Welcome to The Legal Analytica’s new series; The Interpreter. This series will be coming to you weekly on Wednesday. We shall be making sense of the noise but from a legal and simple perspective. In today’s article, we will be discussing the contents of Senior Counsel Ahmednassir Abdullahi’s tweet below.
Mr. Nassir’s tweet fired up the internet. He had threatened to initiate a class action against a big telecommunications company for misusing his data. His dismay was informed by the receipt of unsolicited marketing communications from marketers he had no idea of. A quick look at the comment section showed that other Kenyans shared Senior Counsel’s sentiments: Despite not signing up for marketing communications, their inboxes were spammed. The company was quick to respond, saying that it would aid the Advocate with his issue.
Mr. Abdullahi’s sentiments are neither isolated nor in vain. Since the internet boom in the 90s, many companies have moved online. So have their customers. Overcome by the desire to reach customers, companies have developed ways to reach their customers key include the use of Short Messaging Services (SMS). Consequently, companies can reach a customer base that did not exist initially. Simultaneously, the internet boom has created companies that collect and process vast amounts of data: case in point, internet service providers like Safaricom, and social media companies like Facebook.
However, the data economy has become an economic wild west; companies sell, transfer, and even collect our data without our consent. As a result, clients have suffered due to this. Case in point, Mr. Nassir’s situation where marketing companies have spammed his inbox with a flurry of marketing his messages. In today’s post, we explain the Advocate’s complaints in line with the provisions of the law.
Where is Ahmednassir’s sentiment coming from?
In 2010, Kenya inaugurated a new Constitution which provides for among other things, a Bill of Rights. Specifically, Article 31, which guarantees every person’s right to privacy. The right includes the right not to have personal communications unnecessarily acquired or revealed. This provision guarantees each Kenyan a right to privacy. Equally, Kenya adopted the Data Protection Act in 2019. The Act enlarges the scope of Article 31 and provides for the rights of a data subject.
Thus, Mr. Abdullahi’s sentiments are grounded on the principle of legitimate expectations as a Kenyan to have their data only revealed with his consent.
Why complain to Safaricom?
Safaricom offers its services when one signs up. Signing up involves providing Safaricom with personal data such as name, ID number, etc. to obtain a phone number that one may use. Similarly, any person that would like to use a betting service or a social media company must supply their details. Safaricom and the social media company receive store and process this data. Legally, this makes them data controllers and processors; that is, they decide the data purposes and process on behalf of the data subject.
The Law imposes upon data controllers and processors certain obligations. Key include ensuring they obtain the data subject’s consent, security, lawful processing, and ensuring that they store and process data for the purposes they collected it.
Since Safaricom is a data processor, the law imposes upon Safaricom various obligations. They include ensuring the security of data and guaranteeing the lawful processing of personal data. As such, the advocate feels that the company has violated the law.
The Law and marketing communications
What the advocate and many other Kenyan’s received were unsolicited marketing communications. The Act requires data processors to process data for which they collected it. Thus, if they collected an email solely to sign you up for Netflix, they should not use it to send an advert. The Act only allows the commercial use of data only if one sought and obtained consent from the data subject or is authorized by law.
Thus, anyone should only receive marketing communications if they consented to them.
What remedies are available to Kenyans if Mr. Abdullahi files a suit?
The Act allows one who is “aggrieved by a decision of any person under this Act,” to file a complaint with the Data Commissioner. Thus, a consumer can lodge a complaint against a person who violates the Act. Upon submitting a claim, the Commissioner will investigate the allegation, and if a person is guilty, it shall serve them with the enforcement or a penalty notice. An enforcement notice shall seek the person to remedy the claim. On the other hand, a penalty notice requires the person to pay the fine specified in the notice. The Act entitles a consumer to seek damages from the data controller or data processor. Moreover, the Act provides for criminal sanctions and fines for persons that violate the Act.
Since we do not have a Data Commissioner yet, Ahmed Nassir would file a constitutional petition in Court. If he files a petition and the Court finds that Safaricom breached some legal obligations, it may order Safaricom to pay some damages and make a declaration of rights. Safaricom may also elect to settle the matter outside court.
What is the Significance of Ahmed Nassir’s claim?
We are living in an interesting time. Out there, there are conversations on data protection and how the internet has created global monopolies. Countries have tried to regulate and sanction large technology companies for violation of data protection principles. Authorities such as The Federal Trade Commission have fined Facebook for privacy violations. Also, Apple stirred developers for creating an update in iOS 14 that could disable tracking across websites. By disabling tracking across the websites, Apple would make it hard for advertisers to track your every move and send targeted advertisements.
Thus, Mr. Abdullahi’s claim will significantly affect how companies process our data. The Court may also interpret the various legal principles that emanate from his claim and this might open a flurry of lawsuits targeting large companies. As a consumer, and a business owner, you should understand the data protection law and how it impacts your business. Luckily for you, we have written pieces explaining these concepts. Click the link below to read from:
A businessperson’s perspective: https://thelegalanalytica.com/2020/07/24/understanding-data-protection-part-iii-for-businesses/
A Customer’s perspective: https://thelegalanalytica.com/2020/07/10/understanding-data-protection-part-ii-a-consumers-perspective/
Do you want us to interpret anything? Email us: [email protected] and we will surely get at it.