The Office of the Data Protection Commissioner (ODPC) has ordered NCBA Bank to pay KSh 250,000 in compensation to a customer whose personal data was mishandled.
The case centered on a complaint by Brian Githaiga, who alleged that NCBA Bank failed to correct an error in his email address, resulting in his business transaction details being sent to an unintended recipient.Githaiga opened a business account with NCBA in 2019, but the bank recorded an incorrect email address after the customer submitted two email addresses, including the erroneous one.The order requires NCBA Bank to erase the third party’s email address from Githaiga’s business account within 14 days and to compensate him for the violation of his data privacy rights.
“In considering whether to issue compensation, this office takes into consideration the fact that the respondent (NCBA) either intentionally or negligently violated the complainant’s right of erasure of his personal data by failing to correct the email address in its database even after the instructions had been issued by the complaint,” Data Commissioner, Immaculate Kassait ruled.
While the bank argued that it used the information provided by the customer, the Commissioner found that the bank failed to rectify the error despite being notified by both the customer and the unintended email recipient.
The unintended recipient had also notified the bank on June 15, 2023, that she was receiving emails despite not having an account with them. Furthermore, Githaiga presented evidence that, even after requesting the correction in July 2023, the bank continued to send information to the incorrect address. An email dated 7th February 2024, showed that the error persisted.
In its determination, the ODPC emphasized the importance of the right to rectification and erasure of personal data under the Data Protection Act of 2019. The Commissioner concluded that NCBA Bank violated Githaiga’s right to erasure by continuing to send information to the incorrect email address.