Data Controller & Processor Liability: Marketing Campaigns and Data Protection Compliance

Ombo Malumbe and Emmanuel Kahero explore a recent decision by the Office of the Data Protection Commissioner (ODPC) concerning liability between a Data Controller and Data Processor as determined in the case of Esther Kanza Mbuvu v Grain Industries Limited ODPC Complaint No. 387 of 2024, whereby the ODPC ordered the Data Controller to pay KES. 1,000,000 to the Data Subject for what would have been classified as the Data Processor’s mistake.