Digital Credit Provider Fined for Personal Data Breach
A Digital Credit provider company, WhitePath Limited has been fined Ksh. 5 million by the Office of the Data Protection Commissioner(ODPC) for failing to protect customers’ personal data.
In a statement issued by the ODPC, WhitePath went against the Data Protection Act.
“Whitepath will have to pay the ODPC a penalty of Sh5 million pursuant to Section 63 of the Data Protection Act, and Regulation 20 of the Data Protection (Complaints Handling Another company that has been fined the same amount is Regus Kenya which generally deals with co-working spaces in Nairobi.” Read the statement.
The statement further reveals the misconduct by WhitePath in handling victims of the data breach.
“The ODPC received close to 150 complaints against Whitepath alleging that their applications have accessed their mobile phone contacts and are sending unwarranted and unsolicited text messages to the said contacts,” the statement reads.
On another account, Regus Kenya faced similar charges for failing to respond to a notification of complaint dated October 27, 2022.
According to ODPC, Regus Kenya was responsible for spamming automated information to the complainant despite attempts to make the responded stop.
Speaking regarding the notices, Commissioner Immaculate Kassait urged businesses to take responsibility in controlling data to avoid penalties.
“Data protection is the responsibility of every data controller and processor, and it must be the company’s top priority whenever they collect, process or store personal information. I challenge businesses to protect personal data by design and by default and cooperate with the ODPC to avoid penalties.”
This comes a week later after Google announced that from May 31, 2023, it will bar loan apps from accessing user contacts, external storage, images, contacts, the exact locations and call records.
About The Author
