Data Breach: NCBA Bank Fined For Disclosing A UK Customer’s Confidential Information To A Third Party

NCBA Bank has been ordered to pay United Kingdom based solicitor Sh250,000 for disclosing her data to a third party.

Data commissioner Immaculate Kassait slapped the lender with the fine as compensation to the Kenyan and UK-based solicitor Rose Wambui Muigai.

The ODPP noted that the lender failed to process personal data in accordance with the right to privacy resulting in unlawful and unauthorized disclosure of Muigai’s personal data.

“Having found that NCBA Bank did not process Wambui’s personal data in accordance with the right to privacy under Section 25(a) of the Act, NCBA Bank is hereby ordered to compensate Wambui in the amount of Sh 250,000,” ruled the Data commissioner.

The lawyer filed a complaint alleging that NCBA Bank disclosed her personal data to third parties, who were the lender’s former employees without lawful basis.She alleged that alleged that on diverse dates between 20th May, 2023 and 28th May, 2024, NCBA Bank processed her personal data in violation of data protection laws.

She said the former employees of the Bank were using her personal data to contact her to assist her with renewal of her insurance cover.

Data commissioner Immaculate Kassait.

Data Commissioner heard that or about June 2021, Wambui subscribed to one of the NCBA’s services, where the lender provided financing for her to acquire a motor vehicle, as well as an additional facility for an annually renewable insurance premium.

On 25th May, 2023 she stated that she received a call from a third party, who disclosed information that included her full name, mobile phone number and her motor vehicle details, car registration number.
Additionally, the third party informed her that her motor vehicle insurance was due for renewal.

Wambui said she received another call from another number and the person introduced himself and an employee of the NCBA.

“This third party disclosed the Wambui’s full name, mobile phone number and motor vehicle details and additionally informed her that the motor vehicle insurance was due for renewal and that he could assist with this,” states the decision.

On 20th May 2024, she received another call from the same person, who again disclosed Wambui’s personal data and further stated that since the Respondent’s portal had an issue with access, he was requesting that she furnish him with a copy of her logbook so he may assist with the renewal of the motor vehicle insurance.
On 22rd May 2024, she received an email from NCBA notifying her that her motor vehicle insurance was due for renewal on 28th May 2024.

She responded to the email dated May 22, 2024 requesting NCBA to proceed with the fulfillment of the vehicle motor insurance.

The Bank defended itself by claiming the individual who called the lawyer were former employees and the ceased working for the institution.