SANDRA BONARERI ONGAKI VERSUS ZEROX TECHNOLOGY LIMITED
1. Introduction
The case is in respect to the complainant, Sandra Bonareri Ongaki against Zerox Technology Limited, on being persistently contacted for a loan that she was not a party to. This action is inconsistent with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was listed as an emergency contact by a loanee without her knowledge or consent. She alleged that the Respondent’s agents constantly contacted her demanding she contact a relative responsible for a defaulted loan, and despite blocking the numbers, they continued using different numbers to contact her.
3. Analysis of Evidence
Complainant’s Position
- Provided screenshots of several numbers that she alleged belonged to agents of the Respondent
- Stated she was still receiving multiple calls and despite blocking the numbers, they contacted her using different numbers
- Denied that the Respondent tried to contact her to settle the complaint
Respondent’s Defense
- Stated that clients are required to provide at least two emergency contacts for loan applications
- Claimed they send OTPs to emergency contacts via SMS where they can agree or reject to be listed
- Indicated the Complainant was listed as an emergency contact by a loanee who defaulted
- Decided to stop contacting all emergency contacts and encrypt phone numbers as a mitigation measure
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Complainant was listed as an emergency contact without her knowledge or consent.
- The Respondent continued contacting the Complainant despite her objections and blocking efforts.
- The Respondent failed to prove that consent was obtained from the Complainant.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 500,000 to the Complainant.
- The Respondent is directed to adhere to Enforcement Notice Ref No. ODPC/CONF/1/7/2 VOL 1 (63), particularly measures 4, 5, 6 and 7 within thirty days.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Emergency Contact Onboarding and Consent
- Establishes that data controllers must obtain direct consent from emergency contacts before processing their personal data
- Prohibits reliance on third-party representations of consent without verification
Repeat Offender Consequences
- Demonstrates that repeated violations attract higher compensation and stricter enforcement
- Respondents must adhere to previous Enforcement Notices
Broader Impact: This determination reinforces that digital lenders across Africa must obtain direct consent from emergency contacts and cannot rely on unverified OTPs or third-party representations. Repeated non-compliance will attract progressively stricter enforcement.