RocketPesa Under Probe: Authorities Investigate Serious Privacy Violations Amid Data Breach Allegations

Ceres Tech, the parent company of popular online loan platform Rocketpesa, is facing a potential legal storm as the Office of the Data Protection Commissioner (ODPC) seeks court orders to investigate alleged violations of the Data Protection Act. The move comes after a complaint was filed by Antony Kinoti, accusing the digital lender of mishandling personal data.

The ODPC has requested a search warrant to access, inspect, and obtain certified copies of Rocketpesa’s digital and manual records dating back to November 2023. The application, filed in court, aims to uncover whether the company has breached data protection laws, particularly regarding the storage and security of users’ personal information.

“This Court be pleased to issue a search warrant to Maryanne Serem, an Investigation Officer, with the Office of the Data Protection Commissioner, or any other officer attached to and authorized by the Data Commissioner, to have access to, inspect, investigate, obtain information, lift and carry away as exhibits certified copies of Rocketpesa’s digital and manual records, system(s), and database(s),” the application stated.

The ODPC expressed concerns that Rocketpesa’s database, which stores sensitive personal data, is vulnerable to loss, modification, or deletion. “Unless the orders sought herein are granted, the personal data, the subject of the complaint herein, is at risk of loss, modification, or deletion,” the Commissioner warned.

Deputy Data Protection Commissioner Oscar Otieno emphasized the urgency of the matter in an affidavit, citing Sections 60 and 66 of the Data Protection Act, which empower the ODPC to obtain search warrants and preservatory orders to safeguard personal data. Otieno revealed that Rocketpesa’s offices at Rafiki Business Park, Ruaraka, Nairobi, are believed to house the computers and databases containing the complainant’s personal information, including mobile phone numbers and national identification details.

“The search in the office of the Respondent (Rocketpesa) will assist in the investigations being carried out by the Data Commissioner and will enable the office to access and peruse the computers or database(s) of the Respondent,” Otieno stated.

The investigation aims to determine whether Rocketpesa or its agents used the complainant’s personal data unlawfully. Otieno also raised concerns that Rocketpesa might tamper with or erase critical information, potentially derailing the probe.

This development marks a significant escalation in the scrutiny of digital lenders in Kenya, many of whom have faced accusations of predatory lending practices and privacy violations. Rocketpesa, a well-known player in the online loan market, now finds itself at the center of a high-stakes investigation that could have far-reaching implications for the industry.