Facts:
The Complainant took a loan with the Respondent in 2018, paying monthly instalments of Kshs 8,360 from his salary. In August 2023, the Respondent contacted the Complainant regarding a loan application he did not make. The Complainant noticed a loan deduction increase to Kshs 11,800 in September 2023, and despite notifying the Respondent, no response was received.
Issues:
Whether there was a violation of the Complainant's rights under the Data Protection Act.
Whether the Respondent fulfilled its obligations under the Data Protection Act.
Whether the Complainant is entitled to remedies under the Data Protection Act.
Rules:
Issue 1:
Data Protection Act Section 2: Personal data is information about an identifiable person.
Data Protection Act Section 26 (a) and (b): The Complainant has rights to be informed, access personal data, and object to processing.
Issue 2:
Data Protection Act Section 25: The Respondent must adhere to data protection principles.
Data Protection Act Section 30: Data processing requires consent or necessity.
Data Protection Act Section 32: Burden of proof lies with the data controller or processor.
Issue 3:
Data Protection Act Section 65: Compensation for damage due to Act contravention.
Analysis:
Issue 1:
The ODPC found the Respondent collected personal data without proper consent, violating the Complainant's privacy rights.
Issue 2:
The Respondent failed to prove the Complainant consented to data processing, thus not fulfilling obligations.
Issue 3:
The additional loan deduction caused financial loss to the Complainant. The ODPC ordered Kshs. 750,000 compensation for the Respondent's infringement.
Conclusion:
The Respondent infringed on the Complainant's rights and failed obligations under the Act. An Enforcement notice is issued, with the right to appeal to the High Court of Kenya within 30 days.