Background
In Kennedy Wambugu v Whitepath Company Limited, the Complainant alleged that the Respondent, unlawfully collected and processed his telephone number for purposes of debt recovery, despite the fact that he had not taken any loan with the Respondent.
Specifically, the Complainant stated that he received multiple communications from individuals purporting to be representatives of the Respondent, claiming that he owed money purportedly borrowed through two digital loan applications: Sunlit Cash and SmartPesa. He further stated that the Respondent escalated the matter by contacting his employer and accusing the Complainant of fraud. Despite making several requests for clarification and particulars of the purported loan, the Respondent failed, neglected and/or refused to furnish him with the requested information.
Respondent’s Response
Determination by the Data Commissioner:
The Data Commissioner held as follows:
- Section 25 of the Data Protection Act, 2019 requires every data controller or data processor to ensure that personal data is processed lawfully, fairly and in a transparent manner.
- Section 28(1) of the Act provides personal data must be collected directly from the data subject, unless the data controller or processor can demonstrate that indirect collection is necessary under the exemptions listed in section 28(2) of the Act.
- Section 28 (3) mandates that a data controller or processor must collect, store or use personal data for a purpose which is lawful, specific and explicitly defined. Further, Section 30 sets out the permitted lawful bases for processing of personal data.
- The Data Commissioner found that:
- the Respondent contacted the Complainant on several occasions in an attempt to recover an alleged loan facility
- the Respondent failed to produce any evidence that the Complainant was a borrower, account holder, beneficiary guarantor or otherwise legally connected to the alleged loan facility and failed to provide any lawful explanation for pursuing recovery against him.
- the Respondent communicated with the Complainant’s employer and made inconsistent and varying representations, distinct from a financier-loanee relationship, in an apparent attempt to recover the alleged debt.
- the Respondent failed to demonstrate that it had a lawful basis for the collection, processing, sharing or disclosure of the Complainant’s personal data with third parties in accordance with the Act and the Regulations.
- Contrary to sections 29 and 26(a) of the Act, the Respondent did not provide any documentary or other evidence to showing how the Complainant’s personal data was obtained, the lawful basis relied upon for such collection and processing, or that the Complainant was informed of the processing. Further, despite several attempts by the Complainant to obtain clarification from the Respondent regarding the source, purpose, and justification for the collection and continued processing of his personal data, the Respondent failed to provide the requested information.
- Having found the Respondent liable for unlawful processing of the Complainant’s personal data, the Data Commissioner directed the Respondent to compensate the Complainant in the sum of Kenya Shillings Three Hundred and Fifty Thousand (Kes. 350,000/=).
