unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request, failure to notify data breach, unlawful processing, failure to implement security measures
The complainant's confidential medical information, contained in a medical form from her treatment at the respondent's Roysambu clinic on 24 December 2021, was released to an insurance agent without her consent. The respondent pointed to an email disclaimer but adduced no evidence it was attached, and did not show it asked the agent to erase the data. The Office found violations of her right to be informed, her right to object and her right of erasure.
Orders and outcome
The respondent was found liable and an enforcement notice was ordered to issue against it. Dated 21 September 2023.
ODPC (Kenya), Grace Gatambu v Aar Healthcare Limited, ODPC Complaint No. 1085 of 2023, determination of 21 September 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/aar-healthcare-limited/ (accessed 23 October 2026).
Track Kenya enforcement
Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.