Claim for unlawful use of personal data dismissed; consent and legitimate interest upheld
Judge: Hon. Magistrate S. Juma
An individual claimed that a technology company had processed his personal data without lawful basis. The court found that consent had been obtained and that the processing was necessary for the performance of a contract and the legitimate interests of the controller.
Facts
The claimant had signed up for a digital service and accepted terms that included use of data for service improvement and marketing. He later withdrew consent and requested erasure. The respondent continued to retain certain data for billing and legal obligation purposes. The claimant alleged unlawful processing and sought compensation.
Legal principle
Data protection law permits processing where the data subject has given consent, or where processing is necessary for the performance of a contract or for the legitimate interests of the controller, provided that such interests are not overridden by the interests of the data subject. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Key issues
2. Whether retention of data after withdrawal of consent was justified by contract or legal obligation.
3. Whether the respondent had complied with transparency and fairness requirements.
Ratio decidendi
The court held that consent had been freely given and that the respondent was entitled to retain data necessary for billing and regulatory compliance after withdrawal of consent. The claim was dismissed. The court noted that the respondent had provided a clear privacy notice and had responded to the erasure request in respect of data not subject to retention obligations.
Commentary
This judgment provides guidance on the interaction between consent, contract, and legitimate interest as lawful bases for processing, and on retention of data after withdrawal of consent where other bases apply.