ODPC COMPLAINT NO. 0815 OF 2023
1. Introduction
This case involves complaints filed against Deltech Capital Kenya Limited (trading as MyKes) for alleged violations of the Data Protection Act, 2019. The complaints pertain to unauthorized collection of personal data, unwarranted communications, and improper debt collection practices involving third parties.
Table of Contents
2. Nature of Complaint
The complainants alleged that the Respondent:
- Made unwarranted calls and sent text messages demanding payments for loans not borrowed or already settled
- Contacted third parties to make loan payments without their consent
- Failed to properly notify data subjects about collection and processing of their personal data
- Accessed phonebook contacts without proper consent mechanisms
3. Analysis of Evidence
Complainants’ Position
- Provided screenshots of unwanted messages and call logs as evidence
- Demonstrated they were contacted about loans they never guaranteed
- Expressed concerns about potential damage to credit scores
- Raised mental health concerns due to harassment
Respondent’s Defense
- Admitted ownership of MyKes but denied liability for Flytech app
- Claimed only accessing emergency contacts and referees/guarantors
- Admitted contacting some complainants as both spouse and referee
- Attributed some contacts to a “system error”
- Provided some documentation including data flow diagrams and contracts
4. Issues for Determination
- Whether the Respondent collected and processed contacts data in accordance with Section 25 of the Act
- Whether the Respondent fulfilled the duty to notify under Section 29 of the Act
- Whether there was infringement of the Complainants’ rights as data subjects
5. Final Determination
The Data Commissioner found:
- The Respondent liable for violating data protection principles
- No proper consent was obtained from complainants
- Failure to notify data subjects about data collection and processing
- Infringement of complainants’ rights under Section 26 of the Act
Orders:
- Issuance of an Enforcement Notice against the Respondent
- Parties retain right to appeal to the High Court
6. Significance and Impact
Digital Lending Practices
- Clarifies requirements for consent in digital lending platforms
- Sets boundaries for contacting third parties in debt collection
Data Collection
- Reinforces prohibition against accessing phonebook contacts without explicit consent
- Mandates transparent disclosure of data collection purposes
Third Party Rights
- Affirms protection for individuals wrongly contacted as guarantors
- Establishes accountability for improper debt collection practices
Broader Impact: This ruling sets important precedents for Kenya’s digital lending sector, particularly regarding consent requirements, third-party communications, and proper data handling practices in financial services.
For full determination, click 🗃️
