S.M.M. v AAR Insurance Kenya Limited

Complaint upheld; compensation ordered. ODPC, 10 September 2024.

Record ID

ke-odpc-2024-0084

Case reference

ODPC Complaint No. 842 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

S.M.M.

Date decided

10 September 2024

Respondent type

private

Sector

banking

Violations

failure to fulfil duty to notify (third-party data sharing)

Provisions cited

s.25 DPA 2019, s.29(d) DPA 2019, s.30(1)(b)(i) DPA 2019, s.30(1)(b)(vii) DPA 2019, s.42(2)(b) DPA 2019, s.56 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered

Compensation

KES 25,000 (≈ USD 190 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 0cb3f0d6eda23880…

Record verified

30 July 2026

The facts

The complainant, identified by initials in the determination, alleged that AAR Insurance Kenya Limited shared his family's health insurance information with a third party without consent, after which he received unsolicited messages about his family medical plan. The ODPC found the respondent failed in its duty to notify, though not intentionally, his contact details having been erroneously excluded from a customer notification about the change; it also noted the respondent had a written contract with the third party and that the complainant did not demonstrate distress or harm.

Orders and outcome

The respondent was found liable for failing to fulfil its duty to notify and ordered to pay the complainant Kenya Shillings Twenty Five Thousand (KES 25,000) in nominal compensation. Dated 10 September 2024.

HEALTHCARE · INSURANCE · DUTY-TO-NOTIFY · PROCESSOR-CONTRACT · UPHELD

Cite this decision

Track Kenya enforcement

Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.