Popular Nairobi Nightclub Among 3 Firms Ordered To Pay Ksh9.4M

The Office of the Data Protection Commissioner (ODPC) has imposed penalty notices worth Ksh9,375,000 to three data controllers, among them Casa Vera Lounge, a restaurant based along Ngong Road in Nairobi.

In a statement on Tuesday, September 26, ODPC found that Casa Vera posted a reveller's image on their social media platform without their permission.

The entertainment joint was among three entities fined for failing to observe Data Privacy Rights to Data Subjects and also not complying with the Data Protection Act.

"The Data Controller that has been fined today is Casa Vera Lounge, a restaurant based along Ngong Road in Nairobi.

Immaculate Kassait during her vetting by MPs for the Data Commissioner post on October 20, 2020. /BUSINESS DAILY

"The establishment was fined KES 1,850,000 for posting a reveller's image on their social media platform without the Data Subject's consent," ODPC stated in part.

The data commissioner argued that the penalty seeks to ensure that other lounges, clubs etc. seek consent from their customers prior to posting their images online.

Another data controller subjected to the hefty fines was Mulla Pride Ltd, a Digital Credit Provider (DCP) which operates KeCredit and Faircash mobile lending Apps.

The DCP received a Penalty of Ksh2,975,000 after it was found culpable of using names and contact information of the Complainants which were obtained from third parties, and subsequently used to send threatening messages and phone calls.

"This Penalty will ensure that Digital lenders and financial institutions notify data subjects when collecting and processing their data, and the intention of processing the said data.

"It will further ensure that the data controllers are limited to strictly dealing with data subjects who have consented to the collection and processing of their data," added ODPC.

Furthermore, Roma School, an Educational Institution based in Uthiru was fined Ksh4,550,000 for posting minors' pictures without parental consent. This is the first and the highest penalty imposed on an educational facility in the country.

The harsh punishment sends a message to schools and other facilities handling minors' personal data to obtain consent from parents/guardians prior to processing minors' data.

ODPC added that the penalty notices have been issued pursuant to Sections 62 and 63 of the Data Protection Act, 2019 (Act) and Regulations 20 and 21 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

While urging entities to comply with the Data Protection Act by implementing data protection principles and safeguards, Data Commissioner Immaculate Kassait called upon Data Controllers and Data Processors to ensure that the processing of personal data is in accordance with the provision of the Act.

"Failure to comply with the Act will result in instituting enforcement procedures," the statement continued.

ODPC also conducted a compliance audit on WhitePath, (a digital credit provider) and an inspection of a local supermarket chain on a recent Data Breach.

The supermarket was on Sunday, April 23 attacked through its network by notorious hackers under the online criminal organisation, Threat Actor.

In a statement, the retailer revealed that the unlawful breach of its systems by the hackers might have compromised some of its data which put millions of Kenyans who are its customers at risk of having their privacy exposed.

"The findings will be shared with the Data Controllers for their swift action.

"The Office will be embarking on conducting forty (40) Compliance Audits to various Data Controllers and Processors in various sectors this Financial Year," concluded ODPC.