NAIROBI, Kenya, Dec 4 – The Office of the Data Protection Commissioner (ODPC) has ordered Platinum Credit Limited to pay a Kenyan Sh400,000 for unlawfully sending unsolicited marketing messages and calls without his consent.
The ruling follows a complaint by Samuel Kamau Waweru, who reported that Platinum Credit – through its sales agents – repeatedly contacted him with promotional SMS messages and calls advertising loan products, despite him never having shared his personal data with the lender.
During the ODPC inquiry, Platinum Credit initially denied responsibility, claiming the agent who contacted Kamau was not affiliated with the company.
However, the regulator confirmed that the caller was indeed a Platinum Credit representative, a finding that significantly increased the lender’s legal exposure.
The Data Commissioner found the company in violation of the Data Protection Act, 2019, specifically for unlawful processing of personal data, failure to obtain consent and providing false or misleading information during a formal investigation.
“The Respondent is hereby found liable,” Data Commissioner Immaculate Kasait said in a final determination, referenced as ODPC Complaint No. 1951 of 2024.
“The Respondent is hereby ordered to pay the Complainant Kenya Shillings Four Hundred Thousand (KES 400,000/=) as compensation.”
Recommended prosecution
Additionally, the ODPC recommended that Platinum Credit’s directors face prosecution under Section 57(3) read with Section 73 of the Act, which criminalizes furnishing false information to the Data Commissioner.
If convicted, the offence carries a penalty of up to Sh3 million in fines, a 10-year prison term, or both.
Alongside the compensation order, the ODPC issued an Enforcement Notice compelling Platinum Credit to fully comply with the Data Protection Act and cease all unlawful data-processing practices.
Both Platinum Credit and the complainant retain the right to appeal the determination at the High Court within 30 days.
The case adds to a growing list of enforcement actions as the ODPC cracks down on financial institutions, digital lenders, and marketers that misuse personal data for aggressive promotions.
Under the Data Protection Act, companies must obtain explicit consent before using or sharing personal data for marketing purposes.