ERIC MBOGO VERSUS PLATINUM CREDIT LTD
1. Introduction
The dispute in this matter concerns Eric Mbogo’s complaint against Platinum Credit Ltd on the continued processing of his personal data for marketing purposes after loan settlement, and the sharing of his data with a third party without his consent. This action is in breach of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant had cleared a previous loan with the Respondent, but the Respondent continued processing his data and contacted him regarding a new loan facility without his consent. The Respondent’s staff marketed a car loan, booked a valuation without his knowledge, and shared his data with a third-party valuer without notifying him. Despite his objection via email, the Respondent continued contacting him.
3. Analysis of Evidence
Complainant’s Position
- On 26th and 30th July 2024, the Respondent’s staff called him regarding loan facilities he had not requested
- He received calls from mobile phone numbers +254714***68 and +254726***24
- The Credit Officer and Manager marketed a car loan facility and booked a car valuation without his consent
- He had cleared his previous loan and his account was dormant
- Exercised his right to object via email on 6th August 2024, requesting the Respondent not to market anything to him
- On 30th August 2024, he was still contacted by the Respondent’s agent
Respondent’s Defense
- Confirmed the Complainant’s contact details were in its database as a dormant client
- Claimed the Complainant had expressed interest in taking a subsequent loan
- Relied on Clause 9 of the Loan Agreement which provided explicit consent for continued holding and processing of his data, including for marketing
- Upon receiving the complaint, promptly contacted the Complainant and removed his personal data from its systems
- Stated it is committed to ensuring compliance with the Act
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent continued marketing to the Complainant after he had exercised his right to object.
- The Respondent shared the Complainant’s personal data with a third-party valuer without his knowledge or consent.
- Consent in a loan agreement does not override the absolute right to object to direct marketing.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 500,000 to the Complainant.
- The Respondent is directed to stop marketing its products to the Complainant.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to Object and Direct Marketing
- Reinforces that the right to object to processing for direct marketing is absolute
- Data controllers must comply with objection requests within 14 days
Duty to Notify Third-Party Sharing
- Establishes that data controllers must notify data subjects when sharing personal data with third parties
- Sharing with external valuers requires prior notification
Broader Impact: This decision underscores that marketing consent embedded in loan agreements does not survive loan settlement nor override a data subject’s objection. Financial institutions across Africa must recognize that the right to object to direct marketing is absolute and cannot be contracted away.