Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Samuel Waweru complained of unsolicited promotional calls and messages from Platinum Credit Ltd's agent despite no prior engagement or consent. The respondent initially denied knowing the applicant but later stated the agent's actions were within their mandate. The ODPC found the respondent processed the data without express consent for commercial purposes. The final ruling held them liable, ordered KES 400,000 compensation, and recommended prosecution of directors for providing false information.

Facts

The Complainant alleged receiving unsolicited text messages and calls from the Respondent or its sales agent/representative promoting its loan products without his knowledge/authorisation.

He further alleged that upon questioning the sales representative about the source of his personal data, the sales representative told him that the organisation's management routinely shared such data with the sales team for them to contact and advertise the Respondent's products to potential customers.

The Complainant stated that he had never interacted/engaged with the Respondent in any business or communication and did not consent for his personal data to be collected, stored, or shared by the Respondent.

The Respondent stated that upon thorough investigation, it confirmed that the Complainant has never been a customer of its company, and thus, it does not have his information or data stored in its database.

They stated that they conducted a comprehensive internal investigation to identify the source of the communications, and the investigated mobile number (07xxxxxx63) registered to a person identified as V***** by the Complainant is neither associated with its agents nor registered to its employees. The Respondent blanketly denied all the allegations fronted against it and denied knowing Vivian at all. They maintained that all material times relating to the complaint, V***** was an agent with the Respondent and that all her actions were within the definitions of the Act and therefore, obligations pursuant to the Act. They further explained the hierarchy and operation of their sales teams.

The ODPC established that:

• the Complainant received unsolicited promotional calls and messages from a sales representative of Platinum Credit Limited.
• V***** was indeed working for the Respondent as a sales agent during the material period and had contacted the Complainant to market the Respondent’s products.
• the Respondent obtained and processed the Complainant’s personal data for commercial purposes without obtaining his express consent.
• The Respondent failed to demonstrate that they obtained the Complainant’s express consent before sending promotional messages.
• the Respondent unlawfully processed the Complainant’s personal data for commercial interest or purpose without his express consent, thereby contravening the provisions of the Data Protection Act.