Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC has made a recommendation for the prosecution of the Director(s) of Mulla Pride Ltd for obstruction of justice contrary to Section 61 of the DPA19 when the firm closed its offices on the day officers of the ODPC were to attend the same to carry out investigations. The firm was also ordered to pay KES.250,000 to the Complainant as compensation for unlawful use of his personal information.

Facts

Mulla Pride Ltd (the “Respondent”) allegedly harassed Sigei Caleb (the “Complainant”) in respect of a loan that the Complainant claimed that he was not aware of. The Complainant therefore alleged that his personal data was mishandled by the respondent, leading to a breach of his privacy. This included unauthorized access, use, and disclosure of sensitive information without consent.

The Respondent denied any wrongdoing, asserting that all data processing activities were conducted in compliance with applicable data protection laws and with the complainant's consent. The Respondent averred that it's staff who contacted the Complainant, acted without authority and that they had since apologised to the Respondent over the infraction.

Full investigation could not however be undertaken because the Respondent closed the offices on the day that officers from the ODPC were to visit.

On interrogation, the premise guards disclosed to the ODPC officers that the offices were initially opened and staff reported to work but then closed abruptly at 8am that morning with staff being ordered to go back home by management.

This event, the ODPC found, was a well choreographed attempt to obstruct justice contrary to Section 61 of the DPA19.

Investigations revealed discrepancies between the Respondent's stated data protection practices and the actual handling of the complainant's personal data. These included inadequate security measures and failure to obtain explicit consent for certain data processing activities.

The ODPC expressed concerns over the Respondent's repeated and ongoing attempts to obstruct justice, the same behaviours having been observed in another case [135 of 2024, Austin Opalla vs. Mulla Pride Ltd (unreported) ].

The ODPC also noted continued poor data governance practices, highlighting systemic issues that could potentially affect a broader range of data subjects.

Holding

The ODPC held that:

• The Respondent is found liable for violating the Complainants rights to be informed of the use of his personal data.