NCBA Bank Kenya Limited is yet to pay Sh250,000 awarded to a customer in an earlier determination by the Office of the Data Protection Commissioner after the bank sent confidential business transaction details to an unrelated third party for months.

Brian Githaiga opened a business account for Versilia Enterprises in 2019, but the bank captured two email addresses, including an incorrect address belonging to another person.

Sensitive transaction alerts, statements and other private business information were consequently sent to the third party, who contacted NCBA as early as June 2023 to report that she was receiving financial data for an account she did not own.

Githaiga also asked the bank to delete the incorrect email address in July 2023.

However, evidence presented before the ODPC showed that his financial information was still being sent to the wrong recipient as late as February 2024, seven months after his request.

NCBA maintained that the incorrect address had been deleted in July 2023 but could not explain why the disclosure continued for several months afterward.

The ODPC found that NCBA had negligently violated Githaiga’s right to erasure under Section 40 of the Data Protection Act and ordered the bank to compensate him with Sh250,000.