| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25(4), 26, 28, 29, 30, 32, 37, 42 of the Data Protection Act, 2019; Regulation 42 of the Data Protection (General) Regulations, 2021 |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 17 November 2023 |
| Decided: | 14 February 2024 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | Millie Namasaka vs. Platinum Credit & Premier Credit |
| Case No.: | 2380 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Platinum Credit (the “1st Respondent”) failed to demonstrate that they took all reasonable measures to ensure their agents complied with the Data Protection Act's provisions. Their agents continued calling the Complainant about their products and ignored repeated requests to stop.
Millie Namasaka (the “Complainant”) alleged that Platinum Credit & Premier Credit (the “Respondents”) by themselves or through their agents called her constantly over their loan products.
She further alleged that they refused to stop the calls even after she went to the Respondent's offices to request that they don't call her anymore.
The 1st Respondent identified certain callers as an employee (team leader) and certain of their independent sales agents.
They averred that the sales agents had been trained on data protection requirements, but had acted outside expectations. The 1st Respondent did not provide proof of the training undertaken by its agents as alleged. The 1st Respondent also averred that they had since terminated the services of the agents even as the team leader is taken through disciplinary action.
The ODPC found that the 1st Respondent had put in reasonable provisions on data protection on agent contracts, but found that only 1 agent’s contract was terminated by the Respondent, which negated their averments as to the reason for termination.
The Office also found that the 2nd Respondent not only trained its agents on data protection laws, but also released all of them from their contracts once they became aware of this incident.
The ODPC held that: