Summary Of The Final Determination Of The Odpc In Complaint No. 0586 Of 2019: Harrison Kisaka Vs Faulu Microfinance Bank Limited
Facts in issue
The Complainant in this matter, Mr. Harrison Kisaka was interviewed twice in March 2023 by the Respondent for an employment opportunity at the Microfinance Institution. He successfully emerged as the top candidate and was informed of the same. In order for the recruitment process to conclude and for him to get a permanent offer, the candidate was to undergo a background check. He received and duly executed a consent form to that effect, and on 28th March 2023, he received an official letter of intent of employment subject to the results of the background check. On 15th April 2023, the Respondent informed the Complainant that after conducting the background check, they would not be proceeding with the offer for employment. Displeased by the outcome, the Complainant contended that the processed data during the background check had been used against his selection. He went to the Respondent’s head office and spoke to the Human Resources Officer seeking to access a copy of the data. The Human Resource Officer denied him a copy of the same claiming it was private information. Displeased, the Complainant lodged Complaint No. 0586 of 2023 with the ODPC, alleging a breach of his rights to access his personal data and to be informed about its usage in accordance with Section 26 of the DPA.
Proceedings before the odpc
The Respondent averred that they had conducted a background check which generated an adverse report on the character of the complainant in relation to non-disclosure of material facts. The Complainant had failed to disclose the existence of an ongoing criminal case, MCCR/E345/2023- Republic v Harrison Kisaka, relating to Conspiracy to defraud Contrary to Section 317 of the Penal Code. The Respondent stated that the matter was well within the knowledge of the complainant and in the public domain, hence there was no need to give a physical report.
The ODPC identified 1 issue for determination:
- Whether there was any infringement of the Complainant’s rights as a data subject as provided for in the Data Protection Act, 2019.
To answer this question, the ODPC began by considering whether the purported adverse report emanating from the background check constituted the Complainant’s personal data. The ODPC consulted with Section 2 of the DPA which defines personal data as, “any information relating to an identified or identifiable natural person.” The ODPC further interrogated the definition of “identifiable natural person” which is provided in the same section as, “a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity.” Taking into consideration the above definitions, the ODPC stated that the background checks relating to the complainant where his name is used as an identifier constituted personal data. This is further cemented by the fact that the background checks were being constituted with the aim of extracting information relating to the Complainant that constituted personal data.
In considering the rights of the Complainant as a data subject, the ODPC turned its attention to Section 26 of the Act and the Data Protection General Regulations (2021), which provide that a data subject has the right to access their personal data in the custody of a data controller or data processor. The regulations specifically provide that the processors and controllers had a duty to produce it at the request of the data subject. The ODPC further noted that the consent form that the Complainant had signed echoed Section 26 and explicitly stated that he had the right to access information by requesting a copy of the data processed in relation to him and that the human capital team would guide him in regards to the expected time taken to access the personal data.
The (ODPC) determined that the complainant’s rights had been violated for two reasons, first because he had a reasonable expectation that they could obtain the requested information, as explicitly outlined in the consent form provided by the Respondent.
Secondly, because the report contained details that specifically identified the Complainant by his name and according to the DPA such an identifier qualifies as personal data. After establishing that any information related to the complainant constituted personal data, the ODPC confirmed that the right to access information is unconditional. Consequently, the ODPC directed that the Respondent provide the Complainant with the report within 7 days.
Conclusion
This decision by the ODPC showcases how important it is for employers to establish and maintain robust Data Protection Policies in all parts of the organization that handle the collection, processing, utilization, and storage of personal data. This step is increasingly becoming more critical for ensuring compliance with the law and mitigate any unnecessary legal liabilities.
Secondly, it showcases that the rights provided to data subjects cannot be withheld. It is a crucial reminder that the days of withholding information from interviewees are long behind us, and therefore clear and unambiguous recruitment practices are necessary to protect the organization from unnecessary legal risks.
For interviewees, this decision is particularly significant as it gives them the opportunity to be in the know especially when such information plays a role in determining their employment status. By providing this right to access information DPA affords candidates the right to rectify any erroneous information used against them in the decision-making process.
Date: October 13, 2023 By: Anne Gathirwa.
For more insights pertaining to this matter, you can reach the writer at annegathirwalaw@gmail.com. You can also contact us at MMS Advocates, Lower Duplex Apartments, LOWER HILL ROAD, or email us at info@mmsadvocates.co.ke