⦁ ODPC says lender unlawfully used Kenyans’ personal data for cold-call marketing and provided false information during investigations
By The Weekly Vision Reporter
Kenya’s data protection watchdog has found a leading digital lender to have unlawfully harvested and used a motorist’s personal data for unsolicited marketing before allegedly providing false information to investigators, prompting recommendations for the criminal prosecution of its directors. In a landmark determination, the Office of the Data Protection Commissioner (ODPC) ruled that Platinum Credit Limited violated multiple provisions of the Data Protection Act, 2019, after it processed the personal information of Samuel Kamau Waweru without his knowledge or consent.
The ruling also accuses the company of supplying false and misleading information during the investigation, a finding that has led the Data Commissioner to recommend criminal proceedings against the company’s directors. According to the determination, Waweru had never been a customer of Platinum Credit and had never shared his telephone number, national identity details or any other personal information with the lender.
Despite this, on 15 November 2024, he received a marketing call from a Platinum Credit sales agent promoting the company’s loan products. During the conversation, the caller referred to details of Waweru’s motor vehicle, raising concerns that the company possessed confidential information about him despite having no prior relationship. Believing his personal data had been obtained and used unlawfully, Waweru lodged a complaint with the ODPC on 27 November 2024, alleging that Platinum Credit had subjected him to unsolicited and unauthorised direct marketing.
When the ODPC commenced investigations, Platinum Credit denied responsibility for the call. The company told investigators that the individual who contacted Waweru was neither its employee nor its agent and further claimed that the telephone number used was not registered to any member of its staff. However, the Commissioner’s technical investigation reached a different conclusion. According to the determination, investigators established a direct link between the telephone number and Platinum Credit, concluding that the caller had been acting on the company’s behalf.
The investigation further found that sales team leaders routinely circulated spreadsheets containing personal information, including names, national identity card numbers and telephone numbers belonging to both customers and non-customers, to sales agents conducting marketing campaigns. The Commissioner found no evidence that the affected individuals had consented to their personal data being collected or used for those purposes. In her determination, Data Commissioner Immaculate Kassait found Platinum Credit liable for multiple violations of the Data Protection Act, 2019, as well as Article 31(c) and (d) of the Constitution, which guarantee every person’s right to privacy.
The Commissioner found that the company had:
- Processed personal data without a lawful basis.
- Used personal information for direct marketing without obtaining consent.
- Failed to demonstrate compliance with the principles of lawful and fair processing.
- Provided false and misleading information to the Data Commissioner during an official investigation.
The Commissioner treated the company’s denial of its relationship with the sales agent not as a simple factual error but as the provision of false information to a regulator in the course of statutory investigations. The ODPC ordered Platinum Credit to pay KSh400,000 in compensation to Waweru for the unlawful processing of his personal data. The Commissioner also issued an enforcement notice requiring the company to comply with Kenya’s data protection laws.
More significantly, the determination recommends that Platinum Credit’s directors be prosecuted under Section 57(3), read together with Section 73, of the Data Protection Act, provisions that criminalise the supply of false or misleading information to the Data Commissioner during investigations. If pursued by prosecutors, the recommendation could expose individual company directors to criminal liability in addition to the sanctions imposed on the corporate entity.
The ruling is expected to reverberate across Kenya’s digital lending sector, where concerns over the collection, sharing and commercial use of personal data have intensified in recent years. Consumer advocates have long alleged that some lenders obtain personal information, including telephone numbers, national identity details and financial records, without the knowledge or consent of the individuals concerned, using the data for aggressive direct marketing and debt recovery.
The ODPC’s determination signals that such practices will face increased regulatory scrutiny and that companies found to have breached the law could face significant financial penalties and potential criminal consequences. The Platinum Credit decision forms part of a broader pattern of increasingly robust enforcement by the Office of the Data Protection Commissioner. In recent months, the regulator has issued several high-profile enforcement decisions against financial institutions over unlawful processing of personal data, including an order directing NCBA Bank to compensate a customer after finding that it had mishandled personal information.
The latest determination sends a clear message that organisations cannot simply deny responsibility when challenged over their data practices. Where regulators establish that false or misleading information has been supplied during investigations, those actions may themselves constitute separate offences under Kenya’s data protection laws, carrying consequences not only for companies but also for their directors and senior executives.
