Ruling Opens Floodgates for Kenyans to Sue Platinum Credit Over Unsolicited Loan Messages

In a landmark ruling that could trigger a tsunami of similar lawsuits, the Office of the Data Protection Commissioner has slapped Platinum Credit Limited with a Ksh400,000 penalty for bombarding a Kenyan with unwanted loan advertisements, setting a precedent that could cost the lender millions.

Samuel Kamau Waweru’s victory against the credit firm has opened the door for potentially thousands of Kenyans who have been on the receiving end of relentless marketing calls and text messages from lending institutions that somehow acquired their phone numbers without permission.

The determination, delivered on February 24, 2025, by Data Commissioner Immaculate Kassait, found Platinum Credit guilty of unlawfully processing Waweru’s personal data and misleading investigators during the probe, a move that has now earned the company’s directors a prosecution recommendation.

Waweru lodged his complaint on November 27, 2024, telling the commissioner that Platinum Credit and its sales agents had been persistently sending him promotional messages and making unsolicited calls about their loan products without his knowledge or authorization.

What he didn’t know was that his complaint would expose a web of data privacy violations that regulators say warrants criminal charges.

During the investigation, Platinum Credit attempted to distance itself from the harassment, claiming that the person making the calls was not their agent or representative.

But the Data Commissioner’s office dug deeper and uncovered evidence proving the caller was indeed working for the lender, a discovery that turned the case from a simple privacy violation into a potential criminal matter.

The Commissioner found that Platinum Credit had violated fundamental principles of data protection by processing Waweru’s personal information without lawful basis, a breach of the Constitution’s guarantee of privacy and the Data Protection Act of 2019.

Beyond ordering the hefty compensation payment, Kassait issued an enforcement notice against Platinum Credit and took the extraordinary step of recommending prosecution of the company’s directors under Section 57(3) read with Section 73 of the Act.

The provision targets those who furnish false or misleading information to the Data Commissioner, an offense that carries a fine of up to Ksh3 million, imprisonment for up to ten years, or both.

Legal experts say the ruling could unleash a flood of lawsuits against mobile lenders and financial institutions that have long operated in a regulatory grey area, purchasing customer databases and marketing aggressively without explicit consent.

With millions of Kenyans receiving similar unsolicited loan offers daily, the potential liability for the industry could run into billions of shillings.

The determination explicitly states that parties have the right to appeal to the High Court within 30 days, leaving room for Platinum Credit to challenge the decision.

However, the Commissioner’s recommendation for criminal prosecution of the company’s directors sends a chilling message to the industry that data privacy violations will no longer be treated as mere administrative infractions.

For Waweru, the Ksh400,000 compensation represents vindication for what many Kenyans endure silently every day.

For Platinum Credit, it may be just the beginning of a costly reckoning with data protection laws that the industry has largely ignored since their enactment.

The case marks one of the most significant enforcement actions by the Data Commissioner’s office since its establishment, signaling that Kenya’s data protection regime has teeth and is prepared to bite those who flout the rules.