Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

This case concerns a digital credit provider, Credit Watch Investment Limited, which listed individuals as guarantors for loans without obtaining their consent. When the borrowers defaulted, Credit Watch contacted the guarantors demanding repayment. The court found this to be a violation of the Data Protection Act, 2019, specifically the right to be informed about data use. The court upheld the ODPC's decision and the awarded compensation.

Facts

Credit Watch Investment Limited, a digital credit provider, listed the three Respondents as guarantors for loan applicants without their consent. When the borrowers defaulted on their loans, Credit Watch sent text messages and made phone calls to the Respondents, demanding they ensure the loans were repaid. Some messages included threats of unspecified consequences if the loans remained unpaid.

The Respondents filed complaints with the Office of the Data Protection Commissioner (ODPC), alleging a violation of their privacy rights. Credit Watch argued that it was the borrowers' responsibility to obtain consent from the emergency contacts, and they only contacted the Respondents to locate the borrowers.

<aside> 💡

Link to original ODPC Ruling:

Peter Mbugua & 2 Others vs. Credit Watch Investment Ltd - ODPC Complaints No. 1835 | 1626 & 1797 of 2023

</aside>

Issues for Determination by the Court:

• Did Credit Watch fulfill its obligations under the Data Protection Act, 2019? Were the Respondents' rights to be informed about the use of their personal data violated?
• Was the compensation awarded to the Respondents excessive?

Laws Reviewed by the Court:

• Data Protection Act, 2019: Key sections examined included:
  • Section 2: Definitions of "personal data," "data controller," and "data processor."
  • Section 25: Obligation of data controllers and processors to protect personal data.
  • Section 26(a): Right of data subjects to be informed about the use of their personal data.
  • Section 28(1): Requirement for data controllers and processors to collect personal data directly from the data subject.
  • Section 29: Duty to notify data subjects about data collection practices.
  • Section 65(1): Power of the ODPC to order compensation for damages resulting from data rights violations.
  • Section 65(4): Definition of "damage," including financial loss and distress.
• Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021:
  • Regulation 4: Procedure for filing complaints.
  • Regulation 14(3): Authority of the ODPC to order compensation.
• Evidence Act:
  • Section 107: Burden of proof in legal proceedings.
• Civil Procedure Act, Cap 21 Laws of Kenya:
  • Section 27: Costs to follow the event.
• Case Law:
  • Sielle v Associated Motor Boat Co. Ltd E.A. 123: Principles for appellate review.
  • Price & another v Hidler KLR 95: Principles for interfering with judicial discretion.
  • Gitobu Imanyara & 2 others v Attorney General eKLR: Principles for disturbing an award of damages.
  • Mbogo & Another v Shah EA 93: Additional guidance on interfering with judicial discretion.

Holding

The Court dismissed Credit Watch's appeal and upheld the ODPC's determination.

The Court found that Credit Watch violated the Respondents' rights under the Data Protection Act by failing to inform them about the use of their personal data and by collecting their data indirectly.

The Court also held that the compensation awarded by the ODPC was justified and within the legal framework.

Comment

The Court concluded that Credit Watch did not meet its legal obligations regarding data protection and privacy, leading to a breach of the Respondents' rights. The Court's decision reinforces the importance of obtaining proper consent and transparency in handling personal data, particularly in the digital lending industry.