The Office of the Data Protection Commissioner (ODPC) continues
to exercise its enforcement mandate by taking action against data
handlers in breach of the Data Protection Act, 2019 (DPA). Two
companies, Whitepath Limited and Regus Kenya, are the latest
entities to be issued with penalty notices on 11 April 2023 for
breaching certain provisions of the DPA. The ODPC communicated that
it had issued penalty notices imposing fines of KES 5 million
(approx. USD 37,053) on each of these companies. This is the
highest financial penalty under the DPA.
Whitepath, a mobile lending company, was fined on account of
complaints from its customers alleging that the digital lender had
accessed their mobile phone contacts without their consent. The
company was accused of sending unwarranted and unsolicited text
messages to the customer's contacts. Further, the complainants
(over 150 in number) alleged that Whitepath's staff had also
been harassing them and their contacts. Both these
