REPUBLIC OF KENYA
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI COMMERCIAL COURTS
CIVIL APPEAL NO. E1282 OF 2024
WPP SCANGROUP PLC…………………………..…….1 st APPELLANT
WPP PLC……………………………………..…………2 nd APPELLANT
VERSUS
THE DATA COMMISSIONER……….…………………..1 st RESPONDENT
BHARAT THAKAR…………………..………………….2 nd RESPONDENT
CONTROL RISK GROUP…………………….…………3 rd RESPONDENT
( BEING AN APPEAL FROM THE DECISION OF THE DATA PROTECTION COMMISSIONER DATED 25 th OCTOBER 2024, IN RESPECT OF ODPC CONSOLIDATED COMPLAINT NO 1159, 1160 AND 1161 OF 2024)
ARISING BETWEEN
IN
OFFICE OF THE DATA PROTECTION COMMISSIONER
CONSOLIDATED COMPLAIANTS NOS 1159, 1160 AND 1161 OF 2024
BHARAT THAKRAR ……..…………….…..………..COMPLAINANT
VERSUS
WPP SCANGROUP PLC………….……........………1 st RESPONDENT
WPP PLC…………………………..………..……..….2 nd RESPONDENT
CONTROL RISK GROUP……………..…………….3 rd RESPONDENT
J U D GE M E N T
A. INTRODUCTION
1. This Appeal challenges the determination of Immaculate Kassait, MBS, Data commissioner dated 25 th October 2024 delivered pursuant to Section 8(f) and 56 of the Data Protection Act, 2019 and Regulation 14 of the Data protection (Complaints handling procedure and enforcement regulations 2021) with respect to ODPC complaint No 1159 of 2024, consolidated with ODCP complaint No 1160 of 2024 and ODCP complaint No 1161 of 2024 , where after considering all the facts of the complaint, the evidence tendered and investigations conducted, she did hold that;
a) The respondents are found liable.
b) The 1 st and 2 nd respondents are hereby ordered to give the complainant access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations, 2021 within 7 days of the date of this determination.
c) The respondents are hereby ordered to compensate the complainant Kshs 1,950,000/= (One Million, nine hundred and fifty thousand only) as follows: -
• The 1 st respondent – Kshs 700,000/= (Seven hundred thousand Kenya shillings Only).
• The 2 nd respondent-Kshs 700,000/= (Seven hundred thousand Kenya shillings Only).
• The 3 rd Respondent-Kshs 550,000/= (Five hundred and fifty Thousand Only).
d) An enforcement Notice to issue to the 1 st , 2 nd & 3 rd Respondents.
e) Parties have a right to Appeal this determination to the high court of Kenya within 30 days.
(B) BACKGROUND OF THE COMPLAINT/PLEADINGS
2. The background hereto was that the 2 nd respondent filed three complaints all dated 31 st July, 2024 against the 1 st and 2 nd Appellants and also against the 3 rd Respondent herein (hereinafter referred to as “the complaint”), where he averred that he was the founder CEO of Scan Marketing limited (Scanad), an advertising agency, he established in 1982 and managed to grow it into one of the largest advertising agencies in East Africa. In 2005 following a successful restructuring process, the said company was renamed to Scangroup Plc, a subsidiary of WPP PLC, a British multinational that specialized in communications, advertising, public relations, technology and commerce. The holding company ( WPP Plc ) was headquartered in London, England, and Scangroup Plc was thereafter successfully listed on the Nairobi stock exchange (NSE) in August 2006. Upon listing he was employed as a director and CEO pursuant to a contract of employment dated 5 th December 2005.
3. It was his contention that in 2021, he was unprocedural suspended from his position as chief executive officer of Scangroup Plc following allegations of misconduct and though he was eventually summoned to appear before the disciplinary panel, he opted to resign under duress, as he believed the said process would be unfair and was pre-determined.
4. Further, after his suspension, the 2 nd appellant did contract the 3 rd respondent (CRG) to access and process his personal data, both physically and those backed up on iCloud, including data containing his personal WhatsApp massages, unrelated to his work, which act was done without his knowledge and/or consent . After completion of their task, the 3 rd respondent complied a report, which report was shared with the Capital Markets Authority (CMA), and the 1 st and 2 nd Appellants board. By undertaking this process, the 1 st and 2 nd Appellant had failed to provide a transparent process, which safeguards his personal data and this had resulted in significant professional and personal harm, since his personal data was mishandled and improperly shared amongst several entities during the said investigations.
5. The 2 nd respondent thus lodged his complaint against the respondents alleging breach of his constitutional right to privacy guaranteed under Article 31 of the Constitution and breach of his rights as a data subject as provided in the Data protection Act (the Act), through unlawful and unjustified processing of his personal information. It was his contention that the 2 nd appellant herein as the largest shareholder of Scangroup played a significant role in the governance and decision-making process within the 1 st appellant company, thereby influencing the processing activities of Scangroup, thus effectively acted as a data controller and had to be held accountable for the breaches that occurred.
6. Specifically, the 2 nd Respondents complaint raised against both appellants and the 3 rd respondent could be summarized as follows;
(i) Complaint against the 1st Appellant (Scangroup)
7 . The 1 st Appellant had:
(a) Denied him access to his personal data without sufficient justification in breach of his right as a data subject – That Scangroup had improperly withheld access to logs and records, claiming inability to comply with the detailed requests for data extraction while citing lack of access to logs and records, failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was being processed.
(b) Improper invocation of exemptions and general situations – That Scangroup had based the denial of access to the requested documents and information on the grounds of public interest without having met the required threshold. According to the 2 nd respondent, there was no significant public interest in withholding his personal information as it did not relate to national security, public safety or other critical public concerns and that the public interest exemption should not be used to obscure transparency and accountability in the handling of personal data.
(c) Data sharing and third-party disclosures – That CRG commissioned by Scangroup and WPP accessed and processed his personal data from the company-issued devices including iCloud data and private WhatsApp messages unrelated to company responsibilities, without his consent or lawful basis. The 2 nd respondent relied on the Data Act, the Constitution and European Data Protection Supervisor (EDPS) guidelines on transparency and accountability when accessing employees' personal data to emphasize this point.
(d) Unauthorized disclosure to majority shareholder – That Scangroup disclosed his personal data, including details of disciplinary procedures and correspondences with WPP's legal counsel post-employment without obtaining his consent.
(e) Lack of transparency and accountability – The 2 nd respondent asserted that Scangroup did not provided clear explanations or documentation to support their decisions to deny him access to specific categories of his personal data and that there was no evidence of proper record keeping or documentation regarding the processing of his personal data.
(f) Misapplication of legal privilege, confidentiality and public interest – According to the 2 nd respondent, the Appellants’ invocation of confidentiality and public interest under Regulation 56 as grounds for denial was legally baseless as the requested personal data, especially those contained in investigative reports and communications with external entities such as CRG did not fall within the scope of legal privilege. The reports were likely to include factual findings based on personal data processed during investigations, which do not inherently involve confidential legal advice or preparation for litigation.
(g) Impact on rights and obligation – The 2 nd respondent avers that the denial of access to his personal data and the unauthorized access of his personal data by third parties has had a detrimental impact on his rights. This includes damage to his professional and personal reputation and standing within regulatory bodies such as the CMA based on undisclosed adverse information and potential legal repercussions stemming from Scangroup's mishandling and unauthorized disclosure of his personal data which could affect his future career prospects and personal and family's wellbeing.
(ii) Complaint against the 2nd Appellant (WPP)
8. The 2 nd Appellant had allowed;
(a) Unauthorized data processing and access – The 2 nd respondent states that WPP commissioned a third party, CRG, to access and investigate his personal data without his express consent nor did they implement measures to segregate personal data from work related data to protect his privacy, thereby disregarding the principles of data minimization and necessity as outlined in the Act.
(b) Use of personal data beyond original scope – That his personal data initially collected by Scangroup for employment purposes was subsequently used by WPP for investigations without informing him or obtaining his consent, and the resultant report was eventually shared with CMA. The usage of his personal data went beyond the original scope of data collection, thus violating the principle of purpose limitation.
(c) Denial of access to personal data – That WPP has persistently denied his requests for access to crucial personal data without justification, despite having sent a DSAR, thereby obstructing his right to fully understand how his data had been processed.
(d) Improper invocation of exemptions and general situations – That WPP had based the denial of access to the requested documents and information on the grounds of public interest, yet there was no significant public interest in withholding his personal information as it did not relate to national security, public safety, or other critical public concerns.
(e) Claims of legal privilege, confidentiality and public interest – That WPP had invoked legal privilege, confidentiality and public interest to deny his access requests to his personal data. The 2 nd respondent stated that the investigation reports and communication with external entities like CRG and CMA likely contain factual findings based on his extracted personal data, which were not inherently covered by legal privilege or involve confidential legal advice or preparation for litigation.
The 2 nd respondent further posited that the process undertaken by WPP was not transparent and that instead of addressing specific confidentiality concerns through redaction or partial disclosure, they had wholly denied his request, further demonstrating the lack of accountability. He further stated that Regulation 55 and 56 should not be used as a blanket exemption from all the provisions of the DPA. The principles of data processing and especially data subject rights must still apply and the appellants had not demonstrated compliance with the said principles even when relying on the exemption.
(f) Lack of transparency and accountability – That at no point was he informed of the nature and extent of data sharing and processing conducted by WPP. That the processing was carried out without his explicit consent, violating his rights under Section 26 of the Act.
(g) Improper personal data sharing with third parties – That WPP engaged third parties like CRG in processing his personal data without a legal basis.
(iii) Complaint against the 3rd Respondent (Control Risks Group (CRG))
9. The grounds for complaint against the 3rd Respondent were that they;
(a) without authority processed, accessed and used his personal data beyond the original scope – That CRG unlawfully accessed and processed his personal data without his consent which included data from his devices and iCloud storage containing private communications unrelated to his professional responsibilities, which constitutes a severe breach of privacy.
(b) Denial of access to personal data – The Complainant asserts that despite his DSAR, CRG did not provide access to crucial personal data, including the investigation report it compiled, which potentially contained adverse information impacting his standing with regulatory bodies. CRG had also failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was processed.
(c) Claims of legal privilege and confidentiality – That CRG had invoked legal privilege and confidentiality to deny his DSAR thereby preventing him from verifying and understanding the personal data CRG processes about him and obstructed his rights as a data subject. It was his further contention that the reports and documents likely contain factual findings arrived at after accessing his personal data, which findings were not inherently covered by legal privilege or involve confidential legal advice or preparation for litigation.
(d) Lack of transparency and accountability – The 2 nd respondent avers that CRG had not provided clear documentation or explanations for the processing activities undertaken involving his personal data, and this had resulted in reports prepared without his explicit consent.
10 . The 2 nd respondent thus urged the data commissioner to find that due to the above breaches elaborated in the complaints filed, his rights as a data subject had been breached, demanded an explanation of data processing activities, cessation of unlawful data processing, deletion of personal data, demanded a formal apology from the Appellants and urged the Data Commissioner to award him compensation for damages suffered.
(C) THE RESPONSE
(i) The 1 st and 2 nd Appellants Response to the Complaints filed
11. The 1 st and 2 nd Appellants filed their responses to the complainant and notification letters vide their letters dated 15 th , 27 th and 28 th August 2024, and 12 th September 2024. They raised a preliminary issue, that there was an ongoing litigation between Scangroup, WPP and the complainant being HCCOMM/E147/2024- BHARAT KUMAR THAKRAR VS WPP PLC, WPP SCANGROUP PLC & 7 OTHERS (The suit), where the 2 nd respondent had raised similar issues, and demanded a copy of the investigations report. Therefore, there was an overlap between his claim before the High court and the complaint made in the DSAR, which to them appeared to be a “ fishing expedition ” to circumvent the proper discovery process in the ongoing civil suit filed. Further it was the appellants contention that If discloses were to be made, it would prejudice them and have detrimental impact on the outcome of the litigation pending before court.
12. On the facts leading to the complaint, the 1 st and 2 nd appellants did aver that sometimes in late 2020 serious allegations were leveled against the 2 nd respondent, that he had engaged in behaviour and practices amounting to gross misconduct, contrary to the terms of Scangroup’s policies and procedures, its code of business conduct and board charter. These allegations were made through a Whistle-blower report of employees and former employees of scangroup using the “ Right to speak line ”, which allegations were then shared with Scangroup’s board of directors for action.
13. Following the said complaints, on 18 th February 2021, the 1 st Appellant board did suspend the 2 nd respondent to pave way for investigation, which was done by and on the behest of the Appellants by the 3 rd respondent and subsequently the 2 nd respondent was issued with a Notice to show cause (NTSC) dated 16 th March 2021, detailing acts which amounted to gross misconduct and was requested to defend himself against the said allegations. Instead of doing so, the 2 nd respondent opted to resign as director and chief executive officer of the 1 st Appellant on 23 rd March 2021.
14. Further, the Appellant’s posited that their subsequent communication with CMA was made in line with its legal reporting requirement as a listed company pursuant to the Capital Markets Act and corresponding regulations. They had also processed the 2 nd respondent’s data on the basis of the existing employer-employee relationship, while protecting their legitimate interests in the context of the said relationship. Thus all of the referenced documents which were in their possession, had been received during the employment period and processing of the same was carried out in accordance with their right as the 2 nd respondent’s employer.
15. The appellants also urged the court to note that , Section 28 of Data Protection Act , allowed for indirect collection of personal data, where such collection is necessary for the prevention, detection, investigations, prosecution and punishment of crime; and/or for the protection of the interest of the data subject or any other interested party. In context of the disciplinary investigations against the 2 nd respondent, they had a legal basis for not relying on his consent to process his personal data and thus had not acted with malice or bad faith.
16. Further, in specific response to the various grounds of complaint made against them, the Appellants stated as follows;
a) Unauthorized data processing and access ; the appellants maintained that the information requested for was legally privileged and would prejudice the suit filed by the 2 nd respondent at the high court. Regarding his request for copies of the relevant data protection policies that were in force, between November 2019 and March 2021, the 2 nd respondent being the former CEO of Scangroup, was responsible for signing off and effecting WPP Data Privacy & security charter. He had also attended several data protection and security trainings and was aware of WPP Data Privacy and security charter which applied at group level on all operating entities. Be that as it may, the had on 27 th August 2024, electronically delivered to the 2 nd respondent a soft copy of his redacted HR file.
b) Improper invocation of exemptions and general situations; The appellants asserted that they were permitted to rely on the general exemptions provided under Section 51(2)(b) of the Act, Regulation 55(a) and Regulation 56(b)&(d) of the Data Protection (General) Regulations, 2021. The 2 nd respondent’s interpretation of public interest in the context of his DSAR was therefore misguided.
c) Data sharing and Third-party disclosures/unauthorized disclosures; Clause 8 of the 2 nd respondents service contract set out how his data was to be handled during the course of his employment and further, WPP Data Privacy & security charter outlined the Appellants rights as regards Data sharing. They also stated that no sensitive personal data of the 2 nd respondent was processed by them in the manner alleged and consequently, his consent was not required in dealing with the same.
d) Employment and Investigative data; They asserted that the same was protected by legal privilege and reserved their right in relation to such information. Further without prejudice to the above such information could also be requested through a disclosure request in the ongoing suit file at the High court between the said parties.
e) Continued disclosure of adverse personal information; The Appellants reiterated that EDPS relied upon by the 2 nd respondent were not applicable and that they were allowed by the Employment Act to retain an employee’s Data post termination for a period of five (5) years. Additionally, WPP Data handling and Retention policy, set out their data retention policies and practices and that this was undertaken in line with the objectives set out in Clause 8 of the 2 nd respondents service contract. Disclosures to CMA were also done in line with statutory requirements under the Capital Markets Act.
f) Lack of transparency and accountability/use of personal data beyond original scope; The appellants stated that the 2 nd respondent as a former CEO of Scangroup had full visibility of their data protection polices, and referred to the contents of WPP Data Privacy & Security Charter, which outlined their polices and practice in the context of disclosure of employee personal Data. Further, as a licensed company of CMA, Scangroup was under strict legal requirement to maintain its books, records, accounts and Audits and regularly report its affairs to CMA as statutorily required. They thus denied use of the 2 nd respondents’ data beyond the original scope of inquiry.
g) Misapplication of legal privilege, confidentiality and public interest; It was the Appellants contention that information sought for was covered by legal privilege, which concept was provided for under Section 134 to 137 of the Evidence Act and was aimed at protecting clients to whom legal services was being provided. They were thus not under any legal obligation to provide an explanation as to why certain information/documents were protected by legal privilege as the attendant confidentiality arose automatically.
h) Impact on the 2 nd respondents’ rights and reputation; The Appellants emphasized that at no point did they make any information regarding the 2 nd respondents’ resignation or the suit public.
i) Inadequate response to DSAR; The appellants maintained that they had responded to the DSAR in good faith, but maintained that the 2 nd respondent was on a fishing expedition since the complaint was being used to harass them and was convoluted in purpose
17. The 1 st and 2 nd respondent thus urged the Data commissioner to find that the complaint raised had no merit and urged her to dismiss the same.
(ii) The 3 rd Respondent (Control Risk Group) Response to the Complaint
18. The 3 rd respondent herein (CRG) filed various responses dated 19 th August 2024, 16 th September 2024 and 8 th October 2024 to the DSAR filed by the 2 nd respondent. They did point out that the personal data requested for by the 2 nd respondent in the DSAR was processed by them solely in their capacity as Data processor on behalf of Scangroup, who were the Data controller, as defined under the Act. The said data was subject to a suit filed by the 2 nd respondent against the Appellants, being HCCOM/E147/2024 and thus believed that disclosure would seriously prejudice the Appellants rights therein and have detrimental impact on the outcome of the said suit.
19. Be that as it may, CRG stated that on or about the 19 th February, 2021, they entered into a legally binding agreement with Coulson Harney LLP (T/A Bowmans Kenya), who acted as legal counsel to Scangroup to investigate allegations of serious misconduct against the 2 nd respondent, who was a director and CEO of the said company. The said agreement included specific written provisions, including instructions for the processing of personal data, in accordance with Section 42(2)(b) of the Data Act and Regulation 25(3) of the General Regulations . Further, as per the said agreement, they had acted as the data processor on behalf of the Data controller, Scangroup, for processing of personal data as part of the said investigations.
20. Based on the foregoing, the 3 rd respondent denied the 2 nd respondents averment that they had illegally processed his personal data, as the same had been handed over to them by Scangroup, the Data Controller, and was processed solely in the context of investigations undertaken on the 2 nd respondents alleged misconduct. They further asserted that the 2 nd respondent did raise a DSAR against the data controller, Scangroup and thus the DSAR raised against them as data processor was unfounded and misplaced since, they were not vested with the authority to make determinations on restrictions of processed data.
21. They did further contend that their engagement to undertake investigations was with Coulson Harney LLP, acting as legal advisor to Scangroup. All investigative data, communications and reports specifically requested for by the 2 nd respondent were thus subject of legal privilege and confidentiality. Further, as per the definition of sensitive personal data under the Act, personal conversations, WhatsApp and iCloud data were not prima facie sensitive personal data and no breach could be attributed to them for accessing the same.
22. The 3 rd respondent, thus urged the Data commissioner to dismiss the complaint filed in its entirety or in the alternative its determination be suspended pending the outcome of the suit filed in view of the sub judice rule.
(D) DETERMINATION OF THE DATA COMMISSIONER
23. The data commissioner did consider all the documents filed by both parties as specified under paragraph 66 and 67 of the determination dated 25 th October 2024 and raised four (4) issues for determination. On the first issue, she held that she had jurisdiction to determine the complaint despite the existence of the High court suit pending as the complaint related to alleged infringement of rights as set out in Section 8(a)&(f) of the Data Protection Act , while the suit centered around contractual and commercial relationship between the 2 nd respondent and the Appellants. Additionally, CRG and was not a party to the suit nor were the 3 rd to 9 th Defendants party to the complaint filed.
24. On the 2 nd issue as to whether, there was infringement of the 2 nd respondents right under the Data Act, the Data commissioner held that;
a) The complainant’s right of access was not limited, even if the personal data in question consisted of information in respect of which a duty of confidentiality is owed under legal privilege, Scangroup and WPP were obligated to redact any confidential and/or legally privileged information, without affecting the complainant’s personal data and his right to access it as provided in Regulation 9 of the General regulations.
b) Other than the Exemptions set out in Part VII of the Act and the restrictions thereto, there are no other exemptions or limitations to the complainant’s right of access.
c) Scangroup and WPP were under no obligation to provide the complainant access to policies, internal agreements and procedures pursuant to a DSAR.
d) Scangroup and WPP failed to give effect to the complainants right to access his personal Data related to his employment as CEO and Director of Scangroup.
e) The complainant’s right of access to personal data related to the investigations is exempt from the application of the Act in as far as those investigations were carried out to facilitate compliance with the regulatory compliance requirements under the Capital Markets Act, subject to Section 51(1) of the Act.
25. On the third issue as to whether, the Appellants had fulfilled their obligation under the Act, the Data Commissioner did hold that;
a) The Appellants did not comply with the principle of lawful processing, while processing the complainants private WhatsApp communications relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act.
b) The Appellants did not comply with the principle of Data minimization in processing the complainants private WhatsApp messages relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act.
c) The sharing of the complainant’s personal data between Scangroup, CRG, WPP and Coulson Harney was lawful.
d) There was no evidence that the complainant’s sensitive personal data was processed by the respondents.
26. On the remedies available for the breach that had occurred, the Data commissioner did hold that Section 65(1) of the Act provides for compensation to a data subject, who suffers damages by reason of a contravention of a requirement of the Act. She therefor held the Appellants jointly with the 3 rd respondent liable and ordered them to jointly pay the 2 nd respondent herein a sum of Kenya shillings One million, Nine hundred and fifty thousand Only ( Kshs 1,950,000/=) for violation of his right to access his personal data in their custody and for failing to comply with the principles of lawfulness and the principles of data minimization. Of this amount,
• The 1 st Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only).
• The 2 nd Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only).
• The 3 rd Respondent (CRG) was condemned to pay Ksh 550,000/= (Kenya shillings five hundred and fifty thousand only)
27. Finally, the Appellants were ordered to give the 2 nd respondent herein access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations 2021 within 7 days of the said determination. An enforcement notice was to issue.
(E) THE APPEAL
28. The Appellants, being dissatisfied with the said determination, filed their memorandum of appeal, wherein they raised ten (10) grounds of appeal, namely: -
a) That the 1 st Respondent erred in fact and law in finding that the matters in issue raised in the proceedings in HCCOMM/E147/2024-Bharat Kumar Thakrar Vs WPP Plc , WPP Scangroup Plc & 7 Others were dissimilar to the issues raised in the complaints before the 1 st Respondent.
b) That the 1 st Respondent erred in law in failing to give effect to and/or the manner of interpreting
[...truncated]
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI COMMERCIAL COURTS
CIVIL APPEAL NO. E1282 OF 2024
WPP SCANGROUP PLC…………………………..…….1 st APPELLANT
WPP PLC……………………………………..…………2 nd APPELLANT
VERSUS
THE DATA COMMISSIONER……….…………………..1 st RESPONDENT
BHARAT THAKAR…………………..………………….2 nd RESPONDENT
CONTROL RISK GROUP…………………….…………3 rd RESPONDENT
( BEING AN APPEAL FROM THE DECISION OF THE DATA PROTECTION COMMISSIONER DATED 25 th OCTOBER 2024, IN RESPECT OF ODPC CONSOLIDATED COMPLAINT NO 1159, 1160 AND 1161 OF 2024)
ARISING BETWEEN
IN
OFFICE OF THE DATA PROTECTION COMMISSIONER
CONSOLIDATED COMPLAIANTS NOS 1159, 1160 AND 1161 OF 2024
BHARAT THAKRAR ……..…………….…..………..COMPLAINANT
VERSUS
WPP SCANGROUP PLC………….……........………1 st RESPONDENT
WPP PLC…………………………..………..……..….2 nd RESPONDENT
CONTROL RISK GROUP……………..…………….3 rd RESPONDENT
J U D GE M E N T
A. INTRODUCTION
1. This Appeal challenges the determination of Immaculate Kassait, MBS, Data commissioner dated 25 th October 2024 delivered pursuant to Section 8(f) and 56 of the Data Protection Act, 2019 and Regulation 14 of the Data protection (Complaints handling procedure and enforcement regulations 2021) with respect to ODPC complaint No 1159 of 2024, consolidated with ODCP complaint No 1160 of 2024 and ODCP complaint No 1161 of 2024 , where after considering all the facts of the complaint, the evidence tendered and investigations conducted, she did hold that;
a) The respondents are found liable.
b) The 1 st and 2 nd respondents are hereby ordered to give the complainant access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations, 2021 within 7 days of the date of this determination.
c) The respondents are hereby ordered to compensate the complainant Kshs 1,950,000/= (One Million, nine hundred and fifty thousand only) as follows: -
• The 1 st respondent – Kshs 700,000/= (Seven hundred thousand Kenya shillings Only).
• The 2 nd respondent-Kshs 700,000/= (Seven hundred thousand Kenya shillings Only).
• The 3 rd Respondent-Kshs 550,000/= (Five hundred and fifty Thousand Only).
d) An enforcement Notice to issue to the 1 st , 2 nd & 3 rd Respondents.
e) Parties have a right to Appeal this determination to the high court of Kenya within 30 days.
(B) BACKGROUND OF THE COMPLAINT/PLEADINGS
2. The background hereto was that the 2 nd respondent filed three complaints all dated 31 st July, 2024 against the 1 st and 2 nd Appellants and also against the 3 rd Respondent herein (hereinafter referred to as “the complaint”), where he averred that he was the founder CEO of Scan Marketing limited (Scanad), an advertising agency, he established in 1982 and managed to grow it into one of the largest advertising agencies in East Africa. In 2005 following a successful restructuring process, the said company was renamed to Scangroup Plc, a subsidiary of WPP PLC, a British multinational that specialized in communications, advertising, public relations, technology and commerce. The holding company ( WPP Plc ) was headquartered in London, England, and Scangroup Plc was thereafter successfully listed on the Nairobi stock exchange (NSE) in August 2006. Upon listing he was employed as a director and CEO pursuant to a contract of employment dated 5 th December 2005.
3. It was his contention that in 2021, he was unprocedural suspended from his position as chief executive officer of Scangroup Plc following allegations of misconduct and though he was eventually summoned to appear before the disciplinary panel, he opted to resign under duress, as he believed the said process would be unfair and was pre-determined.
4. Further, after his suspension, the 2 nd appellant did contract the 3 rd respondent (CRG) to access and process his personal data, both physically and those backed up on iCloud, including data containing his personal WhatsApp massages, unrelated to his work, which act was done without his knowledge and/or consent . After completion of their task, the 3 rd respondent complied a report, which report was shared with the Capital Markets Authority (CMA), and the 1 st and 2 nd Appellants board. By undertaking this process, the 1 st and 2 nd Appellant had failed to provide a transparent process, which safeguards his personal data and this had resulted in significant professional and personal harm, since his personal data was mishandled and improperly shared amongst several entities during the said investigations.
5. The 2 nd respondent thus lodged his complaint against the respondents alleging breach of his constitutional right to privacy guaranteed under Article 31 of the Constitution and breach of his rights as a data subject as provided in the Data protection Act (the Act), through unlawful and unjustified processing of his personal information. It was his contention that the 2 nd appellant herein as the largest shareholder of Scangroup played a significant role in the governance and decision-making process within the 1 st appellant company, thereby influencing the processing activities of Scangroup, thus effectively acted as a data controller and had to be held accountable for the breaches that occurred.
6. Specifically, the 2 nd Respondents complaint raised against both appellants and the 3 rd respondent could be summarized as follows;
(i) Complaint against the 1st Appellant (Scangroup)
7 . The 1 st Appellant had:
(a) Denied him access to his personal data without sufficient justification in breach of his right as a data subject – That Scangroup had improperly withheld access to logs and records, claiming inability to comply with the detailed requests for data extraction while citing lack of access to logs and records, failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was being processed.
(b) Improper invocation of exemptions and general situations – That Scangroup had based the denial of access to the requested documents and information on the grounds of public interest without having met the required threshold. According to the 2 nd respondent, there was no significant public interest in withholding his personal information as it did not relate to national security, public safety or other critical public concerns and that the public interest exemption should not be used to obscure transparency and accountability in the handling of personal data.
(c) Data sharing and third-party disclosures – That CRG commissioned by Scangroup and WPP accessed and processed his personal data from the company-issued devices including iCloud data and private WhatsApp messages unrelated to company responsibilities, without his consent or lawful basis. The 2 nd respondent relied on the Data Act, the Constitution and European Data Protection Supervisor (EDPS) guidelines on transparency and accountability when accessing employees' personal data to emphasize this point.
(d) Unauthorized disclosure to majority shareholder – That Scangroup disclosed his personal data, including details of disciplinary procedures and correspondences with WPP's legal counsel post-employment without obtaining his consent.
(e) Lack of transparency and accountability – The 2 nd respondent asserted that Scangroup did not provided clear explanations or documentation to support their decisions to deny him access to specific categories of his personal data and that there was no evidence of proper record keeping or documentation regarding the processing of his personal data.
(f) Misapplication of legal privilege, confidentiality and public interest – According to the 2 nd respondent, the Appellants’ invocation of confidentiality and public interest under Regulation 56 as grounds for denial was legally baseless as the requested personal data, especially those contained in investigative reports and communications with external entities such as CRG did not fall within the scope of legal privilege. The reports were likely to include factual findings based on personal data processed during investigations, which do not inherently involve confidential legal advice or preparation for litigation.
(g) Impact on rights and obligation – The 2 nd respondent avers that the denial of access to his personal data and the unauthorized access of his personal data by third parties has had a detrimental impact on his rights. This includes damage to his professional and personal reputation and standing within regulatory bodies such as the CMA based on undisclosed adverse information and potential legal repercussions stemming from Scangroup's mishandling and unauthorized disclosure of his personal data which could affect his future career prospects and personal and family's wellbeing.
(ii) Complaint against the 2nd Appellant (WPP)
8. The 2 nd Appellant had allowed;
(a) Unauthorized data processing and access – The 2 nd respondent states that WPP commissioned a third party, CRG, to access and investigate his personal data without his express consent nor did they implement measures to segregate personal data from work related data to protect his privacy, thereby disregarding the principles of data minimization and necessity as outlined in the Act.
(b) Use of personal data beyond original scope – That his personal data initially collected by Scangroup for employment purposes was subsequently used by WPP for investigations without informing him or obtaining his consent, and the resultant report was eventually shared with CMA. The usage of his personal data went beyond the original scope of data collection, thus violating the principle of purpose limitation.
(c) Denial of access to personal data – That WPP has persistently denied his requests for access to crucial personal data without justification, despite having sent a DSAR, thereby obstructing his right to fully understand how his data had been processed.
(d) Improper invocation of exemptions and general situations – That WPP had based the denial of access to the requested documents and information on the grounds of public interest, yet there was no significant public interest in withholding his personal information as it did not relate to national security, public safety, or other critical public concerns.
(e) Claims of legal privilege, confidentiality and public interest – That WPP had invoked legal privilege, confidentiality and public interest to deny his access requests to his personal data. The 2 nd respondent stated that the investigation reports and communication with external entities like CRG and CMA likely contain factual findings based on his extracted personal data, which were not inherently covered by legal privilege or involve confidential legal advice or preparation for litigation.
The 2 nd respondent further posited that the process undertaken by WPP was not transparent and that instead of addressing specific confidentiality concerns through redaction or partial disclosure, they had wholly denied his request, further demonstrating the lack of accountability. He further stated that Regulation 55 and 56 should not be used as a blanket exemption from all the provisions of the DPA. The principles of data processing and especially data subject rights must still apply and the appellants had not demonstrated compliance with the said principles even when relying on the exemption.
(f) Lack of transparency and accountability – That at no point was he informed of the nature and extent of data sharing and processing conducted by WPP. That the processing was carried out without his explicit consent, violating his rights under Section 26 of the Act.
(g) Improper personal data sharing with third parties – That WPP engaged third parties like CRG in processing his personal data without a legal basis.
(iii) Complaint against the 3rd Respondent (Control Risks Group (CRG))
9. The grounds for complaint against the 3rd Respondent were that they;
(a) without authority processed, accessed and used his personal data beyond the original scope – That CRG unlawfully accessed and processed his personal data without his consent which included data from his devices and iCloud storage containing private communications unrelated to his professional responsibilities, which constitutes a severe breach of privacy.
(b) Denial of access to personal data – The Complainant asserts that despite his DSAR, CRG did not provide access to crucial personal data, including the investigation report it compiled, which potentially contained adverse information impacting his standing with regulatory bodies. CRG had also failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was processed.
(c) Claims of legal privilege and confidentiality – That CRG had invoked legal privilege and confidentiality to deny his DSAR thereby preventing him from verifying and understanding the personal data CRG processes about him and obstructed his rights as a data subject. It was his further contention that the reports and documents likely contain factual findings arrived at after accessing his personal data, which findings were not inherently covered by legal privilege or involve confidential legal advice or preparation for litigation.
(d) Lack of transparency and accountability – The 2 nd respondent avers that CRG had not provided clear documentation or explanations for the processing activities undertaken involving his personal data, and this had resulted in reports prepared without his explicit consent.
10 . The 2 nd respondent thus urged the data commissioner to find that due to the above breaches elaborated in the complaints filed, his rights as a data subject had been breached, demanded an explanation of data processing activities, cessation of unlawful data processing, deletion of personal data, demanded a formal apology from the Appellants and urged the Data Commissioner to award him compensation for damages suffered.
(C) THE RESPONSE
(i) The 1 st and 2 nd Appellants Response to the Complaints filed
11. The 1 st and 2 nd Appellants filed their responses to the complainant and notification letters vide their letters dated 15 th , 27 th and 28 th August 2024, and 12 th September 2024. They raised a preliminary issue, that there was an ongoing litigation between Scangroup, WPP and the complainant being HCCOMM/E147/2024- BHARAT KUMAR THAKRAR VS WPP PLC, WPP SCANGROUP PLC & 7 OTHERS (The suit), where the 2 nd respondent had raised similar issues, and demanded a copy of the investigations report. Therefore, there was an overlap between his claim before the High court and the complaint made in the DSAR, which to them appeared to be a “ fishing expedition ” to circumvent the proper discovery process in the ongoing civil suit filed. Further it was the appellants contention that If discloses were to be made, it would prejudice them and have detrimental impact on the outcome of the litigation pending before court.
12. On the facts leading to the complaint, the 1 st and 2 nd appellants did aver that sometimes in late 2020 serious allegations were leveled against the 2 nd respondent, that he had engaged in behaviour and practices amounting to gross misconduct, contrary to the terms of Scangroup’s policies and procedures, its code of business conduct and board charter. These allegations were made through a Whistle-blower report of employees and former employees of scangroup using the “ Right to speak line ”, which allegations were then shared with Scangroup’s board of directors for action.
13. Following the said complaints, on 18 th February 2021, the 1 st Appellant board did suspend the 2 nd respondent to pave way for investigation, which was done by and on the behest of the Appellants by the 3 rd respondent and subsequently the 2 nd respondent was issued with a Notice to show cause (NTSC) dated 16 th March 2021, detailing acts which amounted to gross misconduct and was requested to defend himself against the said allegations. Instead of doing so, the 2 nd respondent opted to resign as director and chief executive officer of the 1 st Appellant on 23 rd March 2021.
14. Further, the Appellant’s posited that their subsequent communication with CMA was made in line with its legal reporting requirement as a listed company pursuant to the Capital Markets Act and corresponding regulations. They had also processed the 2 nd respondent’s data on the basis of the existing employer-employee relationship, while protecting their legitimate interests in the context of the said relationship. Thus all of the referenced documents which were in their possession, had been received during the employment period and processing of the same was carried out in accordance with their right as the 2 nd respondent’s employer.
15. The appellants also urged the court to note that , Section 28 of Data Protection Act , allowed for indirect collection of personal data, where such collection is necessary for the prevention, detection, investigations, prosecution and punishment of crime; and/or for the protection of the interest of the data subject or any other interested party. In context of the disciplinary investigations against the 2 nd respondent, they had a legal basis for not relying on his consent to process his personal data and thus had not acted with malice or bad faith.
16. Further, in specific response to the various grounds of complaint made against them, the Appellants stated as follows;
a) Unauthorized data processing and access ; the appellants maintained that the information requested for was legally privileged and would prejudice the suit filed by the 2 nd respondent at the high court. Regarding his request for copies of the relevant data protection policies that were in force, between November 2019 and March 2021, the 2 nd respondent being the former CEO of Scangroup, was responsible for signing off and effecting WPP Data Privacy & security charter. He had also attended several data protection and security trainings and was aware of WPP Data Privacy and security charter which applied at group level on all operating entities. Be that as it may, the had on 27 th August 2024, electronically delivered to the 2 nd respondent a soft copy of his redacted HR file.
b) Improper invocation of exemptions and general situations; The appellants asserted that they were permitted to rely on the general exemptions provided under Section 51(2)(b) of the Act, Regulation 55(a) and Regulation 56(b)&(d) of the Data Protection (General) Regulations, 2021. The 2 nd respondent’s interpretation of public interest in the context of his DSAR was therefore misguided.
c) Data sharing and Third-party disclosures/unauthorized disclosures; Clause 8 of the 2 nd respondents service contract set out how his data was to be handled during the course of his employment and further, WPP Data Privacy & security charter outlined the Appellants rights as regards Data sharing. They also stated that no sensitive personal data of the 2 nd respondent was processed by them in the manner alleged and consequently, his consent was not required in dealing with the same.
d) Employment and Investigative data; They asserted that the same was protected by legal privilege and reserved their right in relation to such information. Further without prejudice to the above such information could also be requested through a disclosure request in the ongoing suit file at the High court between the said parties.
e) Continued disclosure of adverse personal information; The Appellants reiterated that EDPS relied upon by the 2 nd respondent were not applicable and that they were allowed by the Employment Act to retain an employee’s Data post termination for a period of five (5) years. Additionally, WPP Data handling and Retention policy, set out their data retention policies and practices and that this was undertaken in line with the objectives set out in Clause 8 of the 2 nd respondents service contract. Disclosures to CMA were also done in line with statutory requirements under the Capital Markets Act.
f) Lack of transparency and accountability/use of personal data beyond original scope; The appellants stated that the 2 nd respondent as a former CEO of Scangroup had full visibility of their data protection polices, and referred to the contents of WPP Data Privacy & Security Charter, which outlined their polices and practice in the context of disclosure of employee personal Data. Further, as a licensed company of CMA, Scangroup was under strict legal requirement to maintain its books, records, accounts and Audits and regularly report its affairs to CMA as statutorily required. They thus denied use of the 2 nd respondents’ data beyond the original scope of inquiry.
g) Misapplication of legal privilege, confidentiality and public interest; It was the Appellants contention that information sought for was covered by legal privilege, which concept was provided for under Section 134 to 137 of the Evidence Act and was aimed at protecting clients to whom legal services was being provided. They were thus not under any legal obligation to provide an explanation as to why certain information/documents were protected by legal privilege as the attendant confidentiality arose automatically.
h) Impact on the 2 nd respondents’ rights and reputation; The Appellants emphasized that at no point did they make any information regarding the 2 nd respondents’ resignation or the suit public.
i) Inadequate response to DSAR; The appellants maintained that they had responded to the DSAR in good faith, but maintained that the 2 nd respondent was on a fishing expedition since the complaint was being used to harass them and was convoluted in purpose
17. The 1 st and 2 nd respondent thus urged the Data commissioner to find that the complaint raised had no merit and urged her to dismiss the same.
(ii) The 3 rd Respondent (Control Risk Group) Response to the Complaint
18. The 3 rd respondent herein (CRG) filed various responses dated 19 th August 2024, 16 th September 2024 and 8 th October 2024 to the DSAR filed by the 2 nd respondent. They did point out that the personal data requested for by the 2 nd respondent in the DSAR was processed by them solely in their capacity as Data processor on behalf of Scangroup, who were the Data controller, as defined under the Act. The said data was subject to a suit filed by the 2 nd respondent against the Appellants, being HCCOM/E147/2024 and thus believed that disclosure would seriously prejudice the Appellants rights therein and have detrimental impact on the outcome of the said suit.
19. Be that as it may, CRG stated that on or about the 19 th February, 2021, they entered into a legally binding agreement with Coulson Harney LLP (T/A Bowmans Kenya), who acted as legal counsel to Scangroup to investigate allegations of serious misconduct against the 2 nd respondent, who was a director and CEO of the said company. The said agreement included specific written provisions, including instructions for the processing of personal data, in accordance with Section 42(2)(b) of the Data Act and Regulation 25(3) of the General Regulations . Further, as per the said agreement, they had acted as the data processor on behalf of the Data controller, Scangroup, for processing of personal data as part of the said investigations.
20. Based on the foregoing, the 3 rd respondent denied the 2 nd respondents averment that they had illegally processed his personal data, as the same had been handed over to them by Scangroup, the Data Controller, and was processed solely in the context of investigations undertaken on the 2 nd respondents alleged misconduct. They further asserted that the 2 nd respondent did raise a DSAR against the data controller, Scangroup and thus the DSAR raised against them as data processor was unfounded and misplaced since, they were not vested with the authority to make determinations on restrictions of processed data.
21. They did further contend that their engagement to undertake investigations was with Coulson Harney LLP, acting as legal advisor to Scangroup. All investigative data, communications and reports specifically requested for by the 2 nd respondent were thus subject of legal privilege and confidentiality. Further, as per the definition of sensitive personal data under the Act, personal conversations, WhatsApp and iCloud data were not prima facie sensitive personal data and no breach could be attributed to them for accessing the same.
22. The 3 rd respondent, thus urged the Data commissioner to dismiss the complaint filed in its entirety or in the alternative its determination be suspended pending the outcome of the suit filed in view of the sub judice rule.
(D) DETERMINATION OF THE DATA COMMISSIONER
23. The data commissioner did consider all the documents filed by both parties as specified under paragraph 66 and 67 of the determination dated 25 th October 2024 and raised four (4) issues for determination. On the first issue, she held that she had jurisdiction to determine the complaint despite the existence of the High court suit pending as the complaint related to alleged infringement of rights as set out in Section 8(a)&(f) of the Data Protection Act , while the suit centered around contractual and commercial relationship between the 2 nd respondent and the Appellants. Additionally, CRG and was not a party to the suit nor were the 3 rd to 9 th Defendants party to the complaint filed.
24. On the 2 nd issue as to whether, there was infringement of the 2 nd respondents right under the Data Act, the Data commissioner held that;
a) The complainant’s right of access was not limited, even if the personal data in question consisted of information in respect of which a duty of confidentiality is owed under legal privilege, Scangroup and WPP were obligated to redact any confidential and/or legally privileged information, without affecting the complainant’s personal data and his right to access it as provided in Regulation 9 of the General regulations.
b) Other than the Exemptions set out in Part VII of the Act and the restrictions thereto, there are no other exemptions or limitations to the complainant’s right of access.
c) Scangroup and WPP were under no obligation to provide the complainant access to policies, internal agreements and procedures pursuant to a DSAR.
d) Scangroup and WPP failed to give effect to the complainants right to access his personal Data related to his employment as CEO and Director of Scangroup.
e) The complainant’s right of access to personal data related to the investigations is exempt from the application of the Act in as far as those investigations were carried out to facilitate compliance with the regulatory compliance requirements under the Capital Markets Act, subject to Section 51(1) of the Act.
25. On the third issue as to whether, the Appellants had fulfilled their obligation under the Act, the Data Commissioner did hold that;
a) The Appellants did not comply with the principle of lawful processing, while processing the complainants private WhatsApp communications relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act.
b) The Appellants did not comply with the principle of Data minimization in processing the complainants private WhatsApp messages relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act.
c) The sharing of the complainant’s personal data between Scangroup, CRG, WPP and Coulson Harney was lawful.
d) There was no evidence that the complainant’s sensitive personal data was processed by the respondents.
26. On the remedies available for the breach that had occurred, the Data commissioner did hold that Section 65(1) of the Act provides for compensation to a data subject, who suffers damages by reason of a contravention of a requirement of the Act. She therefor held the Appellants jointly with the 3 rd respondent liable and ordered them to jointly pay the 2 nd respondent herein a sum of Kenya shillings One million, Nine hundred and fifty thousand Only ( Kshs 1,950,000/=) for violation of his right to access his personal data in their custody and for failing to comply with the principles of lawfulness and the principles of data minimization. Of this amount,
• The 1 st Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only).
• The 2 nd Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only).
• The 3 rd Respondent (CRG) was condemned to pay Ksh 550,000/= (Kenya shillings five hundred and fifty thousand only)
27. Finally, the Appellants were ordered to give the 2 nd respondent herein access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations 2021 within 7 days of the said determination. An enforcement notice was to issue.
(E) THE APPEAL
28. The Appellants, being dissatisfied with the said determination, filed their memorandum of appeal, wherein they raised ten (10) grounds of appeal, namely: -
a) That the 1 st Respondent erred in fact and law in finding that the matters in issue raised in the proceedings in HCCOMM/E147/2024-Bharat Kumar Thakrar Vs WPP Plc , WPP Scangroup Plc & 7 Others were dissimilar to the issues raised in the complaints before the 1 st Respondent.
b) That the 1 st Respondent erred in law in failing to give effect to and/or the manner of interpreting
[...truncated]