Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged receiving unsolicited calls from Whitepath Company regarding a loan where he was purportedly listed as a guarantor without his consent or knowledge. The Data Commissioner found that the Respondent processed the Complainant's personal data without a lawful basis. Whitepath Company was ordered to pay the Complainant KES 250,000 in compensation.

Facts

Dennis Caleb Owuor complained about receiving unsolicited calls from Whitepath Company regarding a loan he had been listed as a guarantor for without his consent.

The Complainant stated he received an unsolicited call on 23rd November 2024 from telephone number 020******40. He asserted that the caller identified himself as a debt collector from Whitepath Limited and addressed the Complainant by his first name at the onset of the conversation. The Complainant maintained that the agent had obtained his name and contact information and disclosed that the Complainant had been listed as a guarantor of a defaulting loanee. He argued he had never consented to be a guarantor for anyone with Whitepath Company. The Complainant sought compensation for unlawfully processing his data without consent and causing him emotional distress.

Whitepath Company did not submit a response to the Notification of Complaint. Therefore, the allegations were treated as uncontroverted.

The Office found that the Respondent contacted the Complainant without a lawful basis and listed him as a guarantor for a loan without his prior knowledge or consent. Section 26(a) of the Act provides for the right to be informed of the use to which a data subject's personal data is to be put. The Respondent ought to have informed the Complainant that his data would be processed as a guarantor for a loan and sought his consent. The Respondent unlawfully processed the Complainant's personal data by obtaining it and using it to contact him as a guarantor without his consent.

Evaluation of Applicable Laws

The Data Commissioner reviewed several legal provisions. These include:

• Article 31(c) and (d) of the Constitution of Kenya, which provides for the right to privacy.
• Section 5 of the Data Protection Act, 2019, which establishes the Office of the Data Protection Commissioner and outlines its mandate, including regulating personal data processing and protecting individual privacy.
• Section 8(1)(f) of the Data Protection Act, 2019, which grants the Office the power to receive and investigate complaints regarding infringements of rights under the Act.
• Section 25 of the Data Protection Act, 2019, which sets out the principles guiding the processing of personal data.
• Section 26(a) of the Data Protection Act, which provides for the right to be informed of the use to which a data subject's personal data is to be put. The Data Commissioner found that Sunking Limited violated this right by not informing Ms. Onyango that her personal data (mobile number) would be used to send her unwanted messages.