| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 28, 29 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 25 May 2023 and 12 June 2023. |
| Decided: | 22 August 2023 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | Brian Kimani & Anor vs. Zillions Credit Ltd |
| Case No.: | 860 of 2023 & 978 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Zillions Credit Company Ltd (the “Respondent”), a digital credit provider, was found liable for violating the Applicants' rights by using their personal information to demand repayment of loans issued to third parties. The Applicants were neither aware of the collection of their data nor informed of its intended use.
Zerox Technology Company Ltd (the “Respondent”), a digital credit provider lender operating the name Meta loan and Zash Loan separately sent multiple messages to the Applicants demanding that they repay loans taken by third parties either as guarantors or as persons known to those third parties.
The Respondent initially wanted to resolve the matter through ADR which failed.
The Respondent confirmed that none of the Applicants were beneficiaries of credit facilities from them but averred that their contacts were provided as alternate/emergency contacts by the third parties/customers. The respondent also averred thatbthey were in the process of improving their data practices.
The Data Commissioner found that the Applicants contacts were not obtained from them directly, they were unaware of the colllection of their personal data and they were never informed of its intended use by the Respondent, which were in violation of the provisions of the data protection law.
The ODPC held that:
The full text of the ruling is available below.