In January 2023 the Data Commissioner made a landmark determination in a data protection complaint. The decision put into practice the provisions of the 2021 Complaints Regulations which we analysed here.
The Commissioner dismissed a data protection claim and provided much needed clarity on enforcement of the 2019 Data Protection Act. We discuss key aspects of the decision below.
Can the Commissioner handle matters pending before courts?
The Commissioner’s office has the authority to handle data protection matters whether or not they are pending before court. This authority is not affected by the registration status of the parties involved. The Data Protection Act applies to you whether or not you are registered as a data controller or processor.
Is a legal entity a data subject?
Under the Data Protection Act, a data subject must be an identifiable natural person. Companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner. Legal entities can only report issues regarding their legal data through the process for notifying the Commissioner of data breaches.
Can you pursue a complaint on behalf of someone else?
Yes, provided you have express authority from the data subject. In this case, the complaint was dismissed partly because the complainant did not show this authority.
How do I prove unauthorized disclosure of personal data?
The Commissioner requires proof that personal data was disclosed. You must show the personal data that was disclosed and how the disclosure was made. For example, if you claim a document containing personal data was emailed, you must produce both the document and the email. Without this proof, the complaint will be dismissed.
How does the Act deal with personal data in the public domain?
If a document containing personal data is part of the public record, then sharing it is not a violation of data privacy. Documents which are part of the public record cannot be the basis of a data breach complaint under the Data Protection Act. This includes documents filed in court and those published on publicly accessible websites.
Conclusion
The decision in ODPC Complaint 677 of 2022 Allen Gichuhi & another v Florence Mathenge & another provides welcome clarity on data protection complaints. It will streamline compliance with the 2019 Data Protection Act and guide future complaints.
Click to Download
DISCLAIMER:
This briefing is a highlight of legislative and policy changes and is intended to be of general use only. It is not intended to create an advocate-client relationship between the sender and the receiver. It does not constitute legal advice or a legal opinion. You should not act or rely on any information contained in this legal update without first seeking the advice of an advocate.
