MUSA WESUTSA VERSUS AZURA CREDIT LIMITED T/A TRUEPESA
1. Introduction
This complaint emanates from Musa Wesutsa’s grievance against Azura Credit Limited t/a TruePesa on the receipt of phone calls and emails regarding a loan he did not apply for, and the harassment of himself and his senior managers. This action offends the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
Individuals purporting to be from the Respondent’s Company have been harassing the Complainant and his senior managers as they try to recover funds that one of his staff members borrowed. The Complainant received phone calls and emails regarding a loan he did not apply for, and the Respondent collected his personal identifiable information illegally to harass him.
3. Analysis of Evidence
Complainant’s Position
- Received phone calls and emails regarding a loan he did not apply for
- Individuals purporting to be from the Respondent’s Company harassed him and his senior managers
- The Respondent is infringing on his privacy and collecting his personal identifiable information illegally
- This includes phone calls, emails to the company, and to his personal Gmail account
- Provided screenshots of emails received as proof
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent had obligations to fulfil under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent contacted the Complainant regarding a loan he did not apply for, without his consent.
- The Respondent harassed the Complainant and his senior managers using illegally obtained personal data.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Harassment of Employers and Managers
- Reinforces that debt collectors cannot harass employers or managers of borrowers
- Using employer information to pressure repayment constitutes a violation
Broader Impact: This determination confronts an increasingly common practice in Africa’s digital lending sector: the weaponization of employer-employee relationships to extract debt repayment. By targeting managers and using workplace hierarchies as leverage, lenders are not only violating individual privacy but also eroding the professional boundaries that sustain functional workplaces, a practice that this ruling firmly condemns.