PATRICK ODHIAMBO PAMBA VERSUS MULLA PRIDE LIMITED
1. Introduction
The dispute in this matter concerns Patrick Odhiambo Pamba’s grievance against Mulla Pride Limited on the receipt of persistent phone calls and emails regarding a loan he did not apply for, without his consent. This action is in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant asserted that he has no contractual relationship with the Respondent and has never subscribed to any loan services. He alleged that the Respondent contacted him regarding a loan he did not apply for, harassed him through persistent calls and emails, and collected, processed, and used his personal data illegally without his consent.
3. Analysis of Evidence
Complainant’s Position
- Received phone calls and emails regarding a loan he did not apply for
- Has no contractual relationship with the Respondent
- At no point did he provide consent for the collection or processing of his personal information
- Provided a written executed statement and emails sent from the Respondent’s agents as evidence
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the Notification of Complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- The allegations levelled against the Respondent remain uncontroverted
4. Issues for Determination
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Respondent had obligations to fulfil under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent contacted the Complainant regarding a loan he did not apply for, without his consent.
- The Respondent harassed the Complainant through persistent calls and emails.
- The Respondent failed to respond to the ODPC notification of complaint.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Consent
- Establishes that data controllers must inform data subjects of the collection and use of their personal data
- Collecting personal data from third parties without notifying the data subject constitutes a violation
Harassment by Digital Lenders
- Reinforces the obligation of digital lenders to obtain direct consent from individuals listed as referees or emergency contacts
- Harassing individuals through excessive calls and emails constitutes a violation of data protection rights
Broader Impact: This ruling confronts the weaponization of personal data by digital lenders who harass non-debtors for repayment. It establishes that consent cannot be presumed and that lenders who ignore ODPC notifications face default judgments, sending a clear deterrent against predatory debt collection practices.