JAMES WANGOME NGOCHI VERSUS GROLA TECH LIMITED T/A LION CASH
1. Introduction
The case is in respect to the complainant, James Wangome Ngochi against Grola Tech Limited t/a Lion Cash, on being contacted regarding a loan that he was not a party to and had not consented to be enlisted as a guarantor. This action is in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was contacted regarding a loan he was not a party to and had not consented to be enlisted as a guarantor. He alleged that the Respondent enlisted him as a guarantor without his consent and failed to respond to the ODPC notification of complaint.
3. Analysis of Evidence
Complainant’s Position
- Was contacted regarding a loan that he had not consented to be enlisted as a guarantor
- Provided screenshots of messages sent by the Respondent as proof
- Lodged the complaint through his representative, Joyce Wanjiru Nderitu
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent enlisted the Complainant as a guarantor without obtaining his consent.
- The Respondent failed to inform the Complainant of the collection and use of his personal data.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Digital Lender Accountability
- Reinforces the obligation of digital lenders to obtain direct consent from individuals listed as guarantors
- Failure to respond to complaints constitutes non-compliance with the Act
Consequences of Non-Response to Regulatory Notifications
- Establishes that ignoring ODPC communications does not shield data controllers from liability; default judgment will be entered against non-responsive respondents
Broader Impact: Across Africa, digital lenders must obtain direct consent from individuals listed as guarantors or emergency contacts. This determination establishes that failure to respond to regulatory notifications will result in default judgment, setting a critical deterrent for non-compliant lenders.