Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Sharamo Wario Issacko complained Platinum Credit Limited sent unsolicited loan marketing calls and messages without consent. The Respondent blamed impersonators but admitted a manager contacted him unlawfully once. The ODPC found a violation of the right to be informed and ordered KES 50,000 compensation.

Facts

The Complainant alleged that the Respondent sent him unsolicited promotional messages and calls without his consent. He stated that these communications began in 2022, shortly after he was employed by the Public Service Commission, and focused on offering check-off loans to civil servants. Despite lodging a formal complaint at the Respondent's head office in March 2023 and receiving assurances that his details were erased and staff disciplined, the communications resumed. He described a distressing incident where he received a marketing call during Friday prayers at a mosque. Despite multiple interactions with the Respondent's Sales and Marketing Manager, the situation repeatedly reverted to a state of continuous harassment from different phone numbers.

The Respondent contended that a thorough investigation revealed the Complainant was never a customer and his data was not in their database. They investigated five phone numbers provided by the Complainant and established that four of them were not registered to their staff or agents, concluding that individuals were impersonating their brand. They reported these impersonators to the police. However, the Respondent admitted that one number belonged to their Sales and Marketing Manager, who had contacted the Complainant in 2022. They asserted that the manager had since issued a personal apology, deleted the number, and undergone extensive data protection training. They further claimed that any interactions in 2024 and 2025 were initiated by the Complainant regarding his concerns about unsolicited contact.

The Office of the Data Protection Commissioner reviewed the matter based on the rights of the data subject:

1. Violation of the Right to be Informed - The Office found that the Respondent failed to provide information on how they obtained the Complainant's contact details. The admission that their manager contacted the Complainant proved he was not informed of the purpose of the collection of his data, which violated Section 26(a) of the Act.
2. Right to Object - Although the Complainant objected multiple times, the Office found the right to object was not violated. This was based on evidence that the Sales and Marketing Manager had issued an internal warning to staff on 26th August 2024 not to contact the Complainant.
3. Remedies - The Office acknowledged that the Complainant suffered distress but also took into account the Respondent's mitigation efforts, such as reporting impersonators to the police and the manager's personal apology.

• Legal Provisions Reviewed

Holding

The Data Commissioner, Immaculate Kassait, delivered the following determination on 27th July 2025:

• The Respondent was found liable for infringing the Complainant's rights.