On lawful obtainance and processign of personal data and breach; Samwel Kamau Waweru v Platinum Credit Limited; ODPC Complaint No. 1951 of 2025

I — Issues

1. Whether Platinum Credit Limited lawfully obtained and processed the Complainant’s personal data.
2. Whether the Respondent violated the consent requirements under the Data Protection Act, 2019 by using the Complainant’s personal data for direct marketing.
3. Whether the Respondent’s conduct amounted to a breach of the Complainant’s right to privacy under the Constitution of Kenya, 2010.

 

R — Rules

• Article 31(c) & (d), Constitution of Kenya (2010):
  Guarantees the right to privacy, including the right not to have personal information unnecessarily revealed or misused.
• Section 25, Data Protection Act, 2019:
  Requires personal data to be processed lawfully, fairly, and transparently.
• Section 30, Data Protection Act, 2019:
  Personal data shall not be processed unless the data subject has given consent or another lawful basis exists.
• Section 37, Data Protection Act, 2019:
  Prohibits the use of personal data for direct marketing without the data subject’s prior consent.
• Section 51, Data Protection Act, 2019:
  Provides data subjects with enforceable rights against unlawful processing.

 

A — Application

Platinum Credit Limited contacted the Complainant in November 2024 to promote loan products despite the Complainant never having been a customer of the Respondent. The Respondent’s agent possessed detailed personal information, including the Complainant’s vehicle details, demonstrating that the Respondent had already collected and processed his personal data.

The Complainant did not provide consent for the collection, processing, or use of his personal data for marketing purposes. When questioned, the Respondent’s agent stated that such information was routinely shared internally with the sales team, indicating systemic processing of personal data for commercial purposes.

This conduct failed to meet the statutory requirements of lawfulness, transparency, and consent under Sections 25 and 30 of the Data Protection Act. Additionally, the repeated unsolicited calls and messages constituted direct marketing, which is expressly restricted under Section 37 without prior consent.

By using the Complainant’s personal data without lawful justification, the Respondent infringed upon the Complainant’s constitutional right to privacy under Article 31 of the Constitution.

 

C — Conclusion

The Respondent unlawfully obtained and processed the Complainant’s personal data without consent and used it for direct marketing purposes in violation of the Data Protection Act, 2019 and Article 31 of the Constitution. The complaint was therefore upheld, and Platinum Credit Limited was found to be in breach of Kenya’s data protection laws.