JEREMIAH MASENGELI VERSUS AZURA CREDIT LIMITED
1. Introduction
The grievance in this matter stems from Jeremiah Masengeli’s complaint against Azura Credit Limited on the receipt of spam emails labeling him in connection with a defaulted loan by an unknown individual, without any lawful basis. This action is in contravention of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant received spam emails of continuous harassment from 24th to 25th September 2024 using different agents and emails with the subject “SUSPECTED FRAUDSTER” for an individual he has no relationship with. Despite warning the Respondent to stop, the emails persisted, disrupting his peaceful working environment.
3. Analysis of Evidence
Complainant’s Position
- Received spam emails of continuous harassment from 24th to 25th September 2024
- The emails were sent using different agents and emails with the subject “SUSPECTED FRAUDSTER”
- The emails were about an individual he has no relationship with
- Warned the Respondent to stop but they refused
- The harassment disrupted his peaceful working environment
- Adduced screenshots of email correspondence and a demand letter as evidence
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to the remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent processed the Complainant’s personal data without a lawful basis.
- The Respondent subjected the Complainant to harassment through spam emails with defamatory labels.
- The Respondent failed to respond to the Complainant’s warnings and the ODPC notification.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- The Respondent is directed to delete the Complainant’s personal data from its systems, stop contacting him, and avail proof thereof to this Office within 7 days.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Duty to Notify and Lawful Processing
- Establishes that data controllers must notify data subjects prior to processing and establish a lawful basis
- Using personal data for third-party debt recovery without consent is unlawful
Harassment by Debt Collectors
- Reinforces that harassing individuals for loans they never took constitutes a serious violation
- Spam emails with labels like “SUSPECTED FRAUDSTER” constitute harassment
Broader Impact: This determination confronts the weaponization of personal data by lenders who use defamatory labels and spam tactics to coerce repayment from non-debtors. It establishes that such practices amount to unlawful processing and harassment, setting a firm deterrent against abusive debt recovery tactics across Africa.