Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged unsolicited contact by RocketPesa demanding loan payment for a loan they did not take. The Data Commissioner determined that Ceres Tech Limited unlawfully processed the Complainant's personal data by contacting him without consent and failing to inform him of the purpose. The Respondent was ordered to pay the Complainant KES 700,000 in compensation

Facts

Antony Mwenda claimed that Ceres Tech Limited T/A Rocketpesa contacted him demanding payment for a loan he did not take. He alleged receiving WhatsApp messages informing him of the loan. He stated that the mobile number used for the alleged loan was not his, although it shared some similarities with his actual number.

The applicant reported the matter to the Central Police Station and the Directorate of Criminal Investigations Cybercrime unit. He asserted that Mpesa records corroborated that the payment was made to Ceres Tech Limited via a paybill number on 15th November 2023.

Ceres Tech Limited did not submit a response to the initial complaint. In a subsequent response dated 17th June 2024, the Respondent stated that neither the mobile numbers nor the ID number provided by the Complainant appeared in their database. They also stated that upon a preliminary review, their records showed nothing associated with the Complainant, including his ID, name, and telephone number. The Respondent averred that they had reviewed the number connected to the Complainant via WhatsApp and the said mobile number was not associated with the company or any of its authorised agents.

The Office analysed Mpesa statements which indicated a payment was made to the Respondent's paybill number using a mobile number with similarities to the Complainant's. This confirmed that a loan had indeed been taken and paid to the Respondent.

The Office found that:

• the Respondent collected the Complainant's mobile phone number and National Identification Number from a third party and did not inform him that his personal data was being collected.
• The Respondent also failed to inform the Complainant of the use to which his personal data was to be put, violating his right to be informed.
• The Respondent ought to have complied with the Complainant's request and stopped contacting him demanding payment for a loan he did not apply for or obtain.
• The Respondent violated the Complainant's right to be informed and right to object to the processing of his personal data.
• The Respondent failed to ensure the National Identification Card Number attached to the loan was accurate and reliable and failed to take reasonable steps to verify it. The collection of the Complainant's personal data directly from him for a loan by a third party without informing him was a failure to adhere to Section 28(1) of the Act.
• The Respondent also failed to ensure the safety of the Complainant's personal data.