| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25(4), 26 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 14 April 2023 |
| Decided: | 5 July 2023 |
| Published: | N/A |
| Fine: | N/A |
| Parties: | Jeff Nduko vs. One Acre Fund |
| Case No.: | 0574 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
One Acre Fund missed a digit when capturing a customer's telephone number resulting in demand notices being sent to a person who had no relationship with it. The case was deemed resolved when One Acre Fund corrected the mistake promptly even though they had violated the principles of the DPA19.
One Acre Fund (”the Respondent”) enrolled a customer onto its platform and issued him with a loan facility. The customer failed to repay the loan and the Respondent instituted collection measures against him by sending demand notices to the phone number registered against his account in the platform.
Unfortunately, the person who keyed in the customer's telephone number in the customer management system, keyed in a wrong digit with the result that the contact details actually captured belonged to Jeff Nduko (”the Complainant”). The result of the error was that the collection messages that were intended for the customer, went to the Complainant instead even though the Complainant had no relationship with the Respondent at all.
The Complainant filed this complaint with the ODPC but did so without first seeking resolution from the Respondent.
The ODPC held that:
The Complaint was marked as resolved.
The complaint does not deal with the breach occassioned by the mistake. The full text of the ruling is available below.