Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Njeri Jomo complained of over 2,000 collection calls for an unknown loan using her number without consent. The ODPC dismissed the complaint as the calls were unlinked to the Respondent. However, the ODPC recommended prosecuting Azura Credit Limited's Directors for obstructing investigations by denying access to their database.

Facts

Njeri Jomo (the Complainant) filed a complaint on 3rd July 2024 alleging that she had been receiving incessant calls from Azura Credit Limited (the Respondent) regarding a loan she was not a party to.

The key facts and evidence presented were that she had not consented for her mobile number to be listed and used as a reference number for the loan. She provided screenshots of her call logs as proof, showing she was receiving incessant calls from a lady claiming to represent the Respondent. The calls originated from the mobile phone number 0754 and were received daily at 12:45 PM. The caller alleged that a member of the Complainant's staff, named D, had borrowed money from the Respondent and provided her number as a reference. Despite repeated requests to cease, she was met with insults and threats from the caller. The Complainant claimed to have received over 2,000 calls, which severely impacted her ability to use her phone. She requested that the calls stop, her personal information be deleted from the Respondent's records, and appropriate sanctions be imposed on the Respondent.

Azura Credit Limited’s primary points were that they operate their business based on the law and industry best practices for data security and privacy. They averred that they do not intentionally or systematically call persons with no loans, and harassment allegations via mobile phone calls were new to them. They claimed they only obtain client's information during the registration process and cannot contact any person who has never borrowed a loan. They stated the only authorized time to call a client is when they are in default of their loan repayment. Their policies state that a client's personal data obtained during the debt application process will not be disclosed or communicated to any third party. The Respondent claimed to have conducted an investigation with Safaricom and confirmed that the number 0754 that contacted the Complainant belongs to a person named P K*****, who is not associated with the Respondent and has never been its employee. They requested the Office to conduct further investigations.

The ODPC conducted investigations, including a site visit to the Respondent’s premises on 30th August 2024.

The findings were:

• Call Attribution: The screenshots provided by the Complainant could not directly link the mobile phone number (07******54) to the Respondent or its agents.
• Database Search: The ODPC sought to examine the Respondent’s database to verify if the Complainant's personal data was present.
• Obstruction: The Respondent derailed and hindered the investigations by claiming that the ICT personnel with access to the backend of its database was not available to facilitate an examination of the loan application data.
• Legal Violation: The Respondent's denial of access to the backend database amounted to obstruction of the Data Commissioner contrary to Section 61 of the Act.
• Lack of Evidence: Investigation Officers visited the premises and conducted a search on the Respondent's front-end side of the database. No evidence was found that the Complainant’s personal data or the mobile phone number that contacted the Complainant belonged to the Respondent.