Momentum Credit Limited has been ordered to pay Kshs. 500,000 in compensation to Mary Ogwena after the Office of the Data Protection Commissioner (ODPC) found the company liable for violating her data privacy rights through persistent unsolicited messages.
According to the ODPC’s findings, Ogwena received more than 50 promotional messages from agents marketing the company’s services, despite not being a customer and having never given consent for her personal data to be used.
The regulator determined that the repeated messages caused her distress and constituted a clear breach of Kenya’s data protection laws.
The ODPC further ruled that Momentum Credit Limited had no lawful basis to process Ogwena’s personal data and failed to act promptly on her objections to the messages, as required under the law.
In its defence, the company reportedly argued that the messages were sent by “rogue agents.”
However, the ODPC dismissed this claim, emphasizing that organizations are fully responsible for the actions of individuals or entities acting on their behalf.
In addition to the Kshs. 500,000 compensation, the ODPC issued an enforcement notice directing the company to take corrective measures and ensure compliance with data protection regulations going forward.
