The complainant alleged that her email address was wrongfully subscribed to the student mailing system of Murang'a University of Technology although she has never been a student there, and that her numerous unsubscribe requests over several years were ignored, with the university acknowledging the issue only after the ODPC served its notification of complaint. The university attributed the failure to gaps in its unsubscribe request handling mechanisms. The Office found it failed to demonstrate a legal basis or the necessity of the processing and violated her right to object.
Orders and outcome
The respondent was found liable, ordered to compensate the complainant KES 50,000, and an enforcement notice was issued against it. Dated 31 May 2025.
ODPC (Kenya), Millicent Achieng Obor v Murang'a University of Technology, ODPC Complaint No. 0308 of 2025, determination of 31 May 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/muranga-university/ (accessed 30 August 2026).