THE ESK LEGAL BRIEF
THE COMPLIANCE GAPS HIDING IN PLAIN SIGHT: WHAT RECENT ODPC DETERMINATIONS TEACH BUSINESSES
Introduction
The Data Protection Act, 2019 places significant obligations on organisations that collect, use, disclose, store or otherwise process personal data. These obligations extend beyond registration with the ODPC or having a privacy policy on a website. Businesses must be able to demonstrate, in their day-to-day operations, that personal data is processed lawfully, fairly and transparently, for specified purposes and in accordance with the rights of data subjects.
Recent determinations by the Office of the Data Protection Commissioner (ODPC) demonstrate the consequences of failing to do so. Depending on the circumstances, non-compliance may result in compensation, enforcement notices or other corrective measures. In some cases, the ODPC has also recommended prosecution for failure to cooperate with regulatory investigations. This article considers a selection of recent determinations and identifies the recurring compliance gaps that businesses should look out for and address before they crystallise into legal disputes.
Compliance Gaps
a) The Duty to Notify and Compliance During Mergers & Acquisitions
Section 29 of the Data Protection Act imposes a duty on a data controller or processor to inform a data subject of prescribed matters when collecting personal data. The duty to notify under this section is proactive, mandatory, and continuous.
In Margaret Manyange v Brites Management Services Limited (ODPC/CIE/CON/2/3(199)), the ODPC found that emails sent to the Complainant containing links to the Respondent’s website did not fulfil the requirements of Section 29 as they did not notify the data subjects of their rights, the nature of the data collected, the purpose of processing, third-party disclosures, or the consequences of withholding data. The determination underscores the importance of specific and substantive notification at the appropriate stage of the processing rather than merely directing a data subject to a generic privacy policy buried in a website.
Likewise, in Catherine Wairimu Gabriel v Penda Health Limited (ODPC/CIE/CON/2/3(211)), the ODPC considered the position of personal data acquired following a corporate acquisition. The Complainant’s data had originally been collected by Grace Health. Following the acquisition, Penda Health became the new data controller. The ODPC held that the acquisition of the data did not extinguish Penda Health’s independent obligation to notify the data subject, in clear terms, of the fact of processing, the purpose, her rights as a data subject, the identity of the new controller, and the safeguards in place. The ODPC found that a single WhatsApp message inviting the Complainant to continue accessing similar services did not meet the statutory requirements.
The Penda Health determination has particular significance for mergers and acquisitions, which transactions mostly involve the transfer of customer databases, employee records, subscriber information and other personal data from one entity to another. The ODPC’s approach in this determination demonstrates that the acquiring entity cannot simply assume that all data protection obligations have been discharged because the acquired entity previously collected the data lawfully. The acquiring entity should therefore establish what categories of personal data are being acquired, the purposes for which the data was originally collected and whether the proposed post-acquisition use is compatible with the original purpose, among others.
b) Consent Must Be Documented and Capable of Proof
One of the recurring weaknesses emerging from recent determinations is the inability of organisations to demonstrate the consent upon which they rely. Section 32(1) of the Data Protection Act places the burden of proving consent on the data controller. Where an organisation relies on consent as its lawful basis for processing, it should therefore be able to demonstrate when, how and for what purpose that consent was obtained.
In Merceline Akoth Odeyo v St. Luke Orthopaedic & Trauma Hospital Eldoret (ODPC/CIE/CON/2/3(247)), the hospital claimed the Complainant gave verbal consent to the outsourcing of her testing to a third-party laboratory. The ODPC held that the failure to provide any record of written consent meant the hospital could not demonstrate that the alleged verbal consent met the legal standard of explicit and informed consent. Therefore, where an organisation relies upon consent, it must maintain adequate evidence demonstrating that the consent was validly obtained and related to the relevant processing.
The issue of consent does not end with obtaining consent. Businesses must also respect its withdrawal. In Catherine Wairimu Gabriel v Penda Health Limited above, the Complainant withdrew consent, but a subsequent communication was sent to her. The Respondent’s characterisation of the subsequent message as an operational error did not absolve it of liability. Consent is therefore not a one-time event. Organisations should have systems for recording consent, identifying the purposes for which it was given and promptly implementing withdrawals.
c) Purpose Limitation: Consent for One Purpose Is Not a Blank Cheque
Section 25(c) of the Data Protection Act requires personal data to be collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes.
In Margaret Manyange v Brites Management Services Limited discussed above, the Complainant had shared her CV with one specific prospective employer. The CV was subsequently shared with a different law firm. The ODPC found that the original consent did not provide a blanket authority to share it with whoever the organisation thinks might be interested.
The principle has practical consequences for businesses whose operations involve repeated sharing of personal data including customer information. Businesses must therefore ask a simple question before undertaking secondary processing: Is this use of the data consistent with the purpose for which the data was originally collected, or do we need a new lawful basis?
d) Third-Party Service Providers Do Not Take Away the Controller’s Responsibility
Businesses frequently rely on external service providers for website development, cloud storage, marketing, payroll processing, customer relationship management and other functions involving personal data. This however, does not transfer the obligations under the Data Protection Act to the third-party service providers. In Arthur V.O Opinya & 2 Others vs. Brainstorm Insurance Brokers Limited (ODPC/CIE/CON/2/3(198)), the Respondent attempted to blame its web developer for mistakenly uploading the Complainants’ names, titles, and professional accolades onto its website and in a licence application. The ODPC rejected this defence, holding that the Respondent, as the data controller, remained fully responsible for ensuring compliance.
Likewise, in Merceline Akoth v St. Luke Orthopaedic & Trauma Hospital, the ODPC held that the existence of a Data Sharing Agreement with a referral laboratory did not negate the Respondent’s obligations concerning the sharing of sensitive health data. This decision also reinforced the obligations when processing sensitive data which includes data relating to one’s health. The ODPC held that Section 45 of the Act sets out the permitted grounds for processing sensitive data, and legitimate interest of the Respondent does not fall within those grounds.
The Respondent’s reliance on legitimate interest as a lawful basis for transferring the Complainant’s samples to a third-party laboratory was therefore misplaced. The ODPC further found that the admission of an administrative error in processing the test results demonstrated a failure to implement adequate technical and organisational measures under Section 41 of the Act.
Practical Recommendations for Businesses
a) Operationalize Privacy Policies
Businesses must move beyond tick-box compliance and embed data protection into their operational DNA. The starting point is to operationalise privacy policies by ensuring that the stated channels, processes, and escalation mechanisms actually work. A published policy that lists an email address no one monitors is not compliance, it is a liability waiting to crystallise.
b) Build an Evidence Trail for Consent
Where consent is relied upon, businesses should maintain evidence showing: what the data subject consented to; when consent was obtained; the purpose for which it was obtained; how it was obtained; whether consent was subsequently withdrawn; and what action was taken following withdrawal. The organisation should be able to retrieve this information when required.
c) Map Purposes Before Sharing Data
Before transferring personal data to another department, affiliate, customer, contractor or service provider, businesses should establish the original purpose of collection and the legal basis for the proposed disclosure. A simple internal approval process for new uses of personal data can prevent significant compliance failures.
d) Strengthen Third-Party Data Governance
Businesses should identify every third party that handles personal data on their behalf and establish whether that party is acting as a processor, controller or another form of data recipient. Contracts should address the applicable data protection obligations and should be supported by practical monitoring and oversight.
e) Include Data Protection in M&A Due Diligence
Where personal data forms part of the assets or operations being acquired, due diligence should cover the target’s data collection practices, consent records, privacy notices, data-sharing arrangements, processors, retention policies, complaints, breaches and regulatory history. The transaction documents should also address the allocation of data protection responsibilities following completion.
How ESK Advocates LLP Can Help
Our data protection and privacy team advises businesses across Kenya on the full compliance lifecycle, including ODPC registration, compliance gap assessments and audits, data protection impact assessments, breach response, data processing and sharing arrangements, and representation in ODPC complaints and enforcement proceedings. The recent enforcement environment demonstrates the importance of proactive compliance. Businesses that identify and address compliance gaps early are better placed to manage regulatory exposure and respond effectively when complaints or investigations arise.
Article By:
Frankline Ojanji
Associate Advocate
Disclaimer:
This publication is for informational purposes only and does not constitute legal advice. For tailored legal support, kindly consult our team.
CONTACT US
0717991970
info@eskadvocates.co.ke
eskadvocatesllp.co.ke
Occidental Plaza, Westlands
@eskadvocatesllp