Nairobi — The Office of the Data Protection Commissioners (ODPC) has fined three firms Sh9.4 million for infringing on personal data.
Mulla Pride Ltd., a digital credit provider (DCP), which operates KeCredit and Faircash mobile lending apps, has been penalized Sh2.98 million for sharing complainants contact information and names with third parties where threatening messages and phone calls were sent later.
"This Penalty will ensure that Digital lenders and financial institutions notify data subjects when collecting and processing their data, and the intention of processing the said data," ODPC said in a statement.
"It will further ensure that the data controllers are limited to strictly dealing with data subjects who have consented to the collection and processing of their data," the notice added.
Casa Vera Lounge, which is located along Ngong Road in Nairobi, has been slapped with Sh1.9 million fine for posting a reveler's image on its social media platform without consent.
ODPC said that the penalty serves to deter other joints from using revelers pictures.
Similarly, Roma School, a learning institution in Uthiru, will have to pay the regulator Sh4.6 million for posting minors' pictures without parental consent.
"This being the first and the highest penalty to an educational facility sends a message to schools and other facilities handling minors' personal data to obtain consent from parents/guardians prior to processing minors' data," it added.
Under Kenyan law, firms are required to comply with the Data Privacy Rights Act and the Data Protection Act.
Data Commissioner Immaculate Kassait urged data controllers and processors to ensure that the processing of personal data is in accordance with the provisions of the Act.
"The office has also conducted a compliance audit on WhitePath, (a digital credit provider) and an inspection on Naivas Supermarkets on recent Data Breach," ODPC stated.
"The findings will be shared with the Data Controllers for their swift action," it added.
"The Office will be embarking on conducting forty (40) Compliance Audits to various Data Controllers and Processors in various sectors this Financial Year."
