Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Marlene N. Matunga stated Whitepath Company Limited processed her personal data without a lawful basis by sending messages about a colleague's loan. The ODPC determined the respondent violated the complainant's right to privacy. Whitepath Company Limited was found liable and ordered to pay the complainant KES 450,000 in compensation.

Facts

The complainant, Marlene Ngira Matunga, alleged that the respondent, Whitepath Company Limited, processed her personal data without a lawful basis.

She stated that the respondent had been repeatedly calling her using different numbers and sending her text messages about her colleague, who had purportedly taken an online loan with the Respondent.

The complainant was listed as a guarantor without her prior knowledge or consent.

She asserted that the respondent's actions violated her right to privacy and caused her distress. She requested the Office to order the Respondent to compensate her for the violation of her rights.

Whitepath Company Limited was notified of the complaint on 9th December 2024 and asked to respond. However, the respondent was non-responsive and did not submit a response to the notification of the complaint.

As per Regulation 11 of the Enforcement Regulations, the ODPC proceeded with the determination based on the information provided by the complainant.

The ODPC made the following key findings:

• The respondent violated the complainant's right to privacy by processing her personal data without a lawful basis.
• The respondent failed to inform the complainant of the purpose for which her personal data was collected and processed, which was for the purpose of third-party debt recovery related to her colleague. This omission constituted a violation of Section 26(a) of the Data Protection Act.
• The respondent did not provide any evidence demonstrating that the complainant had been informed of the collection, processing, or intended use of her personal data.
• The respondent had an obligation under Section 25(a) of the Act to ensure that personal data is processed in accordance with the right to privacy and Section 25(c) of the Act to ensure that personal data is collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes, which they failed to do.