Summary

Joseph Githinji Kimani, a government employee, alleged that Platinum Credit staff unlawfully accessed his personal data to process a loan without his knowledge, resulting in unauthorised salary deductions. The ODPC found he had applied for the loan himself via USSD. The complaint was dismissed, and no compensation was awarded due to material non-disclosure.

Facts

The Complainant filed his complaint on 22 May 2025 alleging that staff of Platinum Credit Limited had unlawfully accessed and used his personal documents and data to submit a loan application to the State Department for Technical and Vocational Education and Training (TVET) — his employer — without his knowledge or consent. He stated that in April and May 2025, he discovered unauthorised salary deductions upon receipt of his pay slips. He claimed he had never requested the loan, never signed any loan application or agreement with the Respondent, and that the deductions commenced without any prior notice or engagement. He sought a written explanation, immediate refund of the deductions, reversal of the loan balance, compensation for financial loss and distress, and a written guarantee against further unauthorised processing.

The Respondent submitted its response on 8 July 2025 and provided a materially different account of events. It confirmed that the Complainant was in fact an active customer who had applied for and been granted a loan facility on 20 June 2024 through the Respondent's USSD platform, using his own registered mobile number and credentials. The loan had been partially performing, and to regularise the repayment schedule, the Respondent had contacted the Payroll Officer at the State Department to adjust the monthly deduction from KES 4,308 to KES 4,403. Due to a system error on the State Department's end, the original deduction of KES 4,308 erroneously continued to be processed for the month of April. The Respondent stated that it had issued a stop order upon discovery of the oversight, that the payroll officer acknowledged the error, and that funds deducted had been applied to the Complainant's existing loan arrears and were not unlawful or fraudulent.

The Complainant's workstation — Mitunguu National Polytechnic — submitted a statement to the ODPC confirming that the Complainant is employed by the State Department for Technical and Vocational Education and Training, and that the Polytechnic did not originate, forward, or participate in any communications with either Platinum Credit or the State Department related to the complaint. Any letters purportedly associated with the institution that were referenced in the case did not emanate from them.

The ODPC applied Section 26(c), which provides for the right to object to processing of personal data, and Section 36, which provides that a data subject may object to processing unless the data controller demonstrates compelling legitimate interest that overrides the data subject's interests. The ODPC found that the Complainant had willfully consented to the processing of his personal data by applying for the loan via the Respondent's USSD platform. The Respondent had processed the Complainant's data for the specific and legitimate purpose of according a loan facility, with the Complainant's consent as required under Sections 30 and 32 of the Act. The Respondent had further fulfilled its obligations by issuing a stop order on the erroneous deduction and engaging with the State Department's payroll officer to address the error. No violation of the Complainant's right under Section 26(c) was established.

On the question of remedies, the ODPC noted that the Complainant had failed to disclose the existence of an active loan agreement between himself and the Respondent — a material omission that cast doubt on the good faith of the complaint. In light of this, the ODPC declined to award compensation and found that the Respondent had fulfilled its obligations under the Act.

• Legal Provisions Reviewed

Holding

• The Respondent did not violate the Complainant's right to object under Section 26(c) of the Data Protection Act 2019; the Complainant had consented to processing by applying for the loan via the Respondent's USSD platform using his own registered credentials
• The Respondent fulfilled its obligations under the Act: it processed the Complainant's personal data lawfully, fairly, and for a specific legitimate purpose (loan facilitation); it issued a stop order on erroneous deductions caused by a State Department payroll system error; and it engaged the relevant payroll officer to resolve the matter
• The ODPC declines to award compensation, noting the Complainant's material non-disclosure of the existing loan facility — an omission that undermined the good faith basis of the complaint
• The Complaint is dismissed in its entirety
• Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days