The data protection office has issued penalty notices to three entities for failing to observe data privacy rights, breaching the data protection act.
Digital Credit provider Mulla Pride, Cesa Vera Lounge (restaurant along Nairobi’s Ngong Road), and Roma School (an educational institution) were fined cumulative Sh9,375,000 for failing to observe data privacy to data subjects.
Roma School received the highest penalty of Sh4,550,000 for posting minor’s pictures without parental consent. “This being the first and the highest penalty to an educational facility sends a message to schools and other facilities handling minors personal data to obtain consent from parents prior to processing minors data,” said office of data protection through a statement.
Mulla Pride, which operates Ke Credit and Faircash mobile lending Apps was the First Data Controller that received a penalty of Sh2,975,000. The firm was found culpable of using names and contact information of the complainants which were obtained from third parties, and subsequently used to send threatening messages and phone calls.
“This penalty will ensure that digital lenders and financial institutions notify data subjects when collecting and processing their data, and the intention of processing the said data. It will further ensure that data controllers are limited to strictly dealing with data subjects who have consented to the collection and processing of their data,” said the commission.
Casa Vera Lounge was fined Sh 1,850,000 for posting a reveler’s image on their social media platform without the data subject’s consent. The Data Commission said, the penalty seeks to ensure that other lounges, clubs among others seek consent from their customers prior to posting their images online.
Q&A; The State of Data Protection Laws in Kenya – Kenyan Wallstreet
