DAVIES KIARIE CHEGE VERSUS WHITEPATH COMPANY LIMITED
1. Introduction
The dispute in this matter concerns Davies Kiarie Chege’s complaint against Whitepath Company Limited on the unlawful collection and processing of his telephone number to recover a loan he neither took nor was associated with. This action is incompatible with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant received numerous text messages from the Respondent’s agents demanding that he contact an individual to facilitate repayment. One sender dispatched 28 text messages within one hour using threatening, abusive, and inappropriate language. The excessive messaging caused him reputational harm and impaired his ability to perform his professional duties.
3. Analysis of Evidence
Complainant’s Position
- Received texts from numbers 07******2, 0113*****8, 079******3, 0114*****7, and 079******2 regarding a loan taken by an individual
- One sender dispatched 28 text messages within one hour
- Agents used threatening, abusive, and inappropriate language
- Excessive messaging caused reputational harm and impaired his professional duties
- Provided screenshots of the multiple messages with time stamps as evidence
Respondent’s Defense
- Confirmed the Complainant is not and has never been its customer
- Acknowledged the individuals involved were its agents
- Admitted it could not ascertain the source or manner in which the agents collected the Complainant’s personal data
- Could not establish the legal basis for using his telephone number to recover a loan
- Terminated the employment contracts of the agents involved
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act
5. Final Determination
The Data Commissioner found:
- The Respondent’s agents collected and used the Complainant’s personal data without any lawful basis.
- The Respondent failed to supervise its agents, resulting in harassment of the Complainant.
- Terminating agent contracts does not absolve the Respondent of liability.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Controller Liability for Agents
- Establishes that data controllers remain liable for the actions of their agents
- Terminating agent contracts does not absolve the controller of liability
Harassment by Debt Collectors
- Establishes that excessive messaging (28 in one hour) and threatening language constitute a violation
- Data controllers must ensure agents do not harass individuals
Broader Impact: This decision dismantles the common corporate defence of blaming rogue agents for data protection violations. It establishes that data controllers cannot insulate themselves from liability by terminating agent contracts, and must proactively ensure their agents process personal data lawfully and without harassment.