Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The ODPC issued an Enforcement Notice against a digital lender (the ‘Respondent’) who had accessed a third party’s personal data (the ’Complainant’) from the contact books of its loanees. The Respondent violated their rights under the DPA,19. The Respondent, who also attempted to evade service of the complaint documents, obstructed the ODPC in the exercise of its powers.

Facts

On diverse dates between 15 March 2023 and 28 March 2023, the ODPC'S office received 23 complaints against the Respondent. It was alleged that the Respondent irregularly accessed phone records of the Complainants, irregularly sent them unwarranted text messages, requested them to settle outstanding financial obligations allegedly taken by the loanees and requesting them to settle the loanees alleged outstanding financial obligations seemingly as guarantors thereof.

The Respondent was also accused of sharing the Complainant's personal data with third parties without their consent and publishing an employee's personal data (name and phone number) on a public forum and failing to remove it when asked to do so.

The Respondent initially attempted to avoid service, which was later achieved through secondary means. The Respondent denied accessing the phone records and averred that the Complainants had consented to their terms of service. The Respondent also claimed that the violations were attributed to a third party provider. They indicated that they would change their platforms interface to restrict access to customer data going forward. They also indicated that they were in the course of closing down their business in Kenya.

Holding

The DPA held that:

• The Respondent did not obtain the Respondent's consent before listing them as guarantors.
• The Respondent obtained the Complainants personal data through their loanees phone books and used them to contact the complaints about loans they were not privy to.
• The Respondent put an employee's personal number on its online corporate profile without his permission and refused to remove when requested to do so.
• The Respondent violated the Respondent's rights to be informed of the use to which their data would be put.
• The Respondent violated their employees right to object to the processing of his personal data.
• The Respondent violated their employees right to have his personal data deleted.