ODPC COMPLAINT NO. 0646/2023 (CONSOLIDATED WITH NO. 0719/2023)
1. Introduction
This consolidated case involved complaints by Eric Migwi and Scholastica Onon against Whitepath Company Limited for unlawful processing of personal data through unsolicited loan guarantee messages.
Table of Contents
2. Nature of Complaint
- Complainants received unsolicited messages demanding loan repayments
- Alleged unauthorized access to phone contacts by lending company
- No prior consent obtained for processing personal data
- 1st complainant’s allegations remained uncontested by respondent
3. Respondent’s Position
- Admitted contacting 2nd complainant as emergency contact
- Claimed notification system for emergency contacts existed
- Stopped communications after complaint filed
- Failed to respond to 1st complainant’s allegations
- Asserted general privacy policy compliance
4. Issues for Determination
- Whether personal data was lawfully processed
- Whether respondent proved valid consent
5. Legal Analysis
- Burden of Proof: Respondent failed to demonstrate valid consent (Section 32 DPA)
- Consent Definition: No “express, unequivocal, free, specific and informed” consent shown
- Processing Basis: No lawful basis established under Section 30 DPA
- Emergency Contacts: System inadequate to prove affirmative consent
6. Final Determination
Findings:
- Respondent found liable for unlawful data processing
- Enforcement notice to be issued against Whitepath Company
- Right of appeal to High Court preserved
For full determination, click 🗃️
