Authority: ODPC - Kenya
Jurisdiction: Kenya
Relevant law: Section 25(4), 26, 28, 29, 30, 32, 37, 42 of the Data Protection Act, 2019; Regulation 42 of the Data Protection (General) Regulations, 2021
Type: Complaint
Outcome: Violation
Started: 17 November 2023
Decided: 14 February 2024
Published: Yes
Fine: N/A
Parties: Millie Namasaka vs. Platinum Credit & Premier Credit
Case No.: 2380 of 2023
Appeal: N/A
Original Source: ODPC
Original contributor: MZIZI Africa

Contents

  1. Summary
    1. Facts
    2. Holding
  2. Comment
  3. Further resources
  4. The Decision

Summary

Platinum Credit (the “1st Respondent”) failed to demonstrate that they took all reasonable measures to ensure their agents complied with the Data Protection Act's provisions. Their agents continued calling the Complainant about their products and ignored repeated requests to stop.

Facts

Millie Namasaka (the “Complainant”) alleged that Platinum Credit & Premier Credit (the “Respondents”) by themselves or through their agents called her constantly over their loan products.

She further alleged that they refused to stop the calls even after she went to the Respondent's offices to request that they don't call her anymore.

The 1st Respondent identified certain callers as an employee (team leader) and certain of their independent sales agents.

They averred that the sales agents had been trained on data protection requirements, but had acted outside expectations. The 1st Respondent did not provide proof of the training undertaken by its agents as alleged. The 1st Respondent also averred that they had since terminated the services of the agents even as the team leader is taken through disciplinary action.

The ODPC found that the 1st Respondent had put in reasonable provisions on data protection on agent contracts, but found that only 1 agent’s contract was terminated by the Respondent, which negated their averments as to the reason for termination.

The Office also found that the 2nd Respondent not only trained its agents on data protection laws, but also released all of them from their contracts once they became aware of this incident.

Holding

The ODPC held that: