A loan app messages everyone in your contacts. A shop shares your phone number with marketers. Your photo appears somewhere you never agreed to. Kenya has a law for this: the Data Protection Act, 2019, enforced by the Office of the Data Protection Commissioner (ODPC).
Your rights. Section 26 of the Act gives you the right to:
- be told how your personal data is being used;
- access the personal data an organisation holds about you;
- object to your data being processed;
- have false or misleading data corrected;
- have data deleted where there is no lawful reason to keep it.
Organisations that collect your data (the Act calls them "data controllers" and "data processors") must have a lawful reason to process it, collect only what they need, keep it secure, and not use it for purposes you were not told about.
Step 1: write to the organisation
Send a short email or letter saying what happened, which right you are using (for example, "I object to the processing of my data" or "please delete my data"), and asking for a reply. Keep a copy and note the date.
Step 2: collect evidence
Screenshots of messages, call logs, emails, the app's name and your account details. If a loan app contacted people in your phonebook, ask them to send you screenshots too.
Step 3: file a complaint with the ODPC
Complaints are free and can be lodged online through the ODPC website or in person. Describe what happened, attach your evidence and say what you want: for the misuse to stop, data to be deleted, or compensation. The Act requires the ODPC to conclude an investigation within 90 days.
What the ODPC can do. It can order an organisation to comply, issue penalty notices with fines, and order compensation to a person who suffered damage, including distress (section 65). In recent years it has fined digital lenders and other businesses for exactly the kind of debt-shaming and data misuse described above.
Tips
- Don't delete the app or the messages before you have screenshots.
- Complain even if you still owe the lender money. Owing a debt does not give anyone the right to shame you or misuse your contacts.
Read our full ODPC guide, or ask Ask Haki to help you draft your complaint.