Ex-CEO loses fight with Scangroup over secret WhatsApp texts

The High Court ruled that the Data Commissioner erred in proceeding with the case despite a pending High Court suit that raised similar issues.

The judge found that both the High Court suit and the complaint before the ODPC arose from the same set of facts and raised overlapping questions regarding the legality of investigations conducted into Mr Thakrar, the non-disclosure of an investigation report, and the alleged violation of his privacy rights.

The court said a determination by the High Court on whether the investigations were lawful, whether the report was privileged, and whether the processing and disclosure of Mr Thakrar’s data was justified would directly affect the outcome of the complaint before the Data Commissioner.

“If the High Court were to find that the investigations were lawful, the resultant report was privileged or was legitimately withheld, and the processing or disclosure was lawful, then there would be no invasion of the former CEO’s privacy,” the court said.

Conversely, the court noted, a finding in Mr Thakrar’s favour in the High Court case would substantially determine the same issues that were before the Data Commissioner.

“It is therefore my finding and holding that central issues for determination in the suit filed before the High Court and before the ODPC were intricately intertwined and posed the same questions for determination in two different forums,” the court said.

The dispute stems from events in 2021 when Mr Thakrar, the founder and former CEO of Scangroup, and the company’s former finance officer Satyabrata Das, were linked to allegations of gross misconduct following a whistleblower report.

Mr Thakrar, who founded Scanad in 1982 and grew it into one of East Africa’s largest advertising agencies, remained CEO after the company was restructured into Scangroup Plc and later became part of the global communications giant WPP Plc.

He told the Data Commissioner that he was suspended in February 2021 following allegations of misconduct and later resigned under duress because he believed the disciplinary process was predetermined and unfair.

According to his complaint, WPP and Scangroup engaged CRG to investigate the allegations and, in the process, accessed and processed personal data stored on company devices and iCloud accounts, including private WhatsApp messages unrelated to his work.

Mr Thakrar argued that the investigations were conducted without his knowledge or consent and that the resulting report was shared with the Capital Markets Authority (CMA), WPP and Scangroup’s board, causing him professional and personal harm.

He further alleged that the companies denied him access to his personal data, improperly relied on public interest exemptions to withhold information, and unlawfully disclosed his personal information to third parties.

The former CEO claimed the actions violated his constitutional right to privacy and several provisions of the Data Protection Act, including principles governing lawful processing, transparency and purpose limitation.

Scangroup and WPP denied the allegations, maintaining that the investigations were triggered by serious misconduct claims raised through the company’s whistleblower channel.

The companies said Mr Thakrar was suspended to allow investigations to proceed and was later issued with a notice to show cause but chose to resign before responding to the allegations.

They argued that all data processing was carried out lawfully within the employer-employee relationship and in pursuit of legitimate corporate governance and regulatory obligations.

The companies also maintained that the investigation report was protected by legal professional privilege because it was commissioned through external lawyers. They further argued that disclosure of the report would prejudice ongoing court proceedings.

In its now-quashed decision, ODPC found that the companies had unlawfully processed Mr Thakrar’s private WhatsApp communications, including messages relating to alleged personal relationships, and had failed to comply with the principles of lawful processing and data minimisation.

The Commissioner then ordered WPP, Scangroup and CRG to provide Mr Thakrar access to his personal data and awarded him Sh1.95 million in compensation.