The High Court has upheld a KSh1 million award against Platinum Credit. The ruling places fresh responsibility on lenders using agents to market financial products.
Platinum Credit Limited has lost a major data privacy appeal after Kenya’s High Court upheld compensation awarded to Donald Mkala Ngolo.
Justice Linus Kassan dismissed the lender’s challenge against a regulatory decision delivered by the data protection regulator.
The judgement, delivered in Nairobi in mid-August 2026, upheld a KSh1 million compensation award to Ngolo.
It also upheld corrective measures ordered against Platinum Credit following the regulator’s finding of unlawful data processing.
The dispute began after Ngolo complained about repeated marketing calls promoting Platinum Credit’s financial products.
He said he had never been the company’s customer, yet promotional communications repeatedly reached his telephone.
More significantly, Ngolo had already asked Platinum Credit to erase his personal data from its records.
The request was acknowledged, but the unwanted communications allegedly continued despite that express request.
Ngolo eventually lodged a formal complaint with the Office of the Data Protection Commissioner.
He filed the complaint on July 19, 2024, after earlier efforts failed to stop the communications.
The regulator notified Platinum Credit and invited the lender to respond to the allegations.
Platinum Credit denied responsibility and said Ngolo’s telephone number was absent from its customer database.
It also insisted that Ngolo had never maintained a customer relationship with the company.
However, its investigations produced an important connection between the lender and the disputed communications.
One telephone number belonged to an independent sales agent working for Platinum Credit.
The lender later terminated that agent’s contract following the conduct that triggered Ngolo’s complaint.
Platinum Credit said another disputed number belonged to an unauthorised person and had been reported to police.
The company also pointed to contractual safeguards requiring its independent agents to observe data protection obligations.
Those explanations, however, failed to persuade the Data Commissioner or the High Court.
The Commissioner found that Platinum Credit had unlawfully processed Ngolo’s personal data for commercial purposes.
She subsequently awarded Ngolo KSh1 million and ordered corrective measures aimed at improving future compliance.
Platinum Credit challenged that determination, raising 16 grounds that eventually narrowed into four central questions.
Agent Defence
The lender argued that the regulatory process was procedurally unfair and had effectively predetermined the complaint.
It complained about the absence of formal charges, oral testimony, witness examination and a separate investigation report.
Platinum Credit also questioned a request requiring it to disclose mitigation measures during the investigation.
The company argued that such wording suggested the regulator had already assumed wrongdoing before reaching its decision.
Justice Kassan rejected that argument after examining the regulator’s handling of the complaint.
He found that Platinum Credit had received the allegations and received opportunities to provide detailed responses.
The company also submitted documentary evidence, which formed part of the material considered before determination.
The judge therefore found no automatic constitutional requirement for an oral hearing in the circumstances.
Nor did the absence of a standalone investigation report invalidate the proceedings before the Commissioner.
The court found that investigative findings could properly form part of the final determination.
The judge then confronted Platinum Credit’s central defence concerning Ngolo’s absence from its customer database.
Justice Kassan described that argument as resting upon an “erroneous premise” concerning data protection.
The Data Protection Act protects data subjects generally, rather than only people already registered as customers.
That means prospective customers remain protected when businesses process their information for commercial marketing.
The court found that repeated promotional communications connected the conduct with Platinum Credit’s commercial operations.
It also attached significance to the lender’s admission that one disputed number belonged to its sales agent.
The judge rejected the suggestion that independent agents automatically bear exclusive responsibility for unlawful processing.
Sections 25 and 26 impose direct obligations upon data controllers conducting commercial processing.
Those obligations cannot simply disappear because marketing activities have been outsourced to external agents.
The judge warned that companies could otherwise evade responsibility by shifting marketing activities onto independent contractors.
Such an interpretation would undermine statutory privacy protections and weaken the purpose of data protection law.
KSh 1 Million Award
Platinum Credit also challenged the KSh1 million compensation as excessive and insufficiently supported by evidence.
The lender argued that Ngolo had not proved financial loss, emotional distress, or other measurable damage.
The High Court rejected the suggestion that financial loss was necessary before privacy compensation could arise.
Section 65 permits compensation for both pecuniary and non-pecuniary harm resulting from unlawful processing.
The court found that repeated unwanted communications could constitute genuine non-pecuniary privacy harm.
Ngolo’s position was strengthened because communications allegedly continued after his express erasure request.
The judge described the resulting privacy infringement as “non-trivial” based upon the evidence before him.
However, the court criticised the regulator’s explanation for arriving at the precise KSh1 million figure.
The Commissioner had not adequately explained how the amount was calculated from the established harm.
There was insufficient analysis concerning frequency, duration, comparable awards, and different categories of potential harm.
Despite that criticism, Justice Kassan independently reviewed the evidence and found KSh1 million reasonable.
He concluded that the amount remained within the range available to a properly directed reasonable decision-maker.
The compensation therefore survived the appeal despite weaknesses in the Commissioner’s reasoning.
The court nevertheless warned regulators to explain future compensation awards with greater analytical precision.
Such reasoning would make decisions easier to review and reduce perceptions that compensation figures were arbitrary.
Stay Dispute
The judgement also addressed a separate dispute surrounding the Enforcement Notice issued by the ODPC.
The regulator issued the notice on February 24, 2025, while Platinum Credit’s appeal remained pending.
Platinum Credit argued that the notice breached an existing court order staying execution of the determination.
The regulator responded that it had not yet been joined to the appeal when that order issued.
It also maintained that it had not received notification of the stay at that stage.
The High Court carefully separated the question of contempt from the validity of enforcement.
Justice Kassan declined to determine whether the regulator had committed contempt during the appeal.
He held that such a question required properly constituted contempt proceedings and appropriate procedural safeguards.
However, the judge also refused to permanently invalidate the Enforcement Notice.
Instead, he held that the notice would take effect from August 18, 2026, when judgement was delivered.
That approach followed the court’s decision to uphold the underlying regulatory determination.
Platinum Credit was consequently ordered to pay the costs of its unsuccessful appeal.
The ruling now carries implications extending well beyond Ngolo’s individual complaint against the lender.
It confirms that privacy protections apply even before a conventional customer relationship exists.
It also makes clear that outsourcing marketing does not automatically transfer regulatory responsibility away from companies.
For lenders, the message is straightforward: inadequate control over agents can create significant corporate exposure.
For consumers, the decision strengthens protection against persistent and unwanted financial marketing communications.
The judgement also signals closer scrutiny of how lenders obtain, process, and control personal information.
READ ALSO: Court Orders DTB, Airtel to Compensate Customer Over KSh592,864 SIM Swap Fraud
At the same time, the court’s criticism gives the ODPC an important lesson about compensation decisions.
Future awards should clearly connect proven harm with the amounts ultimately ordered as compensation.
For Kenya’s expanding digital-credit industry, that balance could become increasingly important as privacy disputes reach courts.
PAY ATTENTION: Reach us at info@gotta.news.
