In the case of Allen Waiyaki Gichuhi & Charles Wamae vs Florence Mathenge & Ambrose Waigwa, a complaint was filed with the Office of the Data Protection Commissioner (ODPC) regarding third-party data sharing contrary to the Data Protection Act. The applicants alleged that the first respondent shared personal and sensitive information, including court documents, with a third party without consent.
The ODPC determined its jurisdiction to hear the complaint and assessed whether there was a breach of the Data Protection Act. However, the applicants failed to provide shared documents, hindering the ODPC's ability to ascertain if personal data was breached. As most documents were already in the public domain, the complaint regarding data breach was dismissed.
The case highlighted the application of the Data Protection Act regardless of registration status as a data controller or processor. Non-registration does not exempt entities from compliance with the Act, and any breach of personal data can be addressed by the ODPC.