Chantal Marissa Pande and Joel Stephen Kunga v Credit Bank Plc

Complaint dismissed. ODPC, 18 September 2023.

Record ID

ke-odpc-2023-0022

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Chantal Marissa Pande and Joel Stephen Kunga

Date decided

18 September 2023

Respondent type

private

Sector

banking

Violations

failure to prevent data breach, unlawful processing

Provisions cited

s.25 DPA 2019, s.43 DPA 2019, s.56 DPA 2019

Outcome

complaint dismissed

Status

final

Source

Official document ↗

Source integrity

SHA-256 ff82d87237be7ee8…

Record verified

30 July 2026

The facts

The complainants alleged the bank caused their personal data, including partially masked account numbers, to be published to third parties including a news outlet, in connection with allegations that bribe payments passed through their accounts. The Office found no evidence linking the respondent to the disclosure, so the breach-notification obligations did not apply and no rights were violated. Noting grave allegations of money laundering and related financial crimes, the Office forwarded the file to the Financial Reporting Centre and the Kenya Revenue Authority.

Orders and outcome

The complaint was dismissed, with the file forwarded to the Financial Reporting Centre and the Kenya Revenue Authority for further action. Dated 18 September 2023.

BANKING · DATA-BREACH · DISMISSED · UNLAWFUL-PROCESSING

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.