The Office of the Data Protection Commissioner (ODPC) has issued a ruling against Wananchi Group Limited, the company behind Zuku, and Geosky Service Limited, finding them liable for violating the Data Protection Act when handling personal data.
Following the findings, the Data Protection Commissioner Immaculate Kassait on Monday, February 17, recommended the prosecution of directors from both Wananchi Group Limited and Geosky Service Limited.
"The Office cautions data controllers that failure to comply with orders and notices pertaining to investigations as envisaged in Section 57 of the Act is an offence and to this end, the Data Commissioner has recommended prosecution of the Directors of Wananchi Group Limited and Geosky Service Limited.
"Both the Data Controllers failed to honor notices from the Office and Wananchi Group Limited refused to comply with a court search warrant which is in violation of Section 60 and 61 of the Act," the statement read in part.
Kassait also ordered compensation for the complainant and instructed both companies to allow individuals to exercise their rights regarding the processing of their personal data.
Read More
"The Commissioner also issued compensation orders against the two Respondents. The Commissioner amongst many other orders, also ordered the Respondents to allow the complainants to exercise their rights to erasure and to object to the processing of their personal data," the statement added.
According to the ODPC, Wananchi Group Limited was found responsible for failing to honor data subjects’ rights, including the right to erasure and the right to object to the processing of personal data.
The agency also determined that the company had not implemented an operational mechanism for individuals to exercise their rights as stated in its privacy notice.
"The Office found Wananchi Group Limited liable for failing to give effect to the data subject’s right to erasure as per section 40 and the right to object to the processing of personal data as defined in Section 36 of the Act.
"Further, the Office found that the company failed to implement a mechanism for data subjects to exercise their rights as the method stated in their privacy notice was not operational," the statement further read.
On the other hand, Geosky Service Limited was found in violation of the Act as it had used a complainant’s personal data without a lawful basis.
ODPC also established that Geosky denied the complainant the right to be informed before processing their information.
"In its Determination, the Data Commissioner also found Geosky Service Limited liable for using the Complainant’s personal data without a lawful basis and for denying the Complainant an opportunity to exercise his right to be informed before processing of his personal data in violation to Section 26(a) of the Act," the statement added.
