A Kenyan man has won a major data privacy battle after Platinum Credit was ordered to pay him KSh 400,000 in compensation over allegations that the lender repeatedly contacted him with loan advertisements without his consent.
The case has drawn attention to the growing debate over how financial institutions collect, access and use Kenyans’ personal information when marketing their products and services.
According to the reported findings, Samuel Kamau lodged a complaint with the Office of the Data Protection Commissioner (ODPC), accusing Platinum Credit of repeatedly sending him unsolicited promotional text messages and making marketing calls using personal data he said he had never provided for that purpose.
What began as unwanted calls and messages eventually developed into a formal complaint that placed the company’s data-handling practices under scrutiny.
The decision serves as a reminder to businesses that contacting potential customers with promotional offers is not simply a matter of making calls or sending text messages. The use of personal information for marketing must also comply with Kenya’s data protection laws.
Kenyan Man Raises Alarm Over Unwanted Loan Promotions
Kamau reportedly approached the ODPC after experiencing repeated marketing calls and text messages promoting loan products from Platinum Credit.
According to his complaint, the company was using his personal information without his consent, raising concerns about how it had obtained his details and the legal basis for contacting him.
For many Kenyans, unsolicited financial advertisements have become a familiar experience. Mobile phone users may receive messages promoting instant loans, credit facilities and other financial products, sometimes from businesses with which they have never knowingly interacted.
However, Kamau’s complaint took the matter beyond personal frustration and into the realm of data protection and accountability.
His case challenged the reported use of his information for direct marketing and sought the intervention of the country’s data protection regulator.
The complaint prompted an investigation into the lender’s conduct, including whether the person who had contacted Kamau was connected to the company.
ODPC Investigation Uncovers Disputed Claims
During the investigation, Platinum Credit reportedly disputed the connection between the company and the caller, claiming that the individual responsible for contacting Kamau was not its agent.
However, the ODPC investigation reportedly established that the caller was indeed associated with the lender.
The findings raised further concerns about the information provided by the company during the inquiry.
According to the reported outcome, the Data Protection Commissioner found Platinum Credit liable for unlawful processing of personal data and ordered the company to compensate Kamau.
The commissioner also issued an enforcement notice and recommended the prosecution of the company’s directors over the provision of allegedly false information during the investigation.
The recommendation for prosecution is a separate matter from the compensation order. It does not, by itself, mean that the directors have been prosecuted or convicted.
Nevertheless, the reported findings highlight the potential consequences businesses may face when handling personal information unlawfully or failing to cooperate truthfully with a regulatory investigation.
Why the KSh 400,000 Decision Matters to Kenyans
The reported compensation award is significant because it highlights the protections available to individuals who believe their personal information has been misused.
Under Kenya’s Data Protection Act, 2019, organisations must comply with legal requirements when collecting and processing personal data. The law also establishes protections concerning the use of personal information and provides a framework for addressing complaints.
Direct marketing is one area where these protections can become particularly important.
A person receiving a promotional message may wonder how a company obtained their phone number, whether they ever consented to being contacted and what options they have if the messages continue.
Kamau’s case illustrates why those questions matter.
Businesses cannot simply assume that possessing someone’s phone number gives them unlimited permission to use it for promotional purposes. They must have a lawful basis for processing the information and comply with applicable requirements governing direct marketing.
The case also underscores the importance of accountability when regulators investigate complaints involving personal data.
For consumers, it is a reminder that unwanted marketing may be more than an inconvenience when it involves the unlawful use of personal information.
What Should You Do If Companies Keep Sending Unwanted Loan Messages?
Kenyans who believe their personal information is being used unlawfully can take practical steps to protect their rights.
They can keep records of unwanted messages, note the dates and times of marketing calls, identify the businesses involved and preserve any evidence that may help explain how their information is being used.
Where appropriate, consumers can ask the business to explain the source of their information and the legal basis for contacting them. They may also request that their details no longer be used for direct marketing, subject to applicable legal requirements.
If the issue remains unresolved, they can consider lodging a complaint with the Office of the Data Protection Commissioner through its official channels.
Consumers should avoid sharing additional sensitive information with unknown callers simply because they claim to represent a financial institution.
A Warning to Businesses Handling Personal Data
The reported decision involving Platinum Credit sends an important message to companies that rely on telephone numbers and other personal information to market their products.
Customer acquisition must be balanced with privacy rights, transparency and lawful data processing.
Organisations need to understand where their customer information comes from, establish appropriate safeguards and ensure that their marketing practices comply with the law.
They must also take regulatory investigations seriously and provide accurate information when responding to questions from authorities.
For Samuel Kamau, the reported KSh 400,000 compensation order represents a significant development following his complaint.
For other Kenyans, the case highlights a broader principle: your personal information is not simply a marketing resource for businesses to use without regard for your rights.
As digital lending and mobile marketing continue to expand, the enforcement of data protection laws will remain important in ensuring that consumers can access financial services without surrendering control over their personal information.
