Kenyan marketing company WPP Scangroup and its founding chief executive, Bharat Thakrar, are locked in a legal fight over laptop logins, WhatsApp messages and use of personal data in a row that has entangled the data commissioner.
The Office of the Data Protection Commissioner on Tuesday ordered the Kenya firm, its parent company (WPP) and risk consultancy firm (Control Risks Group) to pay Mr Thakrar Sh1.95 million for personal data breaches.
It also ordered WPP Scangroup to provide logins and laptops to its former CEO to access his personal data.
But the Nairobi bourse-listed firm yesterday said it will oppose the orders from the data watchdog at the High Court in a legal fight that will open the secrets behind the fallout between WPP Scangroup and Mr Thakrar—who has a 9.79 percent stake in the marketing company.
Mr Thakrar and Scangroup’s former chief finance officer, Satyabrata Das, were ousted from the firm in 2021 after Scangroup linked them to allegations of gross misconduct following a whistleblower report.
The former CEO reckons that a probe that followed their suspension breached his privacy and use of personal information after Control Risks Group managed to access his WhatsApp message in iCloud via his laptops.
The WhatsApp messages were used in backing up the investigations and were shared with the regulator—the Capital Markets Authority (CMA) r— prompting Mr Thakrar to file a complaint with the Office of the Data Protection Commissioner and seek compensation of Sh24 billion.
The data watchdog backed Mr Thakrar over tapping and processing of his personal conversations retrieved from his WhatsApp and iCloud by Control Risks Group.
“The 1st and 2nd respondents are hereby ordered to give the complainant access to his personal data related to his employment as CEO and director…within seven days,” said the order from the Office of the Data Protection Commissioner.
It also ordered Scangroup to pay Mr Thakra Sh700,000 for the data breach while WPP and Control Risks Group are to offer the former CEO Sh700,000 and Sh550, 000 respectively.
“The respondents didn’t comply with the principle of lawful processing in processing the complainant’s private WhatsApp communications relating to alleged sexual relationships and thus did not demonstrate compliance with the Act,” said the data watchdog.
“The respondents did not comply with the principle of data minimisation in processing the complainant’s private WhatsApp and thus did not demonstrate the complainant’s private WhatsApp messages relating to alleged sexual relationships and thus did not demonstrate compliance with the Act.”
In defence, Control Risks Group said that information retrieved from Mr Thakrar’s WhatsApp are not sensitive personal information as contained in the Act.
It argued that personal data includes race, health status, marital status and family details like names of children, parents and sex.
Scangroup has opposed the orders and has decided to appeal at the High Court to reverse the orders.
“WPP Scangroup notes the determination of the Office of the Data Protection Commissioner (ODPC) against the company and Control Risks Group following an investigation into allegations of serious misconduct made in relation to the former CEO Bharat Thakrar,” the firm’s current CEO, Patricia Ithau, wrote.
“The respondents disagree with the determination and are considering an appeal.”
Separately, Mr Thakrar has sued WPP Plc, its subsidiary WPP Scangroup, and all its directors in a Nairobi court for alleged loss and reputational, emotional and mental damage linked to the events that followed his suspension from the company he founded.
He is seeking more than half a billion shillings in Kenya, plus loss of potential earnings had he still been CEO of Scangroup, and reputational damage, which, according to UK media, could be in the region of £24 million (Sh4.3 billion), if the claim succeeds.
Mr Thakrar has also accused the UK-based advertising agency of loss of a significant business opportunity to generate revenue through his children’s company where he served as a consultant.
WPP, he alleges, gave Airtel Africa further defamatory and false statements that collectively could be taken to mean that he was guilty of allegations levelled against him.
Mr Thakrar is also seeking a permanent injunction to prohibit the defendants and their agents from the continual publication of defamatory expressions against him and an order for the parties to make an unqualified retraction of the allegations.
He is accusing WPP and its Kenyan subsidiary of a “conspiracy to injure his status and reputation as a founder shareholder, director and CEO of WPP Scangroup”.
His suspension, he argues, was a result of ‘surreptitious investigation using unlawful means.’
Mr Thakrar accuses the firm’s directors that despite not seeing a draft report prepared by Control Risks, and in breach of their statutory duty to act independently, they proceeded to endorse the resolution to suspend him.
He says instead of subjecting himself through a process that was clearly predetermined, he chose to resign from his position as CEO on March 23, 2021.
He describes the resignation as ‘not voluntary.’ The entire process of his ouster and the investigation, he says in court papers, was spearheaded by Andrea Harris, Group Chief Counsel of WPP, from London despite the board having appointed a committee to manage this process.
