In January 2023 the Data Commissioner made a landmark determination in a data protection complaint. The decision put into practice the provisions of the 2021 Complaints Regulations which we analysed here.
The Commissioner dismissed a data protection claim and provided much needed clarity on enforcement of the 2019 Data Protection Act. We discuss key aspects of the decision below.
Can the Commissioner handle matters pending before courts?
The Commissioner’s office has the authority to handle data protection matters whether or not they are pending before court. This authority is not affected by the registration status of the parties involved. The Data Protection Act applies to you whether or not you are registered as a data controller or processor.
Is a legal entity a data subject?
Under the Data Protection Act, a data subject must be an identifiable natural person. Companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner. Legal entities can only report issues regarding their legal data through the process for notifying the Commissioner of data breaches.
Can you pursue a complaint on behalf of someone else?
Yes, provided you have express authority from the data subject. In this case, the complaint was dismissed partly because the complainant did not show this authority.
How do I prove unauthorized disclosure of personal data?
The Commissioner requires proof that personal data was disclosed. You must show the personal data that was disclosed and how the disclosure was made. For example, if you claim a document containing personal data was emailed, you must produce both the document and the email. Without this proof, the complaint will be dismissed.
How does the Act deal with personal data in the public domain?
If a document containing personal data is part of the public record, then sharing it is not a violation of data privacy. Documents which are part of the public record cannot be the basis of a data breach complaint under the Data Protection Act. This includes documents filed in court and those published on publicly accessible websites.
结论
The decision in ODPC Complaint 677 of 2022 Allen Gichuhi & another v Florence Mathenge & another provides welcome clarity on data protection complaints. It will streamline compliance with the 2019 Data Protection Act and guide future complaints.
点击下载
免责声明：
本简报重点介绍立法和政策变化，仅供一般使用。它无意在发送者和接收者之间建立律师-客户关系。它不构成法律建议或法律意见。在未事先征求律师意见的情况下，您不应根据本法律更新中所包含的任何信息行事或依赖这些信息。
