PHIDALE CASTRO MAJIWA OUMA VERSUS WHITEPATH COMPANY LIMITED
1. Introduction
The dispute in this matter concerns Phidale Castro Majiwa Ouma’s complaint against Whitepath Company Limited on the unauthorized use of his personal data to demand payment as a loan guarantor without his consent. This action is in contravention of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant received numerous incessant calls and messages from the Respondent demanding payment as a loan guarantor, yet he has never guaranteed anyone loans with the Respondent. He received more than three hundred (300) messages and almost 200 calls from the Respondent’s agents, and was never informed or consulted by the Respondent when they engaged their client.
3. Analysis of Evidence
Complainant’s Position
- Received lots of calls and text messages terming him as a referee for a client who had defaulted on a loan
- His consent was never procured to allow them to spam him with incessant and unwarranted calls
- Received more than three hundred (300) messages and almost 200 calls from the Respondent’s agents
Respondent’s Defense
- Admitted that one of its agents had contacted the Complainant on numerous times as alleged
- Took disciplinary actions against the employee involved
- Did not provide evidence to prove that the Complainant was informed prior to being made a guarantor
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies
5. Final Determination
The Data Commissioner found:
- The Respondent listed the Complainant as a guarantor without his knowledge or consent.
- The Respondent subjected the Complainant to excessive harassment through 300+ messages and 200+ calls.
- The Respondent failed to supervise its agents and ensure they acted lawfully.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 250,000 to the Complainant.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Controller Liability for Agents
- Establishes that data controllers remain liable for the actions of their agents
- Disciplinary action against agents does not absolve the controller of liability
Harassment by Debt Collectors
- Establishes that excessive messaging (300+) and calls (200+) constitute harassment
- Listing individuals as referees without consent is unlawful
Broader Impact: This case reveals the staggering scale of harassment inflicted on individuals by digital lenders, with over 500 combined calls and messages in a single instance. It establishes that the sheer volume of communications is itself evidence of a violation, setting a clear threshold for what constitutes unlawful harassment in debt recovery practices.