SALAUDDIN YOUSUF KHAN VERSUS AZURA CREDIT LIMITED & MULLA PRIDE LIMITED
1. Introduction
The dispute in this matter arises from Salauddin Yousuf Khan’s complaint against Azura Credit Limited and Mulla Pride Limited on the receipt of numerous threatening calls and emails regarding a loan he was not a party to, without his consent. This action is in breach of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant, an Executive Director of NextGen Pharmaceuticals (K) Ltd, received hundreds of threatening phone calls per day from 10th August 2024 through his private phone number and the office line, causing him mental anguish and rendering him unable to carry on with his usual business. He was listed as a referee or emergency contact without his consent, and the Respondents ignored cease and desist notices issued by his legal counsel.
3. Analysis of Evidence
Complainant’s Position
- On 10th August 2024, NextGen Pharmaceuticals received emails from representatives of the Respondents alleging that an employee had taken a loan facility which was in arrears
- Despite establishing that the loan was procured by the employee in her private capacity, the Respondents embarked on a campaign to call and threaten the Company and the Complainant
- Received hundreds of threatening phone calls per day for more than one week
- His legal counsel issued two cease and desist notices which were ignored
- Provided screenshots of email correspondences, call logs, and cease and desist notices as evidence
Respondents’ Defense
- The Respondents were non-responsive and did not submit a response to the Notification of Complaint
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondents remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondents fulfilled their obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondents listed the Complainant as a referee without his consent.
- The Respondents subjected the Complainant to hundreds of threatening calls, causing mental anguish.
- The Respondents ignored cease and desist notices issued by the Complainant’s legal counsel.
- The Respondents failed to respond to the ODPC notification of complaint.
- The Respondents are jointly and severally liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 500,000 to the Complainant (jointly and severally against both Respondents).
- The Respondents are directed to immediately stop contacting the Complainant regarding the loan.
- An Enforcement Notice is issued against the Respondents.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Harassment of Employers and Directors
- Establishes that debt collectors cannot harass employers or directors of employees who take loans
- Contacting company directors and threatening them constitutes a serious violation
Joint and Several Liability
- Confirms that multiple respondents can be held jointly and severally liable
- Non-responsive respondents cannot avoid liability
Broader Impact: This ruling confronts the growing practice of digital lenders weaponizing workplace hierarchies by targeting directors and company executives for employee debts. It establishes that such harassment extends beyond individual privacy violations to disrupt business operations, and that multiple lenders cannot evade liability through silence or non-cooperation.