Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Jimmy Owiti complained Natal Tech unlawfully shared emails revealing his debt status to his employer, NEMA, without consent, causing distress. The ODPC found Natal Tech liable for violating data rights and awarded KES 50,000 compensation. A prosecution recommendation was issued against the Directors for obstructing the investigation.

Facts

Jimmy Owiti (the Complainant) lodged his complaint on 21st February 2025, alleging that Natal Tech Limited (the Respondent), through its agents, unlawfully transmitted multiple emails to his employer, the National Environment Management Authority (NEMA), revealing his financial obligations (debt status) without his explicit and informed consent.

The Complainant provided the following details and evidence:

• He was subjected to aggressive and coercive debt collection tactics, including repeated WhatsApp messages and calls from the Respondent’s representatives, who threatened to disclose his financial situation to his employer.
• He asserted that the Respondent's representatives operated under unverified aliases, engaged in defamatory, fraudulent, and harassing conduct.
• He suffered severe reputational damage, emotional distress, and workplace embarrassment as a result of these violations.
• He further averred that as a public officer, he suffered unauthorized disclosure of his debt status, threats of job loss, public embarrassment, psychological distress, workplace anxiety, and fear of surveillance.
• Evidence included screenshots of emails that allegedly originated from the Respondent and were sent to his employer, demonstrating clear evidence of workplace exposure.
• The Complainant sought remedies including an immediate formal investigation, imposition of financial penalties, issuance of an Enforcement Notice, a formal apology, and potential prosecution.

Natal Tech Limited submitted its response on 3rd April 2025. The Respondent primarily denied the allegations of accessing or sharing employer data:

• They claimed they strictly adhere to data minimization principles and their systems are designed only to collect the necessary information for lending services, and do not request or store borrowers' employer details (including company names or work email addresses).