1. Introduction
This case involves complaints by Annsalome Wangari (1st Complainant) and Jaytie Sichiri (2nd Complainant) against ZeroX Technology Company Limited, a digital credit provider operating AsapKash. The complaints allege violations of data protection rights under the Data Protection Act, 2019, including unauthorized use of personal data and harassment through calls and messages.
Table of Contents
2. Nature of Complaint
The 1st Complainant alleged that representatives of AsapKash demanded repayment for a loan she never took, holding her accountable for a third party’s debt. The 2nd Complainant reported receiving harassing calls and insulting messages after being listed as a guarantor without consent, attaching screenshots as evidence.
3. Analysis of Evidence
Complainant’s Position
- 1st Complainant: Never took a loan from ZeroX but was harassed for repayment.
- 2nd Complainant: Listed as a guarantor without consent, subjected to excessive calls and abusive messages.
Respondent’s Defense
- Admitted contacting the Complainants but claimed their numbers were provided by borrowers as emergency contacts or guarantors.
- Apologized for the excessive communication and stated they took action against the offending agent.
- Failed to demonstrate prior consent or notification to the Complainants regarding the use of their data.
4. Issues for Determination
- Whether ZeroX fulfilled its duty to notify the Complainants of the use of their contact details under Section 29 of the Data Protection Act.
- Whether ZeroX infringed the Complainants’ rights as data subjects under the Act.
5. Final Determination
- The Respondent was found liable for violating Sections 28 and 29 of the Data Protection Act by failing to obtain consent or notify the Complainants before using their data.
- An Enforcement Notice was issued against ZeroX Technology Company Limited.
- Parties retain the right to appeal the decision to the High Court of Kenya.
6. Significance and Impact
Data Collection Practices
- Reinforces the requirement to collect personal data directly from data subjects or with their explicit consent.
- Mandates clear notification of data use purposes at the point of collection.
Digital Lending Sector
- Sets precedent for ethical debt recovery practices, prohibiting harassment of third parties.
- Requires lenders to implement mechanisms for emergency contacts/guarantors to consent or decline involvement.
Consumer Protection
- Affirms the right to privacy and protection from unsolicited communication.
- Highlights accountability for agents’ actions, even if unauthorized by the company.
Broader Impact: This ruling underscores the importance of compliance with data protection laws in Kenya, particularly for digital lenders, and sets clear expectations for transparency and consent in data processing.
For full determination, click 🗃️
