Marketers have borne the biggest brunt of sanctions as the Office of the Data Protection Commissioner (ODPC) enforced rules on individual privacy.
An analysis by Business Daily of all data breach complaints handled by the ODPC in the first half of this year shows that the offensive use of private data, including images and videos, for marketing and commercial purposes without consent attracted the highest conviction rate, which in turn led to the largest proportion of penalties levied.
According to filings on ODPC’s official website, the watchdog handled a total of 26 complaints during the period, 17 of which resulted in convictions, with the offenders ordered to compensate complainants a collective sum of Sh12 million.
Nine of the 17 convictions involved the unauthorised use of private media files to advertise brands, with these commercial marketers being forced to cough up Sh8.4 million in compensation to victims, representing 69.6 percent of the total levied penalties for the period.
A fashion company, Accessorise with Style, incurred the highest penalty of Sh1.5 million after the ODPC found it guilty of violating the privacy of three complainants in a ruling issued on April 22.
The three, Wendy Mwatha, Winnie Wanja, and Annah Mburu, submitted that the enterprise continued with the illegal use of their images for its in-store branding in its multiple outlets long after their contracts had expired.
In its verdict, the ODPC found that the firm was in breach of the Data Protection Act, which prohibits the commercial use of personal data without the express consent of the data subject, before awarding each of the aggrieved parties a sum of Sh500,000.
Others that took a substantial hit for data breaches included Miguel Ventures Limited which was slapped with a Sh1.2 million penalty, Video One Limited (Sh1.1 million), Grain Industries Limited (Sh1 million) and Nova Pioneer Kenya Limited (Sh950,000).
Kenya’s Data Protection Act came into force on November 25, 2019, paving the way for the implementation of laws that govern the collection, processing and storage of personal data by both the government and the private sector.
Parliament later enacted regulations to enforce the Act in March 2022, namely the Data Protection (General) Regulations, 2021, the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
The regulations require all data controllers and data processors to register with the ODPC, a violation of which attracts a fine of not more than Sh5 million or up to one percent of the offender’s annual turnover.
