Govt Orders Digital Lender to Pay Ksh400K Over a Single Phone Call

Platinum Credit was recently ordered to pay Ksh400,000 to a man who filed a complaint with the Office of the Data Protection Commissioner (ODPC) over a data breach. 

In the complaint filed in November 2024, Samuel Kamau reported that he received a call from a sales agent who was promoting a loan product offered by the digital lender.

During the call, Kamau detailed that the sales agent shared personal data, such as details of his vehicle and ID.

Alarmed by the information, he sought an explanation from the sales agent, who informed him that the details had been shared by the management of Platinum Credit. This prompted the man to file a complaint.

Consequently, the Kassait-led commission began its investigations even as the digital lender was served with the complaint.

In response, Platinum Credit denied having the personal details of Mwangi, adding that the sales agent did not have any link with the company.

However, upon being summoned to appear before the Commission, the sales agent confirmed that she was hired by the company.

Also Read: 40 Digital Lenders Under Investigation Over Data Breaches 

She also provided Whatsapp group chats that showed how team leaders would share Excel sheets of potential clients with the sales agents. 

She even revealed to the Commission that she was asked to work from home to avoid being found working at the office by the Commission’s investigators.

In the end, the Commission ruled that the digital lender contravened the Data Protection Act by processing the personal data of the man for their own financial benefit without obtaining consent.

“Section 65 (1) of the Act provides for compensation to a data subject and states that a person who suffers damage by reason of a contravention of a requirement of the Act is entitled to compensation for that damage from the data controller. 

“Section 65 (4) of the Act states that ‘damage’ includes financial loss and damage not involving financial loss, including distress,” read part of the ruling.

Further, Kassait recommended that managers of the digital lender be prosecuted.

“A recommendation for prosecution is hereby made against the Respondent's directors for furnishing to the Data Commissioner information which they knew to be false or misleading, an offence under Section 57(3) as read with Section 73 of the Act,” the Commissioner ruled.

“Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.”

Breach of data has been one of the concerns raised by Kenyans regarding digital lenders.

Besides access to personal data, other Kenyans have lamented over constant calls that are made to them after loan applicants included them as guarantors when taking the loan facility.

Digital lenders are banned from making unauthorised or unsolicited calls to customers when seeking loan repayment, as outlined in the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022.

Also Read: How Kenyan Law Protects You When Taking a Mobile Loan