Whitepath has been ordered to pay Dennis Caleb Owuor Sh250,000 for harassment during loan recovery. The Office of the Data Protection Commissioner (ODPC) found the firm guilty of illegally using Owuor’s personal data without his consent, it’s a repeat offender in data breaches.
Unprocedural data processing and Harassment
Data Commissioner Immaculate Kassait** says Whitepath didn’t respond to the complaint lodged in November 2024 and therefore the ODPC ruled in favour of the complainant. Owuor alleged that Whitepath’s agents kept calling him for a loan he was listed as a guarantor without his knowledge or consent.
When he asked how they got his contacts, the agent ignored him and instead asked him to convince the actual borrower to pay the loan. Despite Owuor warning him he would file a complaint, the calls persisted.
**Data Protection Violations
In her ruling Kassait stated that Whitepath had violated Section 26(a) of the Data Protection Act which requires individuals to be informed about the processing and intended use of their personal data.
“The respondent failed to establish any lawful basis for processing the complainant’s data as he had not consented to be a guarantor, therefore the whole processing was unlawful.”
Whitepath is to pay Owuor Sh250,000 for using his personal data unlawfully.
Whitepath’s History of Data Breaches
This is not the first time Whitepath has been caught violating data privacy laws. In April 2023 the firm was fined Sh5 million after ODPC received over 150 complaints from customers who alleged that the lender had accessed their phone contacts and sent unsolicited messages.
Implications for Digital Lenders
The ruling shows the growing regulatory scrutiny on digital lenders in Kenya, especially on their aggressive debt collection and data privacy violations.
Whitepath’s repeated violations indicate a pattern of non compliance, raises concerns on consumer protection in the digital lending space. The case also sets a precedent for borrowers and individuals who are harassed or listed as guarantors without consent to seek redress through ODPC.Digital lenders should watch out for data protection!