In recent months, the Office of the Data Protection Commissioner (ODPC) has imposed three fines on three organisations. The first fine concerns OPPO. The ODPC issued an enforcement notice against the
smartphone brand for violating a complainant’s privacy by using their photo on the company’s Instagram account (Instagram stories) without their consent. The penalty notice for a fine of €33,500 was issued in accordance with the Data Protection Act (2019) and the Data Protection Regulations (2021).
Despite the enforcement notice, OPPO Kenya has refused to cooperate with the ODPC. The brand has not submitted and/or developed a compliance policy in accordance with Article 37 of the Data Protection Act. In addition, OPPO Kenya has not submitted a data protection policy consistent with the enforcement notice issued. Finally, the brand also failed to prove that it had an internal complaints mechanism in place to deal with data subjects’ complaints. As a result, OPPO Kenya has been fined.
With regard to the other two sanctions, the ODPC issued two penalty notices to Whitepath Company Limited and Regus Kenya for failure to comply with the Data Protection Act and failure to respond to complaint notices. These companies have each been ordered to pay approximately €33,500. Ecological Industries Limited received an enforcement order for refusing to co-operate following several complaints lodged against the company for the illegal use of the complainants’ photos.
In the press release about OPPO’s sanction, the Data Protection Commissioner, Immaculate Kassait, MBS, urged all organisations to comply with the Data Protection Act by implementing principles and safeguards for all processing activities related to the collection and storage of personal data.
“The ODPC urges data controllers and processors to ensure that the processing of personal data complies with the provisions of the law. Failure to comply with the law will result in the implementation of sanction procedures”, she emphasized.