lack of consent, unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request, failure to notify data breach, obstruction of data commissioner, unlawful processing
The complainant, formerly CEO and director at WPP Scangroup, alleged multiple breaches of his privacy and data protection rights by WPP Scangroup PLC, WPP PLC and Control Risks Group, including failure to give effect to his data subject rights and to comply with their legal obligations, in the context of disciplinary investigations against him. The ODPC found the respondents liable for violating his right to access his personal data in their custody and for failing to comply with the principles of lawfulness and data minimisation.
Orders and outcome
The first and second respondents were ordered to give the complainant access to his personal data related to his employment as CEO and director at WPP Scangroup within 7 days. The respondents were ordered to pay a total of KES 1,950,000 in compensation: KES 700,000 by the first respondent, KES 700,000 by the second, and KES 550,000 by the third. An enforcement notice was issued against all three respondents. Dated 25 October 2024.
ODPC (Kenya), Bharat Thakrar v Wpp Scangroup Plc Wpp Plc Control Risks Group, ODPC Complaint No. 1159 of 2024 (consolidated with Nos. 1160 and 1161 of 2024), determination of 25 October 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2024/wpp-scangroup-plc-wpp-plc-control-risks-group/ (accessed 30 August 2026).