NAIROBI, Kenya — The Office of the Data Protection Commissioner (ODPC) has ordered Platinum Credit to compensate a mobile subscriber Sh400,000 for persistently sending unsolicited promotional loan messages, marking one of the clearest enforcement actions yet against digital lenders violating Kenya’s privacy laws.
In a decision issued by Data Commissioner Immaculate Kassait, the ODPC found that Platinum Credit unlawfully contacted subscriber Samuel Waweru with repetitive loan offers despite his failure to grant consent, infringing both his constitutional right to privacy and provisions of the Data Protection Act, 2019.
“The Respondent is hereby ordered to pay the Complainant Sh400,000 as compensation; an enforcement notice is hereby issued to the Respondent,” Kassait stated.
Waweru lodged the complaint on November 27, 2024, arguing that the digital lender had repeatedly spammed him with promotional messages and alerts.
According to the ODPC, the company failed to demonstrate that it had obtained his data legally or secured authorisation to use his phone number for direct marketing.
The ODPC further recommended that Platinum Credit’s directors face prosecution for giving false or misleading information during the investigation, in breach of Section 57(3) as read with Section 73 of the Data Protection Act.
“A recommendation for prosecution is hereby made against the Respondent’s directors for furnishing to the Data Commissioner information which they knew to be false or misleading,” Kassait said. If charged and convicted, they could face fines of up to Sh3 million, imprisonment for up to 10 years, or both.
The ruling comes as Kenyan mobile users report a surge in nuisance messages — particularly from betting firms, digital lenders, and unauthorised content services — prompting renewed scrutiny from regulators.
In a November statement, the Communications Authority of Kenya (CA) acknowledged rising complaints over spam and unauthorised use of personal data.
“We have noted consumer frustration over spam messages, unsolicited subscriptions, unauthorised use of phone numbers and unauthorised premium services,” CA said, adding that improved SIM registration and identity verification processes are part of a broader consumer protection strategy.
Under the Data Protection Act and its accompanying regulations, companies may only send direct marketing messages if they:
- Collect personal data lawfully
- Obtain explicit consent from the data subject
- Provide a free and clear opt-out mechanism
- Include contact information for withdrawal of consent
- Respect requests from individuals to stop processing their data for promotional purposes
The law also affirms an individual’s right to object to direct marketing, requiring companies to halt the use of their data for that purpose immediately.
The ODPC’s directive adds to a growing list of enforcement actions aimed at tightening accountability in Kenya’s digital lending space, which has long been criticised for aggressive marketing, data misuse, and harassment of customers and non-customers alike.
As digital lenders expand their operations, regulators have pledged stricter oversight to curb privacy violations and ensure compliance with both data protection and consumer rights frameworks.
Platinum Credit now has a statutory obligation to comply with the enforcement notice and settle the compensation, even as its directors face potential criminal liability.
The ruling is expected to embolden more consumers to file complaints and test the robustness of Kenya’s data privacy regime in the face of persistent spam and unauthorised marketing practices.
