SBM BANK KENYA ORDERED TO PAY KSH. 450,000 FOR UNLAWFULLY SENDING PROMOTIONAL EMAILS
Review of the ODPC complaint No. 0372 of 2024
In a case between Kevin Kiprotich Rono [Complainant] and SBM Bank Kenya [Respondent]. The Complainant lodged a complaint alleging that despite NOT being the Respondent’s customer, the Respondent sent him almost 327 emails containing passwords, OTPs alerts, log in notifications, transactions OTPs, account to mpesa transactions alert, account statements as well as promotional and offer notifications.
After filing the complaint, the ODPC notified the Respondent of the complaint filed against it and asked it to provide the ODPC with the following:
- A response to the allegations made against them by the Complainant;
- Any relevant materials or evidence in support of their response;
- The lawful basis relied upon in processing the Complainant’s personal data;
- Evidence whether the Complainant consented to the processing of his personal data and sharing to third parties;
- The mitigation measures adopted or being adopted to address the complainant to his satisfaction.
The Complainant sought a declaration that the Respondent was liable for infringement on his rights to object to processing of his personal data.
After investigation, it was discovered that the Respondent misspelt one of its client’s email instead of k***nr**noo@gmail.com with double “oo” it used k***nr**no@gmail.com with single “o” which was the Complainant’s email address. That despite the Complainant calling the Respondent through its customer care number and writing to them on email to stop sending the email messages, the Respondent failed to take action until the intervention of the ODPC.
DETERMINATION
It was held by the ODPC that the Complaint email is his personal data and the Respondent violated the Complainant’s right to object to processing of his personal data. That by the Respondent failing to comply with a request from the Complainant to stop sending the emails within 14 days, it violated the Complainant’s right as envisaged in section 36 of the Data Protection Act, 2019 and Regulation 8 (3) of the Data Protection (General) Regulation 2021. The ODPC went ahead to award the Complainant Ksh. 450,000.00 as compensation for the unlawful processing of Complainant’s personal data.
At A.O.WANGA ADVOCATES we are happy to assist you with all your privacy right and Data protection concerns in Kenya.
For more info, please contact us on info@aowangaadvocates.com or +254794600191
All rights reserved for A.O.WANGA ADVOCATES
www.aowangaadvocates.com
