Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged that the Respondent contacted him regarding a loan he was not a party to. The Respondent listed him as a guarantor without his knowledge or consent, and sent him numerous messages. The Data Commissioner found the Respondent violated the Complainant's right to be informed under Section 26(a) of the Data Protection Act, 2019 and issued an enforcement notice against them.

Facts

The Complainant alleged that the Respondent was contacting him regarding a loan for which he was not a party and to which he had not consented to be listed as a guarantor.

The Complainant received numerous calls and messages from the Respondent, who was attempting to collect a loan from one of their customers. The Complainant stated that he was receiving around 15 messages per hour.

The Respondent was non-responsive to the Notification of Complaint and did not respond to the Notice of Complaint. Therefore, the allegations against the Respondent remain uncontroverted.

The Office found that the Complainant's right under Section 26(a) of the Act was violated by the Respondent. The Respondent collected the Complainant's data from a third party and did not inform him that his personal data was being collected . They did not provide the Complainant with an opportunity to consent to the listing of his mobile phone number for the purpose of being listed as a guarantor.

Additionally, the Respondent failed to fulfil its obligations under Section 29 of the Act by failing to inform the Complainant of his rights.

Legal Provisions Reviewed

• Article 31(c) and (d) of the Constitution of Kenya: provides for the right to privacy.
• Section 8(1)(f) of the Data Protection Act, 2019: provides that the Office can receive and investigate any complaint by any person on infringements of the rights under the Act.
• Section 56(1) of the Act: provides that a data subject who is aggrieved by a decision of any person under the Act may lodge a complaint with the Data Commissioner.
• Regulation 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021: states that the Data Commissioner shall, upon the conclusion of the investigations, make a determination based on the findings of the investigations.
• Section 26(a) of the Act: provides for the right to be informed of the use to which a data subject's personal data is to be put.