Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

A financial institution was held to have violated the accuracy principle of the DPA19 and ordered to rectify the details of its customer or face enforcement action.

Facts

Koros Kiprotich (the “Complainant”) accessed a loan facility issued by the Higher Education Loans Board (the “Respondent”). The Complainant averred that notwithstanding his full repayment of the loan facility, the Respondent failed/neglected to update his records on its portal which showed that he was in default.

The Respondent denied that its records are inaccurate. The Respondent indicated that the Complainant had a default history which had been subsequently regularised and that this fact of default would continue to appear in its reports as part of the transaction history. The Respondent confirmed that the account had been regularised when the loan was cleared by the Complaint and averred that it had updated its records to reflect that position. The Respondent attributed the error to the Credit Regerence Bureaus (CRB) who had failed to update their records in keeping with the new status on time. It also indicated that the CRB portals would continue to highlight the default history in future reports notwithstanding the regularisation of the account.

Upon review, the ODPC confirmed that the Respondents had in fact not updated the Complainants records in their system as averred, which information was reflected in the CRB statements as reporting agents as well.

Holding

The following are the findings:

• The Respondent had an obligation to ensure the accuracy and correctness of the Complainants personal data. The Respondent failed to ensure the accuracy and correctness of the data held by them which caused the miscommunication and in so doing violated the provisions of the DPA19.
• The Respondent also has a duty to promptly correct any inaccuracies in personal data held by them when notified which they did not do and in so doing violated the provisions of the DPA19.

In the circumstances, the ODPC held that the Respondent must rectify or update the Complainants records within seven (7) days of the ruling failing which an enforcement notice to issue.

Comment

The full text of the ruling is available below.

Further resources