| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25(4), 26, 29, 30 32 & 41 of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 6, 27 & 29 September 2023 |
| Decided: | 1 December 2023 |
| Published: | Yes |
| Fine: | KES.900,000/- (Kes.300,000/- to each defendant) |
| Parties: | Peter Mbugua & 2 Others vs. Credit Watch Investment Ltd |
| Case No.: | Complaints No. 1835 |
| Appeal: | Yes - Civil Appeal |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Creditwatch Investment Ltd (the “Respondent”) a digital credit provider and proprietor of CloudLoan was found liable for breaching the Complainant’s rights to privacy and the provisions of the DPA19 by listing them as guarantors of loans by third parties, without their knowledge or consent.
Peter Mbugua, Timothy Ngome & Aggrey Timothy (the “Complainants”) filed diverse complaints with the Office of the Data Protection Commissioner alleging that Creditwatch Investment Ltd (the “Respondent”) a digital credit provider and proprietor of CloudLoan, listed them as guarantors of loans by third parties, without their knowledge or consent.
The Respondent theafter contacted the Complainants on different occassions asking them to impose upon the third parties to regularise their outstanding facilities.
In responce the Respondent confirmed that the Complainants were indeed contacted over the outstanding third party loans, but avers that they did so because the Complainants were nominated by the loanees whose duty it was to confirm their acceptance to act as emergency contacts.
The ODPC found that the Respondent violated section 26 by not informing the Complainants of the use of their personal data. They also did not obtain the Complainant’s consent before so doing. The Respondent did not therefore process the personal data for legitimate purposes (to wit, emergency contacts). Further their systems were not designed to protect or promote DPA19 principles.
As a result of the foregoing the ODPC found that the Respondent violated the Complainant's rights to privacy and there was non compliance withe the DPA19.
The ODPC held that: