Nevertheless, KBL manually opted the complainant out of receiving further promotional messages.
KBL confirmed that Mr Muriithi still had an account on ke.thebar, which he had created, and that he could adjust the account settings at any time, including opting in or out.
To support its case, KBL provided documents such as its Data Processing Impact Assessment (DPIA) for the e-commerce platform, the complainant’s system logs of the ke.thebar system and the data retention policy.
The dispute will now be determined by the High Court.
