The Office of the Data Protection Commission ('ODPC') announced, on 11 April 2023, via Twitter, its decision to issue a penalty notice of KES 5 million (approx. €33,800) against Regus Kenya, an office space provider, for failure to respond to a notification of complaint and an enforcement notice issued by the ODPC against it, following a complaint. 

Background to the case

In particular, the ODPC stated that the complaint against Regus concerned frequent spamming of automated information directed at the complainant, despite attempts by the complainant to make Regus stop such communications. In this regard, the ODPC noted that it had previously issued a notification of complaint, on 27 October 2022, a reminder to the same, on 11 November 2022, and an enforcement notice, on 16 February 2023, against Regus, which the company had failed to respond to and comply with. 

Findings of the ODPC

As such, the ODPC found that Regus had failed to comply with its notification of complaint and enforcement notice after its violation of data protection laws. 

Outcomes

Accordingly, the ODPC issued the aforementioned fine against Regus and noted that the Data Commissioner, Immaculate Kassait, urges businesses to protect personal data by design and by default, and cooperate with the ODPC to avoid penalties. 

You can read the announcement here.