Show Me What You Hold

 

                                                                

By Tim Munyi Mugo, Advocate

In Part 2 of this series, I introduced you to the Treasurer who posted a chama members Kshs. 500 arrears on the group alongside the M-pesa statement. Now, today, three days after the Treasurer pressed send, the member is still being greeted at the market with a smile that says someone knows where his Fridays go. So he does what nobody in the group expected. He walks to the Treasurer and asks for two things. Show me everything you hold on me. And take that statement down.

The Treasurer answers the way most controllers would. It is only WhatsApp, he says. Everyone already has it, and what has been posted cannot be unposted.

Section 26 gives the member his opening move.

THE RIGHTS  |  Section 26, Cap 411C. A data subject has a right to be informed of the use to which their personal data is to be put; to access their personal data in the custody of a data controller or data processor; to object to the processing of all or part of their personal data; to correction of false or misleading data; and to deletion of false or misleading data about them.

 

Access is the quiet right with the loudest consequences. The Act states it in a single line, and the Data Protection (General) Regulations give it teeth. Under regulation 9, a controller must confirm whether it holds your data, give you access, and say why it holds it, who has received it, how long it will keep it and, where the data did not come from you, where it came from. It must do so within seven days, free of charge. The Regulations even prescribe the form, Form DPG 2.

The second request is harder, and section 40 answers it.

THE REMEDY  |  Section 40(1), Cap 411C. A data subject may request a data controller or data processor to rectify without undue delay personal data that is inaccurate, outdated, incomplete or misleading, or to erase or destroy without undue delay personal data that the controller is no longer authorised to retain, or that is irrelevant, excessive or obtained unlawfully.

 

Hold that list against the Treasurer’s post. A missed contribution of Kshs. 500 was answered with a statement of every Friday. Regulation 12 requires a response to an erasure request within fourteen days, again free of charge. A careful member cites section 40 rather than section 26(e), because section 26 speaks only of false or misleading data, and section 40 is wider.

The Treasurer’s best defence arrives next, stating the M-pesa statement was needed, he says, to prove the arrears.

THE EVIDENCE EXCEPTION  |  Section 40(3), Cap 411C. Where the personal data is required for the purposes of evidence, the controller shall, instead of erasing or rectifying it, restrict its processing and inform the data subject within a reasonable time.

 

He has a point. Evidence is a reason to restrict, not a reason to erase, and not a reason to publish. He may keep the one line that proves the contribution was missed. Under section 34(2)(a), restricted data may be stored and used to establish a legal claim, but not circulated for the group’s benefit. Regulation 7(4)(c) lists removing published data from a public medium as one way to give effect to a restriction.

What of the thirty copies already sitting on thirty phones? Section 40(2) requires a controller who has shared data with third parties for processing to take all reasonable steps to inform them of the request. Whether a group member counts as a third party processing the data is arguable. Asking every member to delete it is plainly a reasonable step, and a Treasurer who refuses will struggle to explain why. And if he reaches for section 51(2)(a), the exemption for purely personal or household activity, a thirty-member group collecting contributions is hard to describe as either.

So what the chama member should do is first, to ask, put it in writing, date it, keep proof that it was delivered, say which right you are exercising, and ask for a written reply. You may act through someone you have authorised, under section 27. If the controller stays silent or refuses, section 56 lets you complain to the Data Commissioner, orally or in writing, and requires the complaint to be concluded within ninety days. Section 65 then entitles a person who suffers damage to compensation, and damage includes distress.

Now put a water utility on the receiving end of the letter, and consider these. A customer clears his arrears in March and in September his name is still on a list for everyone to read. Another receives a bill built on an estimated reading that no meter ever recorded. The first writes for rectification or erasure under section 40. The second writes for access under section 26(b) and regulation 9, asking for the readings behind the bill, and the seven days begin when the letter lands.

The sector question is not whether customers will write. It is whether the desk that receives the letter knows what it is, who answers it, and whether anyone is counting to seven. Regulation 23 expects controllers to publish a data protection policy, and says it may set out how a data subject can access their data and exercise their rights. That policy is where an honest utility starts.

So this is the interesting part. The chama Treasurer pressed send in a second. The Regulations give him 7-days to answer the first request and 14-days to answer the second. And just like that, now the calendar is on the member’s side, because deletion is always slower than disclosure.

Next in this series, the lender who borrows your friends: what the Act says about contact lists, debt, and the people least able to argue back.

Stay with me. The law you live is more interesting than the law you fear.

*The author is an Advocate of the High Court of Kenya and Co-Founder of the Veritas Governance Institute.

Connect on LinkedIn: linkedin.com/in/tim-munyi-mugo-8194b024 

 

Catch you in the next blog!

 

Disclaimer- The information provided is for general informational purposes only and should not be considered as professional advice. Please consult a qualified professional for specific guidance.