Microfinance lender Platinum Credit has been ordered to pay a Kenyan mobile subscriber Sh400,000 for repeatedly sending unsolicited promotional messages and calls without his consent.
The Office of the Data Protection Commissioner (ODPC) said the digital credit provider was found liable after Samuel Waweru filed a complaint on November 27, 2024, accusing Platinum Credit of persistently contacting him with loan advertisements without his knowledge or authorisation.
The ODPC found Platinum Credit in violation of Article 31 of the Constitution, which protects the right to privacy, as well as several provisions of the Data Protection Act governing the lawful processing of personal data.
Data Commissioner Immaculate Kassait. The Office of the Data Protection Commissioner (ODPC) found Platinum Credit liable of breaching Samwel Waweru's privacy.
Photo credit: File | Nation Media Group
“The Respondent is hereby ordered to pay the Complainant Sh400,000 as compensation; an enforcement notice is hereby issued to the Respondent,” Data Commissioner Immaculate Kassait said in her determination.
The ODPC also recommended the prosecution of Platinum Credit’s directors for providing “false or misleading” information to the regulator during the investigation.
“A recommendation for prosecution is hereby made against the Respondent's directors for furnishing to the Data Commissioner information which they knew to be false or misleading, an offence under Section 57(3) as read with Section 73 of the Act,” Ms Kassait said.
The directors could face penalties of up to Sh3 million or jail terms of up to 10 years, or both.
Kenyan mobile phone users have recently raised concerns over a surge in spam and unsolicited trivia alerts, quizzes, motivational quotes, betting platform notifications and digital lending offers.
Last month, the Communications Authority of Kenya (CA) acknowledged the rising anger, calling the matter a priority.
“We have also noted consumer frustration over spam messages, unsolicited subscriptions, unauthorised use of phone numbers and unauthorised premium services,” the CA said in a statement. “These concerns are a priority for the Authority.”
Per the Data Protection Act, data controllers must only send direct marketing messages if they collected the customer’s data legally, notified them that marketing is a purpose of collection, obtained consent, and provided a working opt-out mechanism.
The law also requires marketers to include clear contact information through which consumers can request that the communications stop, without incurring charges.
Consumers also have the right to ask a data controller not to process their data for all or part of a specific purpose, including direct marketing.
“A data subject may request a data controller or data processor not to process all or part of their personal data, for a specified purpose or in a specified manner, such as direct marketing purposes,” the Act states.
An aggrieved mobile subscriber can complain to the ODPC through an online submission, and the ODPC investigates within 90 days.
