NCBA Bank has been ordered to pay a customer Ksh250,000 after repeatedly sending his private financial information to an unrelated person, in a case that highlights the risks of poor data management by financial institutions.
The case involved Brian Githaiga, who opened a business account with NCBA Bank in 2019. During the account registration process, two email addresses were entered into the bank’s system, one of which did not belong to him.
The error later resulted in the bank sending Githaiga’s account statements and transaction information to the wrong person.
The recipient alerted NCBA Bank after receiving the information, while Githaiga also asked the bank to remove the incorrect email address from his account in July 2023.
The bank said it acted on the request the same day. However, records reviewed by the Office of the Data Protection Commissioner showed that the incorrect email address remained active and continued receiving Githaiga’s financial information as late as February 2024.
The matter was eventually taken to the Data Protection Commissioner, who found NCBA Bank liable for violating Githaiga’s right to erasure under Kenya’s Data Protection Act.
An entrance of a NCBA bank-branded premises. Photo/https://web.facebook.com/ncbabank
NCBA Bank faced repeated warnings
The Commissioner ordered NCBA Bank to delete the third-party email address from Githaiga’s account within 14 days and compensate him Ksh250,000.
The decision raises questions about how NCBA Bank handled a known data error after both the customer and the unintended recipient had brought it to the institution’s attention.
For a bank, the information involved is particularly sensitive. Account statements can contain balances, transaction histories, account numbers and other details that customers reasonably expect to remain private.
NCBA Bank’s position that the email address had been provided during the original account registration did not resolve the issue. The regulator’s findings instead focused on the bank’s failure to properly address the continued disclosure of the information.
NCBA Bank ruling highlights data duties
The case also serves as a reminder that banks and other institutions handling personal information have obligations under Kenya’s data protection laws.
Customers have rights over how their personal information is collected, stored and used. They can also seek intervention from the Data Protection Commissioner when those rights are breached.
Githaiga’s case shows that a data breach does not necessarily end when a mistake is identified. Institutions are expected to act promptly to contain the problem and prevent further disclosure.
For NCBA Bank, the compensation order provides a financial consequence for failing to stop the repeated disclosure.
The ruling also puts the spotlight on the need for financial institutions to maintain accurate customer records and respond quickly when clients report errors involving their personal information.
