A complainant is set to receive hefty compensation after receiving unsolicited marketing messages from a renowned events company in Nairobi.
The company was ordered to pay the man Ksh700,000 in compensation by the Office of the Data Protection Commissioner (ODPC) to one Dennis Gathara for sending a spate of unwarranted messages promoting their business.
Further, the ODPC ordered the company to erase all traces of the complainant's data within 14 days.
The case was first filed in June 2024 with the complainant claiming to have received numerous messages from the company without consent.
According to the complainant, the company failed to provide an opt-out mechanism for the promo messages, which is a breach of the law.
Despite the complainant's requests to the company to stop sending the messages and delete his data, the promo messages kept coming, prompting him to move to The Office of the Data Protection Commissioner.
The company was found to violate several provisions of the Data Protection Act of 2019. According to the act, "a data controller or data processor shall bear the burden of proof for establishing a data subject's consent to the processing of their personal data for a specified purpose.
The act further states that a data subject has the right to withdraw consent at any time - something which the complainant in this case did but the marketing messages kept coming.
Another violation by the company was a violation of the complainant's rights to object to processing and data erasure.
The company in question claimed to have implemented remedial measures, including an SMS opt-out feature and updates to terms and conditions but was unable to provide evidence of the implementations.
In the wake of the landmark ruling, organisations and companies have now been put on high alert regarding the misuse of clients' personal data.
To maintain consumer trust, corporates are being encouraged to adopt opt-out mechanisms to ensure compliance which also puts them in line with data protection laws.
Opt-out instructions also need to be extremely clear and subject to minimal effort from consumers, such as embedding unsubscribe links in promotional emails.
