Platinum Credit, a micro-lender in Kenya, has been ordered to pay a penalty of Ksh. 400,000 to a Kenyan citizen. This is after being found guilty of unlawfully processing personal data to send unsolicited loan promotional messages and make marketing calls without consent.
The ruling was issued by the Office of the Data Protection Commissioner (ODPC) following a formal complaint filed by Mr. Samuel Kamau.
Mr. Kamau lodged a complaint with the ODPC, stating that Platinum Credit repeatedly sent him unsolicited marketing calls and text messages promoting their loan products. Crucially, the company was using his personal data, which he asserts he never gave them, and was doing so entirely without his consent. This constituted a breach of his rights under the Data Protection Act (DPA).
During the course of the investigation, the lending company attempted to disassociate itself from the breach. Platinum Credit falsely claimed that the individual who placed the marketing calls was not their agent.
However, the Data Protection Commissioner (DPA), after a thorough investigation, was able to confirm that the caller was, in fact, an agent acting on behalf of Platinum Credit. This finding was central to the Commissioner’s final determination.
Following the findings, the Data Commissioner concluded that Platinum Credit was liable for unlawful processing of personal data. The company was found to have violated the principles of data protection, specifically relating to consent and fair processing.
Consequently, the Commissioner issued the following directives:
- Financial Penalty: Platinum Credit was ordered to pay KES 400,000 in compensation to Mr. Samuel Kamau for the damages suffered due to the unlawful data processing.
- Enforcement Notice: An enforcement notice was issued against the lender, compelling them to comply with the Data Protection Act.
- Prosecution Recommendation: The Commissioner also took the severe step of recommending the prosecution of the company’s directors for providing false information during the investigation, which is a serious offense under the Act.
This landmark decision by the ODPC serves as a strong warning to Kenyan companies regarding the strict requirements for obtaining and processing personal data for marketing purposes.