Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Anne Arina complained that BESTCASH T/A Zuri Cash used her information without authorization, receiving incessant calls and messages demanding loan repayment, despite not being a guarantor. As Zuri Cash failed to respond, the Data Commissioner found the company liable for unlawful processing and ordered them to pay KES 200,000/- compensation.

Facts

The Applicant (Complainant), Anne Arina, filed a complaint alleging the unauthorized use of her information by the Respondent. She contended that she had been receiving numerous incessant calls and messages from the Respondent demanding payment related to a third party's loan. She further asserted that she had never guaranteed anyone loans with the Respondent. It was the Complainant's case that she was continuously receiving calls and text messages from the Respondent referring to her as a referee to the Respondent's client who had defaulted in repaying the loan. She argued that she was never informed or consulted by the Respondent when they engaged their client, nor was her consent ever procured to allow them to harass or "spam" her with unwarranted calls. The Complainant requested the ODPC to award her damages for the unlawful sending of the messages and the incessant calls.

The ODPC notified the Respondent of the complaint on 2nd July 2025, requesting a response to the allegations, details on how the Complainant’s personal contact information was used, any contractual or legal basis authorizing the use of her data, and evidence of consent. However, the Respondent was non-responsive and did not respond to the Notification of Complaint. This failure meant the allegations filed against them remained uncontroverted. The ODPC determined the matter pursuant to Regulation 11(2) of the Enforcement Regulations, which allows the Data Commissioner to proceed to determine the complaint when a Respondent fails or neglects to respond.

The ODPC reviewed two primary issues: whether the Respondent fulfilled its obligations under the Act, and whether the Complainant was entitled to remedies.

1. Violation of Data Processing Law: The ODPC found that the Respondent did not fulfil its obligations under the Act. Since the Respondent did not dispute the Complainant's contention that she was not informed prior to being made a guarantor, and failed to provide any evidence to the contrary, the allegations remained uncontroverted. The ODPC concluded that the Respondent did not process the Complainant's personal data lawfully and did not notify the Complainant of the processing of her personal data, thereby failing in its duty as required by Section 29 of the Act.
2. Entitlement to Remedies: The ODPC found that the Complainant was entitled to remedies based on Section 65(1) of the Data Protection Act, which provides for compensation to a data subject who suffers damage by reason of a contravention of the Act. Damage includes financial loss and damage not involving financial loss, such as distress.

• Legal Provisions Reviewed

Holding

The Data Commissioner made the following final determination:

1. The Respondent (BESTCASH T/A Zuri Cash) was found liable.
2. The Respondent was ordered to compensate the Complainant, Anne Arina, the sum of KES 200,000/- (Two Hundred Thousand Kenya Shillings Only).