Mobile Loans Lender Whitepath Punished With Authority For Harassing Customers

The Office of the Data Protection Commissioner (ODPC) has issued two penalty notices against Whitepath company limited and Regus Kenya for contravening data protection laws.

The companies will now be required to pay a fine of Sh5 million each.

For White Path, the penalty has been issued because the firm failed to comply with an ODPC’s enforcement notice dated January 10, 2023.

In a statement, the ODPC noted that it has received close to 150 complaints against Whitepath alleging that their applications have accessed their mobile phone contacts and are sending unwarranted and unsolicited text messages to the said contacts.

“Additionally, the Whitepath staff have been harassing the complainants, and their contacts irregularly obtained from the complainant’s phone books,” the statement read.

The penalty on Regus Kenya is on basis of the firm being non-cooperative and failing to respond to a Notification of Complaint dated October 27, 2022, a reminder to the Notification of Complaint dated November 11, 2022, and an Enforcement Notice dated  February 16, 2023.

The ODPC noted that the complaint against Regus alleged frequent spamming of automated improper information to the complainant despite attempts to make the respondent stop.

Speaking on the notices, the Data Commissioner Immaculate Kassait, MBS said, “Data protection is the responsibility of every data controller and processor and it must be the company’s top priority whenever they collect, process, or store personal information.”

“I challenge businesses to protect personal data by design and by default and cooperate with the ODPC to avoid penalties,” she said.

The ODPC has also issued an enforcement notice to Ecological Industries Limited due to non-cooperation with several notifications of a complaint launched on January 25, 2023 and a reminder on February 15, 2023 against them for publishing of a personal photo on a company catalog and calendar for marketing purposes.

“Failure to comply with the enforcement notice within the stipulated time, Ecological Industries Limited will be faced with a penalty notice,” the ODPC said.

According to Section 72 of the Data Protection Act of 2019, a data controller who, without lawful excuse, discloses personal data in any manner that is incompatible with the purpose for which such data has been collected commits an offence. Additionally, a data processor who, without lawful excuse, discloses personal data processed by the data processor without the prior authority of the data controller commits an offence.

The complaints about Whitepath are so severe that a local newspaper reported how the firm went as far as forming a WhatsApp group for a client and faking suicide threats to his contacts.

There are numerous complaints from a number of consumers from Whitepath, including a petition generated by Ms Caroline Kahiu seeking to ban the app over what she termed severe harassment and debt shaming by its employees.

The complaints against Whitepath point to a growing concern among the public over the debt collection harassment by loan app companies. Customers have reported being harassed by uncouth loan company agents who call them and their contacts incessantly in a bid to force them to pay loans.

Due to the growing concern, Google announced last week said it would from May 31 prohibit loan apps from accessing user contacts, external storage, images, videos, contacts, the exact location, and call records.

Whitepath Company is alleged to be operating several apps namely Skypesa, Instacarsh, Kubwa cash Fastcash, Mcredit, papcash, Zuri Cash, and many others.

So far, only 22 digital lenders have been licensed with WhitePath missing from the list.