Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Stephen Ngatia Maina complained that Whitepath Company Limited unlawfully used his data to list him as a guarantor for an unauthorized loan. He was harassed by over 50 calls. Whitepath acknowledged agents acted unprofessionally but ceased communication. The ODPC found Whitepath liable for infringing the right to be informed and the right to object. Compensation of KES 50,000 was awarded.

Facts

The Complainant averred that the Respondent used his personal data without his consent to list him as a guarantor for a loan he did not authorize. The Complainant stated that starting on or about 2nd April 2025, he received multiple phone calls from an unknown number demanding that he repay a loan allegedly linked to a third party.

He was harassed, insulted, and called over 50 times, which disrupted his peace and his ability to conduct business. After confirming that he had not been listed as a guarantor, the Complainant asked the Respondent to stop further communication. Despite this request, the Respondent allegedly continued to send threatening messages and make repeated calls even after receiving an email request to cease. The Complainant provided call logs from the Respondent's caller and the alleged third party who claimed to have listed him as a referee.

The Complainant sought the following remedies: a formal apology for the distress caused, and acknowledgement of the inconvenience and interruption to his business, noting that the phone used was his main business line.

The Respondent submitted a response to the notification on 31st May 2025. The Respondent acknowledged that their agents had acted unprofessionally and violated the Company's code of conduct. As a result, the offending agents were penalized and permanently removed from the debt recovery team.

The Respondent averred that they only collect referee contacts voluntarily provided by loan applicants and denied accessing the Complainant's entire phonebook, as alleged. The Respondent stated that all communication with the Complainant had ceased, the loan recovery process against the related party was suspended, and both the Complainant and the loan applicant were engaged to resolve the matter amicably. The Respondent provided screenshots of information allegedly provided by the loan applicant, as well as the loan applicant information.

The ODPC determined three issues: whether there was a violation of the Complainant's rights under the Act, whether the Respondent fulfilled its obligations, and whether the Complainant was entitled to remedies.

The ODPC found that the Complainant's rights under the Act were violated based on two provisions:

1. Right to be informed (Section 26(a)): The Complainant was unaware that his data was being processed until he started receiving numerous phone calls informing him that he had been listed as a guarantor by a third party. The Respondent infringed the Complainant's right to be informed of the intended use of his personal data.
2. Right to object (Section 26(c)): The Complainant clearly exercised his right to object to the processing of his data by telling the Respondent's agents to contact the loan applicant instead. The Respondent was obligated to cease processing the Complainant’s personal data, but the Respondent disregarded this objection and continued to send messages and call the Complainant incessantly, which was a direct breach of the Complainant’s rights under Section 26(c).

The ODPC concluded that the Complainant's rights with respect to the right to be informed (Section 26(a)) and the right to object (Section 26(c)) were violated by the Respondent.