Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Eric Munene Mbogo complained Platinum Credit used his data for unsolicited marketing and unlawfully shared it with a third-party valuer. Mbogo explicitly objected, but Platinum continued contact, violating his right to object. The ODPC found the company liable for data rights infringement and ordered KES 500,000 compensation.

Facts

Eric Munene Mbogo (the Complainant) lodged his complaint on 27th August 2024, alleging that Platinum Credit Limited (the Respondent) used his personal data, which was in its custody, for marketing purposes and subsequently shared his personal data with a third party without notifying him.

Specifically, the Complainant adduced the following evidence. That on or around 26th July 2024 and 30th July 2024, the Respondent’s staff called him regarding loan facilities that he had not requested. The calls, originating from numbers claiming to be the Respondent's Credit Officer and Manager, respectively, aimed to market a car loan facility and even attempted to book a car valuation. The callers claimed to have retrieved his number from the Organisation’s database, relating to a facility he had initially cleared.

The Complainant provided evidence, including a voice note, a WhatsApp screenshot, and a text message from a valuer, as proof of these allegations.

On 30th July 2024, the Complainant received a text from P****** M****** from Eezy Valuers informing him that he was on his way to Laare to value a motor vehicle. The Complainant averred that this incident caused him emotional distress and reputational damage, noting one call was on loudspeaker when the insensitive caller claimed he had borrowed a loan. He formally objected to the processing of his data via email on 6th August 2024, requesting the Respondent not to market anything to him. Despite the Respondent confirming on 20th August 2024 that they had deleted his data and would not provide further marketing communication, the Complainant stated that he was still contacted on 5th September 2024 by a Respondent agent marketing payslip loans and logbook loans from the Meru Branch.

The Complainant sought compensation for emotional distress and reputational damages, along with an order compelling the Respondent to comply with data protection regulations.

Platinum Credit Limited submitted its response in two letters dated 30th September 2024 and 23rd October 2024.

The Respondent’s main counterarguments were that the Complainant’s contact details were in their database as a dormant client. Their sales team recorded that the Complainant had expressed interest in taking a subsequent loan.

As part of the standard loan process for the new facility, the Complainant was informed that his motor vehicle would be used as security, requiring a valuation. Specific details, including location and booking for the assessment, were communicated. The valuation is conducted through third parties to ensure an independent assessment, which formed the basis for their agents and contracted valuers contacting the Complainant.

The Respondent relied on Clause 9 of the Loan Agreement, which they asserted provided the Complainant's explicit consent for the continued holding and processing of his data even after the initial loan was settled, covering marketing and offering further financial services. The Respondent claimed that upon receiving the complaint on 6th August 2024, they promptly contacted the Complainant and took immediate action to remove his personal data from their systems, asserting he was no longer being contacted. The Respondent later disputed the Complainant's subsequent claim that he continued to be contacted by their agents.

Following its analysis of the evidence, the ODPC established the following facts and legal violations: