CAROLINE MAKAU VERSUS GROLA TECH LTD T/A LIONCASH
1. Introduction
The dispute in this matter concerns Caroline Makau’s complaint against Grola Tech Ltd t/a LionCash on the repeated calls demanding payment for a loan she never obtained, without her consent. This action is in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant received calls from the Respondent demanding payment for a loan taken by N***** W*****, despite her not being the borrower or a guarantor. She was called 27 times on 20th August 2024 and 51 times between 6.13 am and 7.19 am, and she had not consented to be listed as a referee or contact person.
3. Analysis of Evidence
Complainant’s Position
- Received calls from mobile phone number 0794****71 demanding payment for a loan she never obtained
- Was called 27 times on 20th August 2024 and 51 times between 6.13 am and 7.19 am
- She was not the borrower and had not consented to be listed as a referee
- Provided screenshots of her call log as proof
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent listed the Complainant as a referee without her consent.
- The Respondent subjected the Complainant to excessive calls constituting harassment.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Harassment by Digital Lenders
- Reinforces the obligation of digital lenders to obtain direct consent from individuals listed as referees or emergency contacts
- Excessive calls (51 calls in an hour) constitute harassment and a violation of data protection rights
Broader Impact: This ruling confronts the weaponization of personal data by digital lenders who use excessive calls to harass non-debtors. It establishes that silence from regulators does not imply consent, and that lenders who ignore ODPC notifications cannot escape liability through non-cooperation.