“Hello, this is X from ABC Loans. You have qualified for a Sh5,000 loan, repayable in 30 days. If you take the loan today, you will enjoy a reduced interest rate. The offer is only valid for a limited time. Shall I help you process it?”

Does this sound familiar?

For many Kenyans, unsolicited calls and messages from digital lenders have become a routine nuisance, offering loans they never requested and pressuring them to borrow immediately to take advantage of promotional interest rates.

While many endure the interruptions in silence, Mr Donald Mkala Ngolo decided enough was enough. He took legal action against Platinum Credit Limited after a persistent stream of promotional calls and messages turned his phone into a source of unwanted intrusion.

On August 18, the High Court in Nairobi upheld a Sh1 million compensation award made by the Office of the Data Protection Commissioner (ODPC) to Mr Ngolo after finding that Platinum Credit had unlawfully processed his personal data for loan marketing.

The court dismissed the digital lender’s appeal against the ODPC’s determination of October 16, 2024, and upheld the compensation award.

The ruling could have wider implications for Kenyans who routinely receive unsolicited calls and messages from lenders marketing products they never requested.

The High Court said Platinum Credit had failed to demonstrate any basis for interfering with the Commissioner’s finding that it had contravened the Data Protection Act.

The judge found that the Commissioner had properly considered Mr Ngolo’s complaint, the lender’s responses and the documentary evidence before reaching a decision supported by the record.

“On compensation, I have, independently satisfied myself that the sum awarded falls within a range properly open to the Commissioner,” the judge said.

Unsolicited promotional messages

The dispute dates back to July 2024, when Mr Ngolo, frustrated by the persistent marketing, lodged a complaint with the ODPC.

He complained that he had repeatedly received unsolicited calls and promotional messages advertising Platinum Credit’s loan products despite never having been its customer and objecting to the communications.

Mr Ngolo also said he had asked the lender to erase his personal data, arguing that it had no lawful basis to retain or use his information. Although Platinum Credit acknowledged receiving the request, he said the calls and messages continued.

The ODPC notified Platinum Credit of the complaint and invited it to respond. The company denied liability, saying Mr Ngolo had never been its customer and that his telephone number was not in its database.

Platinum Credit said its investigations established that one of the numbers used to contact Mr Ngolo belonged to an independent sales agent whose contract had since been terminated. The other was not linked to any authorised agent and had been reported to police.

“The firm has instituted contractual and training measures requiring its agents to comply with data protection obligations,” the lender said in its defence.

After considering the evidence, the Data Commissioner found on October 16, 2024, that Platinum Credit had processed Mr Ngolo’s personal data for commercial purposes without lawful consent, contrary to the Data Protection Act.

The Commissioner ordered the lender to pay Mr Ngolo Sh1 million and implement corrective measures to prevent similar breaches.

The ODPC subsequently issued an Enforcement Notice on February 24, 2025, requiring Platinum Credit to implement the measures within 45 days.

'Unfair proceedings'

The lender challenged both the determination and the Enforcement Notice before the High Court, arguing that the ODPC proceedings were unfair and biased.

It said the Commissioner had effectively presumed its liability before completing the investigation, failed to properly consider its evidence and did not give it a formal hearing or adequate opportunity to respond.

Platinum Credit also maintained that Mr Ngolo was never its customer, his number was not in its database and the calls were made by an independent agent and an unauthorised third party.

It further argued that the Sh1 million award was excessive and unsupported by evidence of actual loss, while the Enforcement Notice was unlawful because it had been issued despite court orders staying enforcement pending the appeal.

Mr Ngolo opposed the appeal, maintaining that the Commissioner had acted within the law in finding Platinum Credit liable for processing his personal data without consent.

He argued that the lender could not escape responsibility by describing the agents involved as independent contractors, particularly after acknowledging that one of the numbers was linked to its sales network.

He also defended the compensation award, saying the repeated unsolicited calls and messages, coupled with the lender’s failure to honour his request to erase his data, caused distress, inconvenience and an invasion of his privacy.

The ODPC similarly opposed the appeal, defending its investigation, finding of liability, compensation award and Enforcement Notice as lawful and proportionate.

The High Court reviewed evidence in this case and rejected all the lender’s arguments, holding that the compensation was reasonable after data breach claims were proven.

“I am satisfied that the sum of Sh1 million falls within a range a reasonable decision-maker properly directing itself could have reached, and I decline to disturb it,” the court said.

The court rejected Platinum Credit’s argument that the ODPC had predetermined the complaint or denied it a fair hearing.

It found that the lender had been notified of the complaint, informed of the allegations and given an opportunity to respond. The company submitted detailed representations and documentary evidence on more than one occasion.

“An oral hearing, formal charges, cross-examination or a separate investigation report was not necessarily required in the circumstances,” the court said.

The court also rejected Platinum Credit’s argument that it could not be liable because Mr Ngolo was not its customer and his number did not appear in its database.

It held that data protection law protects all data subjects, including people whose personal information is processed for marketing without an existing customer relationship.

The court found that the evidence linked the calls to Platinum Credit’s commercial operations. The lender had acknowledged that one of the numbers belonged to an independent sales agent whose contract was later terminated over the conduct complained of.

The judge held that using independent agents did not absolve Platinum Credit of its responsibilities as a data controller.

The appeal was consequently dismissed, leaving the Sh1 million compensation award and the ODPC’s determination intact.

Follow our WhatsApp channel for breaking news updates and more stories like this.

bocharo@ke.nationmedia.com