DONALD MKALA NGOLO VERSUS PLATINUM CREDIT LIMITED
1. Introduction
The dispute in this matter concerns Donald Mkala Ngolo’s grievance against Platinum Credit Limited on the repeated processing of his personal data for marketing purposes without his express consent, and the failure to act on his erasure request. This action is in contravention of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant received repeated marketing phone calls from agents of the Respondent. He submitted a request for erasure on 21st May 2024, which was acknowledged, but the calls persisted. The Respondent’s agents continued to call him with marketing and promotional messages despite his request for cessation and erasure.
3. Analysis of Evidence
Complainant’s Position
- Received repeated marketing phone calls from agents identified as representing the Respondent
- Filled and submitted the Respondent’s request for erasure form on 21st May 2024
- Received acknowledgement of the erasure request on the same date
- Wrote to the Respondent to cease and desist, but the calls persisted
- Provided screenshots of call logs, the erasure form, and correspondence as proof
Respondent’s Defense
- Initiated internal investigations and claimed the Complainant is not and has never been its customer
- Engages independent sales agents to market its products
- Identified two phone numbers as belonging to one contracted sales agent and initiated disciplinary process
- Claimed the second number was not registered to any contracted agent and reported the matter to the police
- Submitted an Independent Sales Agent Agreement which the ODPC found deficient
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act
5. Final Determination
The Data Commissioner found:
- The Respondent processed the Complainant’s personal data for marketing without obtaining his express consent.
- The Respondent failed to act on the Complainant’s erasure request despite acknowledging receipt.
- The Respondent’s agreement with its sales agents was deficient and did not meet regulatory requirements.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 1,000,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Controller Liability for Agents
- Establishes that data controllers remain liable for the actions of their contracted agents
- Disciplinary action against agents does not absolve the controller of liability
Right to Erasure and Consent
- Reinforces the obligation of data controllers to act on erasure requests
- Marketing calls without express consent constitute a violation
Broader Impact: This decision cuts through the common corporate defence of blaming independent agents for data protection violations. It affirms that principals cannot insulate themselves from liability by outsourcing marketing functions, and that the failure to act on erasure requests is a violation regardless of whether the erasure request was acknowledged.