Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

A digital lender (the ‘Respondent’) was found guilty of irregularly accessing third party (the ‘Complainants') personal data from its customers mobile phones without their consent and using the data to send them threatening collection messages and calls.

Facts

Approximately 150 people filed complaints against Whitepath, a mobile lending company, alleging breach of their right to privacy. The customers alleged that the Respondent had irregularly accessed their mobile phone book and accessed third party contacts without consent. The Respondent was also accused of sending unwarranted and unsolicited text messages to the customer and third parties who had no relationship to the lender. Further, the complainants alleged that the Respondent's staff had also been harassing them.

They averred that these activities contravenes the provisions of the DPA,19 restricting the commercial use of personal data without a lawful basis, and the principles of data protection generally.

The ODPC issued an enforcement notice against the Respondent who failed to comply with it.

Holding

The DPA held:

• the burden of proof for purposes of proving consent lies with the Respondent.
• Respondents violated the rights of the Complainants. Enforcement action to issue - It is reported that the Respondent was fined Kes.5million for the violation.

Comment

A full text of the ruling is available. A release in respect of the same is also attached below.

Further resources

Share blogs or news articles here!