Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Donald Mkala Ngolo complained Platinum Credit sent unsolicited marketing calls/messages and refused data deletion. Platinum Credit unlawfully processed data, used non-compliant agents, and failed to uphold data accuracy. They were ordered to delete his data and pay KES 1,000,000 compensation.

Facts

The Complainant, Donald Mkala Ngolo, alleged that the Respondent, either directly or through its agents, repeatedly called his phones with marketing and promotional messages despite his repeated statements that he was not interested in their service and that his number should be deleted. He attempted to stop the calls by filling out and submitting a data erasure request form on 21st May 2024, which the Respondent acknowledged receiving. He also sent a written request for them to cease and desist from contacting him without his consent, but the marketing calls persisted, leading to his complaint with the ODPC.

The Respondent, Platinum Credit Limited, stated that their internal investigations found the Complainant was not and had never been their customer, and they could not trace his information in their database. They claimed to engage independent sales agents who are mandated to obtain explicit consent before marketing products. They identified two phone numbers used to call the Complainant as belonging to one of their contracted sales agents, against whom disciplinary action, including termination, was initiated They pleaded that a third number was not registered to any contracted agent and was reported to the Central Police Station for investigation.

The ODPC found that the Independent Sales Agent Agreement submitted by the Respondent was deficient and could not be recognized as a lawful data processing contract under Regulation 24 of the Data Protection (General) Regulations, 20215.... The ODPC determined that the independent sales agents were acting on behalf of the Respondent, making the Respondent responsible for establishing a lawful basis for processing the Complainant's personal data for commercial purposes. The Respondent continually called the Complainant without his consent and failed to demonstrate that they had collected his personal data with consent or provided a simplified opt-out mechanism, violating Section 37(1) of the Act**.**. The Respondent also violated the Complainant's right to object to processing and his right to erasure (Section 26 of the Act) by failing to act on his requests to cease communication and delete his data.

• Evaluation of Applicable Laws

Holding

The ODPC found the Respondent liable. The Respondent was ordered to compensate the Complainant KES 1,000,000 (One Million Kenya Shillings). An enforcement notice was ordered to be issued against the Respondent under Section 58 of the Act and Regulation 16 of the Enforcement Regulations. Parties have the right to appeal this determination to the High Court of Kenya within 30 days

Comment

The full text of the ruling is available below.

Further resources

Share blogs or news articles here!

The Decision