KIPLIMO KIPTUI vs. MULLA PRIDE LIMITED T/A KE-CREDIT
1. Introduction
The case is in respect to the complainant, Kiplimo Kiptui against Mulla Pride Limited t/a Ke-Credit, on the unlawful obtaining of his salary information, threatening messages and calls after loan repayments, tracking of his location and that of his child, and sending of marketing messages without his consent. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant was contacted by a collection agent who obtained his salary details via social media without his consent. The complainant alleged that the respondent unlawfully obtained his salary information, sent him threatening messages and calls even after loan repayments were made, tracked his location including that of his child to the extent of monitoring school drop-offs, and sent him marketing messages without obtaining consent.
3. Analysis of Evidence
Complainant’s Position
- Received a call informing him of his employer and salary details without consent
- Received a message with details of his child’s school drop-off details
- Received threatening messages even after making loan repayments
Respondent’s Defense
- Admitted a collection agent accessed the Complainant’s salary details using social media platforms
- Condemned such unlawful activities
- Stated it had deleted the Complainant’s data and issued an apology
- Failed to provide evidence of written contracts with data processors
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies
5. Final Determination
The Data Commissioner found:
- The Respondent unlawfully obtained the Complainant’s salary details through a collection agent using social media without consent.
- The Respondent tracked the Complainant’s location, including monitoring his child’s school drop-offs.
- The Respondent failed to provide evidence of written contracts with its data processors.
- The Respondent had deleted the Complainant’s data and issued an apology.
Orders:
- Compensation of Ksh 0 to the Complainant.
- The Respondent is directed to delete the Complainant’s personal data from its systems and provide proof within 7 days.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Unlawful Data Collection and Location Tracking
- Data controllers cannot collect salary information via social media without consent
- Prohibits tracking of data subjects and their families beyond the specified purpose
Family Privacy Protection
- Tracking family members, especially children, constitutes unlawful processing of sensitive personal data
- Data controllers must not use location data to monitor data subjects’ families
Broader Impact: This determination addresses serious privacy violations in Kenya’s digital lending sector, including the collection of salary data from social media, real-time location tracking of borrowers and their families, and monitoring of children’s school activities. It establishes that digital lenders cannot use location data beyond its specified purpose.