| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 32 (1), 63 of the DPA,19 |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 20, 26 & 27 June, 2023 & 13 July, 2023 |
| Decided: | 15 September 2023 |
| Published: | N/A |
| Fine: | Kes.5million |
| Parties: | Laureen Mumia & 3 Others vs. Whitepath Limited |
| Case No.: | 1234,1049, 1104 & 1111 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Whitepath, a digital lender (the ‘Respondent’) was found guilty of irregularly accessing third party (the ‘Complainants') personal data from its customers mobile phones without their consent and using the data to send them threatening collection messages and calls.
Approximately 150 people filed complaints against Whitepath, a mobile lending company, alleging breach of their right to privacy. The customers alleged that the Respondent had irregularly accessed their mobile phone book and accessed third party contacts without consent. The Respondent was also accused of sending unwarranted and unsolicited text messages to the customer and third parties who had no relationship to the lender. Further, the complainants alleged that the Respondent's staff had also been harassing them.
They averred that these activities contravenes the provisions of the DPA,19 restricting the commercial use of personal data without a lawful basis, and the principles of data protection generally.
The ODPC issued an enforcement notice against the Respondent who failed to comply with it.
The DPA held the burden of proof for purposes of proving consent lies with the Respondent which had not been dispelled. The Respondents breached the provisions of the DPA19. Enforcement action to issue - It is reported that the Respondent was fined Kes.5million for the violation.
A full text of the ruling is available. A release in respect of the same is also attached below.
Share blogs or news articles here!
ODPC-issues-penalty-notice-against-whitepath.pdf