Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Ann Wambui Kahwai complained Zillions Credit Limited contacted and harassed her for a debt she neither borrowed nor guaranteed. Zillions' agent used her personal data without a lawful basis, violating her right to be informed. Zillions was found liable for infringing her rights and ordered to pay Kenya Shillings Two Hundred and Fifty Thousand (Kshs. 250,000) as compensation.

Facts

The Complainant alleged that Zillions Credit Limited contacted her without her consent, sending unsolicited and often threatening text messages and making numerous calls in an effort to recover a debt. She detailed receiving a call from a representative who claimed he was contacting her regarding a loanee who had defaulted. Although she immediately clarified that she was not the individual they were seeking, the representative incorrectly alleged her name was listed as a guarantor for the actual borrower, a claim made without her knowledge or consent. Ms Kahwai maintained that representatives threatened her on their first call and subsequently continued to harass her through frequent calls, often using a private number, which caused her significant mental distress. The Complainant sought a finding that the Respondent violated data protection laws and requested an award of damages for the mental distress suffered due to the constant harassment.

Zillions Credit Limited responded, acknowledging that the communications were sent incorrectly by one of their collection agents. The Respondent claimed that a thorough investigation revealed the messages were intended for a different customer, identified as J****** W******, and were sent to the Complainant by mistake. They clarified that the agent had failed to exercise necessary due diligence in verifying the customer's details, despite having received extensive training in ethical debt collection practices and data protection. Crucially, Zillions asserted that the agent had also wrongly informed the Complainant that she was a guarantor for a Zash Loan. The Respondent stated that their Zash Loan product only collects personal data and does not require collateral or guarantors. The company also noted that in response to the complaint, they organized their customer data systems to prevent future instances of data mix-up and had implemented data protection training for their agents.

The Office of the Data Protection Commissioner (ODPC) determined that there was a violation of the Complainant's rights. Specifically, the ODPC found that the Respondent infringed upon the Complainant’s right to be informed under Section 26(a) of the Data Protection Act. The Respondent collected and used the Complainant's mobile number to contact her without informing her of the purpose for which her personal data was to be put at the point of collection, and utilized it without a lawful basis. Furthermore, the ODPC found that Zillions Credit Limited failed to uphold its mandated responsibility under Section 25(f) of the Act to maintain accurate records. The agent's misrepresentation highlighted a significant lapse in due diligence regarding the verification of the data's accuracy and relevance. The ODPC concluded that reaching out to the Complainant regarding a loan she did not guarantee infringed upon the principle of purpose limitation.

• Legal Provisions Reviewed

Holding

The Data Commissioner made a final determination, finding the Respondent liable for infringement of the Complainant’s rights to be informed under Section 26(a) of the Act. The Respondent was ordered to pay the Complainant a sum of Kenya Shillings Two Hundred and Fifty Thousand (Kshs. 250,000) as compensation for the infringement of her rights. An Enforcement Notice shall be issued to the Respondent. The parties were informed that they possess the right to appeal this determination to the High Court of Kenya within thirty (30) days.

Comment

The full text of the ruling is available below.

Further resources

Share blogs or news articles here!