Cases
Peter Mbugua, Timothy Ngome & Aggrey Timothy vs. Credit Watch Investments Limited
Case Summary
The determination addresses complaints filed by Peter Mbugua, Timothy Ngome, and Aggrey Timothy against Credit Watch Investments Limited regarding unauthorised listing as guarantors. The complaints, received in September 2023, allege that the respondents listed these individuals as guarantors for loans without their consent, resulting in unsolicited communications and privacy breaches.
Credit Watch Investments Limited, a digital credit provider offering a product called Cloudloan, was found to have listed the complainants as emergency contacts without obtaining their consent. The Office of the Data Protection Commissioner (ODPC) investigated the matter, finding that the complainants' rights under the Data Protection Act, 2019 were violated.
Issues of Determination
- Whether there was a violation of the complainants' rights under the Data Protection Act
- Whether the respondent fulfilled its obligations under the Data Protection Act
- Whether the complainants are entitled to any remedies under the Act and the attendant Regulations
Determination
The ODPC determined that Credit Watch Investments Limited violated the complainants' rights by failing to inform them about the collection and use of their personal data. The complainants were listed as emergency contacts without their knowledge or consent, breaching their right to privacy under Section 26 of the Data Protection Act, 2019.
Further, credit Watch Investments Limited did not fulfil its obligations under the Act. The company failed to process the complainants’ personal data in compliance with the Act’s principles. Notably, the respondent did not collect data directly from the complainants nor did it notify them about the data collection, thus failing to meet the requirements of Section 29 and Section 30 of the Act.
Hence, the ODPC determined that the complainants are entitled to compensation for the distress caused by the unauthorised use of their personal data, and ordered Credit Watch Investments Limited to compensate each complainant Kshs. 300,000.
Analysis
On whether there was a Violation of Complainants' Rights under the Act
The Data Protection Act, 2019 guarantees data subjects the right to be informed about the use of their personal data (Section 26). The complainants’ rights were violated as they were not informed about the collection and use of their phone numbers by Credit Watch Investments Limited. The company listed the complainants as emergency contacts without obtaining their explicit consent, which is a clear breach of privacy.
On whether the Respondent Fulfilled its Obligations under the Act
The Data Protection Act requires data controllers to collect personal data directly from the data subject and to inform them of the data collection and processing purposes (Sections 28 and 29). Credit Watch Investments Limited failed to meet these requirements. The company collected the complainants' personal data from third parties and did not provide necessary notifications or obtain consent, thus violating Sections 25, 28, and 29 of the Act.
On whether the Complainants are Entitled to any Remedies under the Act and the Attendant Regulations
Under Section 65 of the Act and Regulation 14 of the Enforcement Regulations, data subjects who suffer damage due to contraventions of the Act are entitled to compensation. The complainants experienced distress due to unauthorised communications and are therefore entitled to financial compensation. The ODPC determined that each complainant should receive Kshs. 300,000 as compensation for the breach of their privacy rights.