| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25(a) and (c), 26, 28(1), 29, 30, 32 and 41 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 22 September 2023 |
| Decided: | 11 December 2023 |
| Published: | Yes |
| Fine: | Kes.20,000/= |
| Parties: | Robert aka ‘Authentic Bales’ vs. Zerox Technology Company Ltd |
| Case No.: | 1728 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Zerox Technology Company Limited (the “Respondent”) the proprietors of AsapCash, a digital lending product, were found to have violated the DPA,19 when they added the Complainant to a WhatsApp group created by the Respondent to fundraise monies to settle a third party’s outstanding loan notwithstanding that the Complainant didn't know that person and was not a party to the credit arrangement.
The Respondent is a digital credit provider operating a money lending product known as “Asap Cash”
The Complainant alleged that the Respondent created a fundraising WhatsApp group in respect of a third party who allegedly owed the firm money.
The Complainant was thereafter included in the chat as a participant notwithstanding that the third party was a stranger to the Complainant and the inclusion into the chat was done without his consent.
The Complainant provided screenshots of the WhatsApp group as proof.
The Respondent admitted the Complainants allegations but stated that the actions were taken by an employee without their authority, and disciplinary action was taken against the errant employee as a result. No proof of these actions was provided.
The ODPC found that there was a violation of the Complainant's rights under the Act, as the Respondent did not collect the personal data directly from the Complainant who was also not informed of the use to which his personal data was being put.
Additionally, it was found that the Respondent did not fulfill its obligations under the Act as a data controller and data processor. As a result, the complainant was found entitled to compensation under the Act for the damage suffered.
The ODPC held that: