Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged receiving unsolicited messages from Whitepath Company urging her to inform her customer to clear a loan, despite her having no such relationship. The Data Commissioner found that the Respondent unlawfully processed the Complainant's personal data without a lawful basis. Whitepath Company was ordered to pay KES 450,000 in compensation.

Facts

Fridah Kemunto Obuba complained about receiving unsolicited communications from Whitepath Company Limited urging her to inform a customer to clear a loan owed to the Respondent.

The Complainant alleged receiving an SMS from 07518 regarding a loan taken by one Mr. O J**** Y***** and she was concerned about how the Respondent had her details, considering she was not a guarantor.

She stated that upon probing Mr. O*****, he indicated that he didn't provide her details during the loan application process. The Complainant asserted she made a call to the same number and spoke to a rude lady, followed by an SMS from the Respondent's Company. She argued that her privacy and security have been compromised. The Complainant sought a formal apology, an order for the Respondent to immediately stop contacting her, financial compensation, and for the Respondent to face severe consequences.

Whitepath Company Limited did not submit a response to the Notification of Complaint. Therefore, the allegations were treated as uncontroverted.

The Office analysed the Complainant's submissions and established that the Respondent had contacted the Complainant urging her to inform a third party to clear a loan. The Office also established that the Complainant did not take a loan from the Respondent and did not consent to be listed as an alternative contact person and/or a guarantor. The Office found that the Respondent collected and processed the Complainant's personal data (mobile phone number) without a lawful basis and without her consent. Section 26(a) of the Act provides for the right to be informed of the use to which a data subject's personal data is to be put. The Respondent failed to inform the Complainant that her mobile number would be listed as an alternative contact for a borrower and failed to seek her consent. The Respondent failed to fulfill this obligation under Section 29 of the

Legal Provisions Reviewed

Holding

• The Data Commissioner found the Respondent liable for unlawfully processing the Complainant's personal data without her consent.
• The Respondent was ordered to pay the Complainant Kenya Shillings Four Hundred and Fifty Thousand (KES 450,000) as compensation for the unlawful processing of her personal data and violation of her right to privacy.
• Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.
• The Respondent is also directed to immediately stop contacting the Complainant regarding the said loan