DR. MAXWEL OKOTH VERSUS AZURA CREDIT LIMITED
1. Introduction
This complaint is brought by Dr. Maxwel Okoth against Azura Credit Limited on the receipt of insistent calls demanding repayment for a loan he had no prior knowledge of, and threats to list him as a defaulter with the Credit Reference Bureau. This action is in conflict with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was contacted by the Respondent informing him they got his contact from a customer who owes them money. The Respondent demanded repayment despite him having no prior knowledge of the loan, and threatened to list him as a defaulter with the Credit Reference Bureau.
3. Analysis of Evidence
Complainant’s Position
- Received incessant calls from the Respondent informing him they got his contact from a customer who owes them money
- The Respondent demanded repayment despite him having no prior knowledge of the loan
- Was threatened with being listed as a defaulter with the Credit Reference Bureau
- Provided screenshots of his call logs as proof
Respondent’s Defense
- Operates its business in line with the law and industry best practices for data security and privacy
- Does not intentionally or systematically call persons with no loans
- Only contacts clients who are in default of their loan repayment
- Confirmed mobile number 0717*****13 belongs to it and was used by its agent
- Reached out to the Complainant and his data has been deleted
- Relies on consent and performance of a contract as the legal bases for processing
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent had obligations to fulfil under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent contacted the Complainant regarding a loan he was not a party to, without informing him of the use of his personal data.
- The Respondent threatened to list the Complainant as a defaulter with the Credit Reference Bureau despite him not being a debtor.
- The Respondent obstructed the ODPC investigation.
- An Enforcement Notice is issued against the Respondent.
- A recommendation for prosecution is made against the Director(s) of the Respondent’s Company for obstruction.
Orders:
- Compensation of Ksh 250,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- A recommendation for prosecution is made against the Director(s) of the Respondent’s Company for obstruction of the Data Commissioner.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Digital Lender Accountability
- Establishes that digital lenders cannot contact individuals who are not party to loans without consent
- Threatening to list non-debtors with CRB constitutes a violation of data protection rights
Broader Impact: This case underscores the high cost of regulatory non-compliance for digital lenders. Beyond compensation orders, obstruction of investigations triggers prosecution recommendations, a consequence that extends liability from the corporate entity to individual directors and fundamentally alters the risk calculus for non-compliant lenders.