LAWRENCE KIRUTHI VERSUS MULLA PRIDE LIMITED
1. Introduction
The case is in respect to the complainant, Lawrence Kiruthi against Mulla Pride Limited, on being contacted and harassed regarding a loan that he was not a party to and had not consented to be listed as a guarantor. This action is prohibited under the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was harassed through calls and messages regarding a loan taken by one of the Respondent’s customers, who listed him as a guarantor without his knowledge. He alleged that the Respondent enlisted him as a guarantor without his consent, subjected him to excessive harassment (about 15 messages in one hour), and failed to respond to the ODPC notification of complaint.
3. Analysis of Evidence
Complainant’s Position
- Being harassed through calls and messages regarding a loan taken by one of the Respondent’s customers
- The customer placed him as a guarantor without his knowledge
- Receiving about 15 messages in one hour
- Provided screenshots of the messages received as proof
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent enlisted the Complainant as a guarantor without his knowledge or consent.
- The Respondent harassed the Complainant through excessive calls and messages.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Harassment by Digital Lenders
- Reinforces the obligation of digital lenders to obtain direct consent from individuals listed as guarantors
- Harassing individuals through excessive calls and messages constitutes a violation of data protection rights
Broader Impact: Across Africa, digital lenders must obtain direct consent from individuals listed as guarantors and cease harassing communications. This determination establishes that failure to respond to regulatory notifications will result in default judgment, setting a critical deterrent for non-compliant lenders.