The Data Commissioner has ordered Wananchi Group (Zuku) to pay Sh500,000 in compensation to a complainant whose personal data they failed to erase despite repeated requests.

"The Office of the Data Protection Commissioner (ODPC) has today issued a Determination against Wananchi Group Limited trading as "Zuku" and Geosky Service Limited. The Respondents were found liable for failing to comply with the Data Protection Act when processing personal data of Data Subjects," the ODPC said.

The Commissioner’s determination also calls for the deletion of the complainant's data from Zuku's systems and recommends the prosecution of the company's directors for obstructing the Data Commissioner's investigation.

"The Office found Wananchi Group Limited liable for failing to give effect to the data subject's right to erasure as per section 40 and the right to object to the processing of personal data as defined in Section 36 of the Act," ODPC stated.

Read More

  1. Senator Orwoba's call for stricter X regulation sparks outrage in Kenya
  2. Former Moja Expressway employee awarded Sh500,000 in data privacy case
  3. Decline in debt-shaming, harassment as digital lenders embrace new regulations

"Further, the Office found that the company failed to implement a mechanism for data subjects to exercise their rights as the method stated in their privacy notice was not operational."

The complainant, who ceased being a Zuku customer years ago, alleged that the company continued to send promotional messages despite numerous verbal, phone, and email requests to delete his personal information.

He further claimed that an attempt to escalate the issue via email on 16th November 2024, failed because the email address listed on Zuku's website was invalid.

The complainant argued that this ongoing retention and misuse of his data violated his rights under the Data Protection Act, of 2019, specifically the right to erasure and the right to object to processing for marketing purposes.

He stated that the unwanted communications caused “inconvenience and distress” and that the lack of response eroded trust in the company’s data handling practices.

Even after lodging the complaint, the complainant received a service auto-suspension notification from Zuku on December 15, 2024.

Zuku, in its response, claimed to have conducted a “comprehensive review” of its records and systems and found no record of data deletion requests from the complainant.

They asserted that they maintain “robust systems” to ensure compliance with the Data Protection Act and prioritise data subject rights.

They offered to reassess the matter but, “in the absence of a record or a formal deletion request,” concluded that the allegation was “not substantiated.”

However, the Data Commissioner’s investigation, including a site visit, revealed that the email address provided on Zuku’s website was indeed “invalid and non-operational,” confirming the complainant’s claim.

This, the Commissioner determined, denied the complainant the opportunity to exercise his right to object to the processing of his data and his right to deletion, as provided under Sections 26(c), 26(e), and 40(1)(b) of the Data Protection Act, 2019.

The Commissioner stated that Zuku’s response to the complaint consisted of “mere denials” without any supporting evidence.

Furthermore, the Commissioner found that Zuku “obstructed the Data Commissioner” by refusing to abide by a search warrant and failing to cooperate with the investigation, an offence under Section 61 of the Act.

This section states that a person who “obstructs or impedes the Data Commissioner in the exercise of their powers,” “fails to provide assistance or information requested,” “refuses to allow the Data Commissioner to enter any premises,” or “gives…any information which is false or misleading” commits an offence and is liable to a fine not exceeding five million shillings or imprisonment for a term not exceeding two years, or both.

Consequently, the Data Commissioner ordered Zuku to delete the complainant's personal data, cease all communication with him, and provide proof of this to the Office within seven days.

In addition to the Sh500,000 compensation, the Commissioner recommended the prosecution of Zuku’s directors for obstructing the investigation.

Zuku has the right to appeal this determination to the High Court of Kenya within thirty days.