Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Eric Mutune Mwamwe alleged Rosky Credit unlawfully processed his data by sending unsolicited marketing messages without consent or subscription. The Data Commissioner found Rosky Credit liable for violating the right to be informed (Section 26(a)) and ordered the payment of KES 20,000 compensation.

Facts

The Complainant lodged his complaint on March 15, 2025, asserting that the Respondent sent him unsolicited text messages marketing their services without his consent and despite him never having subscribed to any of their services. The Complainant alleged that the Respondent sent these marketing messages to his phone number with the intention of attracting him into their business. He contended that he had never been a customer and did not give express consent for the marketing messages. The Complainant argued that this action constituted a serious infringement of his data rights, specifically citing violations of Sections 26, 29, and 37 of the Data Protection Act. He further noted that the Respondent failed to notify him at the time of collecting his personal data and never sought his express consent for the data’s commercial use. As a remedy for the alleged actions, the Complainant sought compensation of Kenya Shillings Six Million (KES 6,000,000).

The Respondent submitted its response to the notification of the complaint on May 8, 2025. Rosky Credit Limited stated that it is engaged in credit financing and generally promotes its products through appointed agents and employees. The Respondent contended that their agents, during marketing activities, maintain records of persons who express interest in their products and indicate a willingness to receive further information. Specifically, the Respondent claimed that the Complainant had voluntarily provided his personal details to one of its agents, whose contact was included in the message. They asserted that during this interaction, the agent clearly explained the purpose of collecting the data, and the Complainant consented to receive a one-time marketing message. Furthermore, the Respondent noted that the message in question was sent in 2023, and the Complainant had not raised any concern for nearly two years. They also observed that the Complainant initially demanded KES 400,000 in March 2025 before the company could issue a formal response, after which the complaint was lodged.

The Office of the Data Protection Commissioner (ODPC) determined that the central issue was whether the Respondent violated the Complainant’s rights under the Act. The investigation focused on the right to be informed under Section 26(a) of the Data Protection Act, which requires data controllers to inform individuals about the specific purposes for which their data is being collected or processed.

The ODPC found that the Respondent, acting through its agent, processed the Complainant’s personal data for marketing purposes without adequately demonstrating that the Complainant was properly informed in accordance with the legal standard. Crucially, while the Respondent asserted that verbal notification and consent were provided, the ODPC noted that no verifiable evidence was produced to support this claim. The Data Commissioner concluded that the Respondent's failure to provide objective and adequate notification at the point of data collection constituted a clear breach of its legal duty under Section 26(a). The ODPC found the Respondent liable under Section 26(a) for failing to inform the Complainant of the intended use of his personal data at the time of collection.

• Legal Provisions Reviewed

Holding

The Data Commissioner made the following final determination:

1. The Respondent (Rosky Credit Limited) was found liable for violating the Complainant’s right to be informed under Section 26(a) of the Act.
2. The Respondent was ordered to pay the Complainant a sum of Kenya Shillings Twenty Thousand (KES 20,000) as compensation for the infringement of his rights under the Act.
3. The Determination noted that parties have the right to appeal this decision to the High Court of Kenya within thirty days.