Kenyan lawyer sues Truecaller over alleged data privacy violations

A data protection lawyer has filed a lawsuit against Truecaller, accusing it of breaching the Data Protection Act by collecting and sharing the contact details of Kenyans without their consent.

The petitioner, James Mbugua, alleged that the Swedish company discriminates against Kenyans by failing to register as a data controller and by not complying with the Act's provisions regarding the collection of personal data.

Truecaller, according to its website, enables mobile phone users to identify incoming calls from unknown numbers.

Mbugua noted that despite operating in Kenya, Truecaller is not registered with the Office of the Data Protection Commissioner (ODPC), as mandated by Section 18(1) of the Act.

“They do not appear in the list of registered data handlers on the ODPC website," Mbugua said in his petition.

He expressed concerns about accountability and compliance with data protection regulations due to the lack of registration.

Mbugua is seeking a declaration that Truecaller's data protection practices violate the Act and Regulations, compelling the company to register as a data controller or processor with the ODPC.

In addition, he accused Truecaller of unauthorised transfer of personal data to India without adequate assurances of effective data protection laws.

“A cease and desist order directing Truecaller to cease transferring Kenyan user data to India or outside the country until they demonstrate full compliance with Kenyan data protection laws or localise their data storage within Kenya is necessary,” he said.

He added that this should include demonstrating adequate safeguards or obtaining consent.

Mbugua said that if a widely used platform like Truecaller operates without proper safeguards, it poses a significant threat to the privacy rights of Kenyan citizens.

“The upshot of this is that not only does its caller ID feature display identifier information for data subjects from around the world to its Kenyan users, but it also displays the personal details of Kenyans (name and number—landline, mobile, or prepaid) to third parties across the world, thereby de-identifying them to strangers and violating their right to privacy as spelled out in Part IV of the Act,” the lawyer said.

He further argued that Truecaller's practices violate the Act and Regulations in several ways, particularly the failure to fulfill its obligations regarding personal data protection, and the transfer of personal data to India without adequate safeguards or consent.

“Not only does Truecaller determine the commercial purposes to which it processes and puts the data, it also uses automated means of processing the data,” he said.

He explained that Truecaller employs a specific algorithm to select the best name from a wide array of harvested names.

He further added that the details of this algorithm are undisclosed and developed by Truecaller, with none of the Kenyan data subjects who upload the data knowing its specifics.

“Contrary to Section 25 (b) and 28(1), Truecaller does not process personal data collected in a transparent manner, nor does it collect data directly from the data subject. Instead, it collects contact details of third parties stored in a user's device without their consent,” he claimed.

On the issue of discrimination and unequal application of privacy standards between Europeans and Kenyans, Mbugua argued that Truecaller applies a different data protection standard for regions with established data protection regimes or where it has been sued for privacy breaches, while bundling other jurisdictions—including Kenya—under a generic privacy policy.