Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Alfred Kande Tallam complained Ukristo Na Ufanisi Sacco sent loan demand messages meant for others and refused data erasure. The Sacco unlawfully processed his data for marketing and violated erasure rights. They were ordered to stop messages, remove his number, and pay KES 500,000 compensation.

Facts

The Complainant, Alfred Kande Tallam, alleged that he had been receiving loan payment demand messages addressed to one of the Respondent's customers, despite having repeatedly requested the Respondent to stop sending these messages

He stated he called the Respondent to ask them to delete his number from their database, contacted them via X (formerly Twitter) with screenshots, and also contacted the Sacco Societies Regulatory Authority (SASRA) for assistance. He blocked the Respondent's messages and requested Safaricom PLC to block them, but the messages persisted9

He also feared "wrongful attachment of his assets" due to the default. He sought immediate stoppage of messages, removal of his number from the Respondent's database, and KES 6,000,000 as compensation for distress, mental anguish, and embarrassment.

The Respondent, Ukristo Na Ufanisi Sacco Ltd, stated they had no knowledge of and made no admission to the allegations in their totality. They claimed to be learning for the first time that the Complainant was the registered owner of the mobile number they used to contact their borrower, Mr. M***** M****** N*****.

They explained that a requirement for credit facilities is that borrowers provide contact details for various reasons, including demanding repayment. They averred that the borrower voluntarily provided the Complainant's mobile number in the Membership Registration Form and Loan Application Form, and they had no reason to believe it was incorrect.

They also stated there had been no written correspondence notifying them of a change in ownership of the mobile number. Upon receiving the complaint notification, they sought clarification from the borrower and committed to cease and desist from further communication to the borrower using the subject mobile number pending clarification. They added that the borrower later clarified that the number provided in the registration form was not his.

The ODPC found that the Respondent's customer erroneously provided the Complainant's mobile number during registration and loan application. Despite the Complainant's repeated requests to stop (via calls, Twitter, and formal erasure request), the Respondent continually sent demand messages. The Respondent failed to comply with Regulation 8(3) of the Data Protection (General) Regulations, 2021, which requires data controllers to cease processing upon objection within 14 days.

This intentional and/or negligent processing violated the Complainant's right to privacy under Section 26(c) of the Act. The Respondent also failed to act on the Complainant's exercise of his right to erasure under Section 40(1)(b) of the Act and Regulation 12(3) of the General Regulations, continuing to send messages even after the request.

• Evaluation of Applicable Laws

Holding

The ODPC found the Respondent liable for violating the Complainant's right to object to processing personal data and his right of erasure. The Respondent was ordered to pay the Complainant KES 500,000 (Kenya Shillings Five Hundred Thousand) as compensation for distress, mental anguish, and embarrassment caused.