John Onkangi v National Bank Of Kenya Limited Keysian Auctioneers

Complaint upheld; enforcement notice issued. ODPC, 15 December 2023.

Record ID: ke-odpc-2023-0041
Case reference: ODPC Complaint No. 1766 of 2023
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: John Onkangi
Date decided: 15 December 2023
Respondent type: private
Sector: banking
Violations: failure to prevent data breach, unlawful debt collection, unlawful processing
Provisions cited: s.25 DPA 2019, s.30 DPA 2019, s.32 DPA 2019, s.56 DPA 2019, s.58 DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 7d004483dc21f321…
Record verified: 30 July 2026

The facts

The complainant alleged his loan statement, and consequently his bank account details, were disclosed to a third party without his consent. The ODPC found the first respondent bank vicariously liable for the actions of its employee, while the complainant failed to discharge the burden of proving a legitimate claim against the second respondent, an auctioneers firm.

Orders and outcome

The first respondent was found vicariously liable and an enforcement notice was issued against it; the complaint against the second respondent was dismissed. Dated December 2023.

BANKING · DATA-BREACH · DEBT-COLLECTION · DISMISSED · UNLAWFUL-PROCESSING

Cite this decision

ODPC (Kenya), John Onkangi v National Bank Of Kenya Limited Keysian Auctioneers, ODPC Complaint No. 1766 of 2023, determination of 15 December 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/national-bank-of-kenya-limited-keysian-auctioneers/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.