Nairobi businessman Dennis Caleb Owuor has been awarded Sh250,000 in compensation after a digital lending company listed him as a loan guarantor without his knowledge, marking a major victory in the fight against predatory lending practices in Kenya.
The Office of the Data Protection Commissioner has found Whitepath Company Limited guilty of unlawfully processing personal data and ordered the firm to pay the hefty fine to Owuor, who was subjected to harassment through multiple phone calls demanding payment for a loan he knew nothing about.
In a determination dated February 21, 2025, Data Commissioner Immaculate Kassait ruled that the digital lender violated the Data Protection Act 2019 by processing Owuor’s personal information without a lawful basis and listing him as a guarantor without his consent.
The case, which began when Owuor lodged a complaint on November 24, 2024, has sent shockwaves through Kenya’s digital lending sector, with consumer rights activists hailing it as a watershed moment in protecting borrowers from unscrupulous lenders.
According to the determination, Owuor received multiple calls from agents of Whitepath Company demanding payment for a loan for which he had allegedly been listed as a guarantor.
The bewildered businessman had no knowledge of the loan, had never agreed to guarantee it, and had not provided consent for his personal information to be used in this manner.
The Commissioner found that the respondent’s unauthorized disclosure of the complainant’s personal data constituted a serious offense under the Act. An enforcement notice has been issued compelling Whitepath Company to erase all data relating to Owuor and furnish proof of compliance.
The ruling invoked Article 31 of the Constitution of Kenya, which guarantees the right to privacy, and cited multiple provisions of the Data Protection Act that require explicit consent before processing personal data. The Commissioner emphasized that data controllers must operate with transparency and accountability, principles that Whitepath Company flagrantly violated.
Legal experts say this case sets an important precedent for thousands of Kenyans who have fallen victim to similar practices by digital lenders. The ruling makes it clear that lending apps cannot simply harvest personal data from phone contacts or other sources and use it to harass individuals who never agreed to be part of a loan transaction.
Consumer protection advocates have long complained about the aggressive tactics employed by some digital lenders, including accessing phone contacts without permission, making threatening calls to borrowers’ relatives and friends, and publicly shaming defaulters through social media.
The Central Bank of Kenya has been under pressure to regulate the digital lending sector more strictly following numerous complaints about exorbitant interest rates, hidden charges, and invasive data collection practices. Several digital lenders have faced sanctions in recent years, but enforcement has been inconsistent.
The ODPC determination makes it clear that victims of such practices have legal recourse. The Commissioner noted that the office was established specifically to regulate the processing of personal data, ensure compliance with data protection principles, protect individual privacy, and provide remedies when personal data is processed unlawfully.
For those who find themselves in similar situations, the process is straightforward. Complaints can be lodged directly with the Office of the Data Protection Commissioner, providing details of the unauthorized use of personal information. The office is mandated to investigate such complaints and has the power to issue enforcement notices and award compensation.
Industry insiders say the Sh250,000 fine, while significant for an individual case, should be high enough to serve as a deterrent. They argue that digital lenders must invest in proper data protection systems and ensure they have explicit consent before processing anyone’s personal information.
Whitepath Company has 30 days to appeal the determination to the High Court of Kenya. The company did not respond to requests for comment by the time of publication.
The case highlights the growing importance of data protection in Kenya’s digital economy. As more financial services move online, the risk of personal information being misused increases exponentially. The Data Protection Act provides robust safeguards, but enforcement depends on individuals being aware of their rights and willing to pursue complaints.
Consumer rights groups are urging anyone who has been similarly harassed by loan apps to come forward and file complaints with the ODPC. They point out that many Kenyans suffer in silence, unaware that they have legal protections against such practices.
The ruling also serves as a warning to other digital lenders operating in Kenya. The era of cavalier treatment of customer data is over. Companies that fail to comply with data protection laws face not only financial penalties but also reputational damage that could prove fatal in a competitive market.
For Dennis Caleb Owuor, the ruling represents vindication after months of harassment. More importantly, his courage in pursuing the complaint has potentially helped thousands of other Kenyans who may find themselves in similar circumstances.
The Data Protection Commissioner’s office has indicated it will continue to vigorously pursue cases of data misuse, sending a clear message that Kenya’s digital economy must be built on a foundation of trust and respect for individual privacy rights.
