Credit Watch Investment Limited v Mbugua & 2 others [2024] KEHC 13703 (KLR) | Data Protection | Esheria

Credit Watch Investment Limited v Mbugua & 2 others [2024] KEHC 13703 (KLR)

Full Case Text

Credit Watch Investment Limited v Mbugua & 2 others (Civil Appeal E014 of 2024) [2024] KEHC 13703 (KLR) (Civ) (8 November 2024) (Judgment)

Neutral citation: [2024] KEHC 13703 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Civil

Civil Appeal E014 of 2024

JM Omido, J

November 8, 2024

Between

Credit Watch Investment Limited

Appellant

and

Peter Mbugua

1st Respondent

Timothy Ngome

2nd Respondent

Aggrey Timothy

3rd Respondent

(Being an Appeal from the decision of the Office of the Data Protection Commissioner delivered on 1st December, 2023 in ODPC Consolidated Complaints Nos. 1626, 1797 and 1835 of 2023; Peter Mbugua & 2 others v Credit Watch Investment Limited)

Judgment

1. The Appellant, Credit Watch Investment Limited has brought this appeal, being aggrieved by the decision of the Office of the Data Protection Commissioner delivered on 1st December, 2023 in ODPC Consolidated Complaints Nos. 1626, 1797 and 1835 of 2023; Peter Mbugua & 2 others v Credit Watch Investment Limited.

2. The Appellant has presented the following grounds of appeal vide the Memorandum of Appeal dated 3rd January, 2024:1. That the Office of the Data Protection Commissioner erred in law and fact by finding that the Appellant had violated the Respondents’ right to privacy.2. That the Office of the Data Protection Commissioner erred in law and fact by denying the Appellant had failed to fulfil its obligation as a data controller as per the terms of the Data Protection Act, 2019. 3.That the Office of the Data Protection Commissioner erred in law and fact by failing to consider all the evidence on record before it delivered its determination.4. That the Office of the Data Protection Commissioner erred in law and fact by failing to find that the Appellant did not breach the Respondents’ right to privacy as the same was under the control of the data processor which in this case was the loan borrower.5. That the Office of the Data Protection Commissioner erred in law and fact by awarding each of the Respondents compensation of Ksh.300,000/- as damages for distress when the same was not pleaded nor proven.6. That the Office of the Data Protection Commissioner erred in law and fact by failing to provide in its decision the basis, criteria and rationale by awarding each of the Respondents the sum of Ksh.300,000/- as damages.

3. This being the first appellate court, I am required under Section 78 of the Civil Procedure Act and as was espoused in the case of Sielle v Associated Motor Boat Co. Ltd [1969] E.A. 123 to reassess, reanalyze and reevaluate the evidence adduced in the Magistrate’s Court and draw my conclusions while bearing in mind that I did not see or hear the witnesses when they testified.

4. In Sielle, Sir Clement De Lestang observed that:“This Court must consider the evidence, evaluate it itself and draw its own conclusions, though in doing so it should always bear in mind that it neither heard witnesses and should make due allowance in this respect.However, this Court is not bound necessarily to follow the trial judge’s findings of fact if it appears either that he had clearly failed on some point to take account of particular circumstances or probabilities, materially to estimate the evidence or if the impression based on the demeanour of a witness is inconsistent with the evidence in the case generally.”

5. The matter before the Office of the Data Protection Commissioner (hereinafter referred to as “the ODPC”) was commenced by way of complaints filed by the 1st, 2nd and 3rd Respondents on 6th September, 2023, 27th September, 2023 and 29th September, 2023 respectively. The complaints by the three Respondents against the Appellant regarded the listing of the Respondents by the Appellant as guarantors for one Pascal Mwanje without their respective consents.

6. The three Respondents lodged the complaints pursuant to Section 56 of the Data Protection Act, 2019 and Regulation 4 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. Although the Appellants presented their complaints separately, the same were consolidated as they related to the Appellant and were of a similar nature..

7. The Respondent, a licensed digital credit provider that offered and operated a money lending product known as Cloudloan, was notified by the ODPC of the complaints filed against it by the Respondents through which it was required to respond to the complaints and provide other relevant material that was specified in the notice. The Appellant responded to the ODPC’s notification of complaint vide letters of 13th October, 2023 and 17th November, 2023

8. In support of their case, the Respondents produced several copies of printed screenshot messages sent to their cellphones by the Appellant and/or its agents on diverse dates. In precis, the messages indicated that the Respondents had been listed as the guarantors and/or emergency contacts of persons who had taken mobile loans from the Appellant through its Cloadloan mobile platform and who had subsequently defaulted.

9. The messages that the Respondents received on their cellphones demanded that the Respondents reach out to the said mobile loan defaulters as a matter of obligation as and ensure that they pay up the defaulted loan amounts. They claimed that some messages had veiled threats that unspecified action would be taken against the Respondents by the Appellant in the event that the loan defaulters did not pay up.

10. The Respondents further claimed that each had received several phone calls from different numbers from persons who stated that they were agents of the Appellant who demanded that each of the Respondents follow up the loan defaulters and ensure that the defaulted amounts were paid.

11. The Respondents generally complained that they were not consulted by the Appellant to be listed as guarantors or emergency contacts of the respective loan defaulters and were as such not privy to the agreements between the loan defaulters and the Appellant and therefore felt harassed and distressed by the incessant messages, phone calls and veiled threats.

12. In response to the complaints by the Respondents, while acknowledging that the unsolicited messages and phone calls that the Respondents received may have caused them distress, the Appellant stated that their customers were required to include secondary or emergency contacts during the application process for Cloudloan and that it was the responsibility of their customers to ensure that the emergency contacts that they provided were aware and had consented to being emergency contacts. The Appellant stated that failure to provide the emergency contacts by the loan applicants would render their applications incomplete.

13. The Appellant stated that the emergency contacts served the purposes of reaching the loan applicants in the event that the applicants could not be reached.

14. The ODPC set out the following issues for determination:i.Whether there was a violation of the Respondents’ rights under the Data Protection Act, 2019. ii.Whether the Appellant fulfilled its obligations under the Data Protection Act, 2019. iii.Whether the Respondents were entitled to any remedies under the Data Protection Act, 2019 and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

15. In its determination rendered on 1st December, 2023, the ODPC resolved all the above issues in the affirmative and in favour of the three Respondents, and proceeded to state as follows:54. The Data Commissioner therefore makes the following final determination:a.The Respondent is hereby found liable for violating the Complainant’s right to privacy and failing to fulfil its obligations under the Act;b.An Enforcement Notice be issued against the Respondent;c.An order for compensation to the Complainants of Ksh.300,000/- each by the Respondent; andd.Parties have a right to appeal this determination to the High Court of Kenya within 30 days.

16. Pursuant to the above, an Enforcement Notice under Section 58 of the Data Protection Act, 2019 and Part III of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 dated 1st December, 2023 was issued against the Appellant, who was the Respondent in the matter before the ODPC.

17. Having reanalyzed the record of the ODPC, and upon considering the grounds of appeal set out above and the submissions by the Appellant and the 1st Respondent (while noting that the 2nd and 3rd Respondents adopted and relied upon the submissions of the 1st Respondent), I deduce the issues for determination in the present appeal to be as follows:i.Whether the Appellant met its obligations under the Data Protection Act, 2019 and whether the rights of the Respondents to be informed of the use to which their personal data is to be put to as provided under Section 26(a) of the Data Protection Act were violated by the Appellant.ii.Whether the amount assessed and awarded as compensation to the three Respondents was in error and/or inordinately high or excessive.

18. What is not in dispute is that the Appellant and/or its agents listed the three Respondents as emergency contacts for the respective loan applicants who subsequently defaulted in the repayment of the loans. The Appellant did not seek the consents of the three Respondents to list them as such.

19. It is also not in dispute that the Appellant and/or its agents sent several text messages and made several phone calls to the Respondents, asking them to ensure that the loan defaulters repaid the defaulted loans and notified them of impending or intended unspecified consequences if the same was not done.

20. The argument that the Appellant fronted was that as part of the conditions before the loan facilities would be advanced, the borrowers were required to provide the emergency contacts to the Appellants. The Appellant further argued that the obligation to obtain the consents of the emergency contacts lay on the loan applicants and that the sole purpose of the emergency contacts was to ascertain the whereabouts of the borrowers in the event that the Appellant was unable to reach them.

21. That in the present matter, the borrowers defaulted on the repayment of the loans necessitating the Appellant to reach out to the emergency contacts in an attempt to trace the borrowers.

22. In the submissions filed by the Appellant, it was urged that the circumstances of the case provided a clear scenario where the Respondents, having given their respective consents for their data to be submitted to the Appellant as emergency contacts, were aware that their data had effectively been shared with the Appellant. The Appellant therefore took the position that it duly complied with Sections 28 and 29 of the Data Protection Act, 2019, which provides as follows:28. Collection of personal data(1)A data controller or data processor shall collect personal data directly from the data subject.(2)Despite subsection (1), personal data may be collected indirectly where—(a)the data is contained in a public record;(b)the data subject has deliberately made the data public;(c)the data subject has consented to the collection from another source;(d)the data subject has an incapacity, the guardian appointed has consented to the collection from another source;(e)the collection from another source would not prejudice the interests of the data subject;(f)collection of data from another source is necessary—(i)for the prevention, detection, investigation, prosecution and punishment of crime;(ii)for the enforcement of a law which imposes a pecuniary penalty; or(iii)for the protection of the interests of the data subject or another person.(3)A data controller or data processor shall collect, store or use personal data for a purpose which is lawful, specific and explicitly defined.

29. Duty to notifyA data controller or data processor shall, before collecting personal data, in so far as practicable, inform the data subject of—(a)the rights of data subject specified under Section 26;(b)the fact that personal data is being collected;(c)the purpose for which the personal data is being collected;(d)the third parties whose personal data has been or will be transferred to, including details of safeguards adopted;(e)the contacts of the data controller or data processor and on whether any other entity may receive the collected personal data;(f)a description of the technical and organizational security measures taken to ensure the integrity and confidentiality of the data;(g)the data being collected pursuant to any law and whether such collection is voluntary or mandatory; and(h)the consequences if any, where the data subject fails to provide all or any part of the requested data.

23. The Appellant thus took the stand that the ODPC fell into error in reaching the determination that the Appellant breached the provisions of the Data Protection Act and that the Respondents did not discharge the burden of proving their complaints on a balance of probabilities, under Section 107 of the Evidence Act, which provides that:107. Burden of proof.(1)Whoever desires any court to give judgment as to any legal right or liability dependent on the existence of facts which he asserts must prove that those facts exist.(2)When a person is bound to prove the existence of any fact it is said that the burden of proof lies on that person.

24. Section 26(a) of the Data Protection Act, 2019 provides that a data subject has a right to be informed of the use to which their personal data is to be put. Personal data is under Section 2 of the same statute defined as any information relating to an identified or an identifiable natural person. In respect of the instant appeal, the Respondents were data subjects with rights under Section 26 of the Act in so far as their details and phone numbers were concerned, which numbers and other details such as names well qualified to be personal data.

25. It was not disputed that the Appellant was a data controller and a data processor within the definition of Section 2 of the Act. As a data controller and processor, the Respondent had an obligation under Section 25 of the Act to ensure that the Respondents’ data was protected and processed in accordance with the right to privacy of the Respondents.

26. It is instructive from the Appellant’s response that it collected the Respondents’ personal data from third parties (the borrowers) and did not have any mechanism of ascertaining that the Respondents had given their consents for their personal data to be used and the purpose for which the same was to be used. Rather, the contention of the Appellant was that it relied on the third parties, whom, as per its position, are the ones who had the obligation to obtain the consents of the Respondents.

27. As we have seen above, Section 26(a) of the provides that a data subject has a right to be informed of the use to which their personal data is to be put. My interpretation and understanding of the provision is that the obligation to inform a data user the use to which his personal data is to be put solely lies with the person or party that so intends to use the data subject’s personal data. To take the Appellant’s argument and submission that it used the Respondent’s personal data on the strength of the belief that the borrowers had obtained the Respondents’ consents for such use would be to abrogate the Appellant’s statutory obligations under Section 26(a) of the Act. I say so because the entity that was to use tha personal data as a data controller or processor in the present case was the Appellant and not the borrowers.

28. Moreover, Section 28(1) of the Act makes it mandatory that a data controller or processor is required to collect personal data directly from the data subject. Therefore, to proffer the position that the Respondents’ personal data was collected by the borrowers and submitted to the Appellant, was clearly a violation of the above provision.

29. The issue of the Respondent’s knowledge (or lack of it) that their personal data had been submitted to the Appellant aside, it is to be noted that the presentation that the Appellant made to the ODPC in defence of the complaints was that the purpose of collecting the Respondent’s personal data from the borrowers was to follow up on the whereabouts of the borrowers in the event that they could not be reached on phone.

30. But then, the several text messages that the Respondents received from the Appellant’s agents tell a different story. A look at the text messages makes it clear to me that the same were not sent by the Appellants and/or its agents to seek to find out the whereabouts of the borrowers. The messages generally had the effect of asking the Respondents to ensure that the borrowers paid up the defaulted loans.

31. As a matter of fact, some of the text messages that were sent to the Respondents warned them of unspecified consequences if they did not ensure that the loans were paid. Without a doubt, this went beyond making a follow up on the whereabouts of the borrowers in the event that they could not be reached on phone. That again amounted to a violation of Section 26(a) of the Act as there was no information given by the Appellant to the Respondents that the same would be used for the purpose or requiring the Respondents to pursue the defaulters of the loans and ensure that they paid up.

32. From my analysis above, I cannot fault the ODPC’s determination that the Respondents’ rights to be informed of the use to which their personal data was to be put under Section 26(a) of the Act were violated. The Appellant, as I have found, also went afoul of Section 28(1) of the Act.

33. The other issue for this court to determine is whether the amount assessed and awarded as compensation to the three Respondents was in error and/or inordinately high or excessive.

34. Compensatory damages are awarded to a wronged party in exercise of the court’s discretion. The principles upon which an appellate court can interfere with judicial discretion were laid down in the case of Price & another v Hidler [1996] KLR 95 as follows:“The court will not interfere with the exercise of discretion by an inferior court unless its satisfied that its decision is clearly wrong, because it has acted on matters on which it should not have acted or because it has failed to take into consideration matters it should have taken into consideration and in doing so arrived at a wrong decision.”

35. Further, in the case of Gitobu Imanyara & 2 others v Attorney General [2016] eKLR the Court of Appeal while discussing the principles upon which an appellate court may disturb an award of damages by an inferior court held that:“…it is firmly established that this Court will be disinclined to disturb the finding of a trial Judge as to the amount of damages merely because they think that if they had tried the case in the first instance they would have given a larger sum. In order to justify reversing the trial Judge on the question of the amount of damages it will generally be necessary that this Court should be convinced either that the Judge acted upon some wrong principle of law, or that the amount awarded was so extremely high or so very low as to make it, in the judgment of this Court, an entirely erroneous estimate of the damage to which the plaintiff is entitled. This is the principle enunciated in Rook v Rairrie [1941] 1 All ER 297. It was echoed with approval by this Court in Butt v Khan [1981] KLR 349 when it held as per Law, J.A that:“An appellate court will not disturb an award of damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect, and so arrived at a figure which was either inordinately high or low.”

36. There is also the authority of Mbogo & Another v Shah [1969] EA 93, where it was held, inter alia, that:“An appellate court will interfere if the exercise of the discretion is clearly wrong because the judge has misdirected himself or acted on matters which he should not have acted upon or failed to take into consideration matters which it should be taken into consideration and in doing so arrived at a wrong conclusion. It is trite law that an appellate court should not interfere with the exercise of the discretion of a judge unless satisfied that the judge in exercising his discretion has misdirected himself and has been clearly wrong in the exercise of the discretion and that as a result there has been injustice.”

37. In the present appeal, the Appellant merely stated that the awards in compensation that were made in favour of the Respondents were too high. The Appellant did not proffer and/or demonstrate to this court the ground that the exercise of the discretion by the ODPC was clearly wrong or that the ODPC misdirected itself or acted on matters which it should not have acted upon or failed to take into consideration matters which it should have taken into consideration and in doing so arrived at a wrong conclusion. There is therefore no basis upon which I can interfere with the discretion of the ODPC.

38. On the point that there was no lawful basis for ordering for compensation, the Latin maxim ubi jus ibi remedium postulates that where the law has established a right, there is a corresponding remedy for the breach of that right. Put in another way, for every wrong, the law provides a remedy. The argument that the Respondents did not specifically seek for compensation does not therefore hold. Noteworthy is the fact that the manner in which a party lodges a complaint to the ODPC does not include pleadings in which the specific prayers would be set out.

39. I have above reached the findings that the Respondents’ rights were violated and that they suffered damage as a result of the violation, and further that there was non-compliance by the Appellant of its statutory obligations. The question that then calls for an answer is whether the ODPC was within the law to award compensation to the Respondents.

40. The ODPC, where the rights under the Act are violated and where the data controller/processor violates its obligations under the Act, is within the law, particularly under Section 65(1) of the Act to order for compensation for the damage suffered by a data subject as a result of the violation of the rights by a data controller/processor; or failure by a data controller/processor to meet its statutory obligations resulting in damage to a data subject.

41. Under Section 65(4) of the Act, damage includes financial loss and damage not involving financial loss, which includes distress. Further, Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 permits the ODPC to make an order for compensation to the data subject. This court then reaches the persuasion that the ODPC cannot be faulted for making an order of compensation to the three Respondents who, as admitted by the Appellant, suffered distress, as the law allows the ODPC to grant such a remedy.

42. Having determined the issues before me and being of the foregoing inclinations, I find the appeal herein to be devoid of merit and proceed to dismiss it. The determination of the ODPC dated 1st December, 2023 made pursuant to Sections 8(f) and 56 of the Data Protection Act, 2019 and Regulation 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 is hereby upheld.

43. Section 27 of the Civil Procedure Act, Cap 21 Laws of Kenya dictates that costs ought to follow the event. Consequently, the Appellant shall bear the Respondents’ costs of the appeal.

DELIVERED (VIRTUALLY), DATED & SIGNED THIS 8TH DAY OF NOVEMBER, 2024. JOE M. OMIDOJUDGEFor The Appellant: Mr. Dachi For Ms. Simaloi.For The 1St Respondent: Mr. Ekesa For Mr. Ojou.For The 2Nd & 3Rd Respondents: Mr. Ekesa For Mr. Gor.Court Assistant: Ms. Njoroge.