Zuku is a television and internet service provider in Kenya. Yasin Abukar was a customer of Zuku. He stopped using and paying for their service. Years later, Zuku continued sending him promotional messages. He asked them to stop. They did not stop. He asked via email and telephone. They did not stop.
Abukar complained to the Office of the Data Protection Commissioner (ODPC).
As the case unfolded, the ODPC found that an official email address provided by Zuku for data protection enquiries was not working. The ODPC said that this made it difficult for Abukar to exercise his right to request the deletion of his data.
ODPC officers visited Zuku offices with a search warrant. They were blocked from accessing relevant records.
The ODPC ruled that Zuku:
– failed to honour Abukar’s request to have his data deleted,
– processed his data unlawfully,
– provided an invalid channel of communication and
– obstructed the ODPC in the exercise of its powers.
The ODPC ordered Zuku to pay Abukar KShs. 500,000 as compensation.
The ODPC also ordered Zuku to permanently delete Abukar’s data and provide proof of having done so within seven days of the ruling.
The ODPC also recommended the prosecution of Zuku’s directors for obstructing the investigation into the matter.
Sources:
Kenyan Wall Street
Is your business compliant with the Data Protection Act? If you are not sure, get in touch.