Nairobi, Kenya, April 11, 2023. The Office of the Data Protection Commissioner (ODPC) has issued two penalty notices against Whitepath company limited and Regus Kenya.
White Path failed to comply with an ODPC’s enforcement notice dated 10th January,2023, while Regus Kenya was non-cooperative and failed to respond to a Notification of Complaint dated 27th October,2022, a reminder to the Notification of Complaint dated 11th November 2022 and an Enforcement Notice dated 16th February 2023.
The ODPC received close to 150 complaints against Whitepath alleging that their applications have accessed their mobile phone contacts and are sending unwarranted and unsolicited text messages to the said contacts. Additionally, the Whitepath staff have been harassing the complainants and their contacts irregularly obtained from the complainant’s phone books. On the other hand, the complaint against Regus alleged frequent spamming of automated improper information to the complainant despite attempts to make the respondent stop.
Each company is required to pay the ODPC a penalty of Kenya Shillings Five Million (KES 5,000,000) pursuant to Section 63 of the Data Protection Act, and Regulation 20 of the Data Protection (Complaints Handling Procedure and Enforcement).
The Office has also issued an enforcement notice to Ecological Industries Limited due to non-cooperation with several notifications of a complaint launched on the 25th January , 2023 and a reminder on the 15th February, 2023 against them for publishing of a personal photo on a company catalog and calendar for marketing purposes. Failure to comply with the enforcement notice within the stipulated time, Ecological Industries Limited will be faced with a penalty notice.
Speaking on the notices, the Data Commissioner Immaculate Kassait, MBS said, fi Data protection is the responsibility of every data controller and processor and it must be the company’s top priority whenever they collect, process, or store personal information. I challenge businesses to protect personal data by design and by default and cooperate with the ODPC to avoid penalties.”
According to section 63 of the Data Protection Act, the maximum amount of the penalty that may be imposed by the Data Commissioner in a penalty notice is up to five million shillings, or in the case of an undertaking, up to one per centum of its annual turnover of the preceding financial year, whichever is lower.