Gov't slaps two companies with Ksh.10M fine for abusing customer phone data

Whitepath is reported to have failed to comply with an enforcement notice issued on January 10th, 2023, while Regus Kenya had been non-responsive to a Notification of Complaint sent to them on October 27th, 2022, a reminder on November 11th, 2022, and an Enforcement Notice on February 16th, 2023.

The Office of the Data Protection Commissioner is said to have received nearly 150 complaints against Whitepath for unauthorized access to mobile phone contacts and unsolicited text messages sent to these contacts. Whitepath staffers were also accused of harassing the complainants and their contacts, whose information had been irregularly obtained from the complainants' phone books.

Meanwhile, Regus Kenya was accused of spamming automated, improper information to complainants despite efforts to make them stop.

Both companies have been required to pay a penalty of Ksh.5,000,000 to the ODPC under Section 63 of the Data Protection Act and Regulation 20 of the Data Protection (Complaints Handling Procedure and Enforcement).

In addition, Ecological Industries Limited has been issued an enforcement notice for non-cooperation with several notifications of complaint launched against them on January 25th, 2023, and a reminder on February 15th, 2023. The complaint accused them of publishing a personal photo on a company catalog and calendar for marketing purposes.

The Data Commissioner, Immaculate Kassait, insisted that data protection is the responsibility of every data controller and processor, and companies must prioritize it when collecting, processing, or storing personal information. 

"I challenge businesses to protect personal data by design and by default and cooperate with the ODPC to avoid penalties," said Kassait.

The maximum penalty that the Data Commissioner may impose on a company under Section 63 of the Data Protection Act is Ksh.5,000,000 or one per cent of its annual turnover of the previous financial year, whichever is lower.