Platinum Credit Limited has been ordered to pay Ksh 400,000 to a Kenyan citizen for unlawfully using his personal data to send unsolicited loan promotions, calls, and text messages without his consent.

The decision was issued by the Office of the Data Protection Commissioner (ODPC) following a formal complaint filed by Samuel Kamau.

According to the ODPC, Kamau reported that Platinum Credit “repeatedly sent him unsolicited marketing calls and messages using his personal data without consent,” prompting an investigation into the lender’s data-handling practices.

The complaint, filed on November 27, 2024, accused the company and its agents of persistently promoting loan products despite the complainant never providing his personal details to the institution.

During the probe, the microfinance company initially attempted to absolve itself of responsibility.

The determination notes that the firm “falsely claimed the caller wasn’t their agent,” but evidence obtained by ODPC investigators later confirmed that the individual involved was indeed acting on behalf of Platinum Credit.

Also Read: Sonko, Mutua Feature Among 18 High-Profile Corruption Cases in Court

ODPC Cites Violation of Privacy and Unlawful Processing

The Data Commissioner found the company in breach of Article 31 of the Constitution, which protects the right to privacy, and several provisions of the Data Protection Act, 2019.

According to the ODPC determination, Platinum Credit was liable for “unlawful data processing” after failing to demonstrate how it acquired Kamau’s information or justify the unsolicited communication.

Commissioner Issues Enforcement Notice, Recommends Prosecution

In a strongly worded determination, Data Commissioner Immaculate Kassait faulted the lender not only for privacy violations but also for misleading the regulator.

The ODPC stated it was “recommending prosecution of the Respondent’s directors for furnishing false or misleading information,” an offence under Sections 57(3) and 73 of the Data Protection Act.

The penalty includes:

• Payment of Ksh 400,000 to the complainant as compensation
• Issuance of an Enforcement Notice requiring compliance measures
• Recommendation for prosecution of the company’s directors
• Right of appeal to the High Court within 30 days

Also Read: Drama in Court as Officer Insists He’s Unaware Ruto Is President

Legal Basis Outlined in Determination

The ODPC referenced the Constitution and the Data Protection Act, noting that privacy is a fundamental right and all data processors must comply with established safeguards.

ODPC warns that providing false information to the Commissioner attracts penalties of up to Ksh 3 million or a jail term of up to 10 years.

The ruling notes that the ODPC is mandated to “regulate the processing of personal data and ensure protection of the privacy of individuals.”

Follow our WhatsApp Channel and WhatsApp Community for instant news updates

Court gravel and hand cuffs for illustration purposes. PHOTO/DPP X