In July 2024, Donald Mkala Ngolo filed a complaint with the Office of the Data Protection Commissioner (ODPC) after receiving persistent promotional calls and SMS messages from Platinum Credit Limited.
The complainant stated that he had never been a customer of the company, and that marketing messages continued to be sent despite multiple opt-out requests. On October 16, 2024, the ODPC ruled that Platinum Credit had violated the Data Protection Act, ordering it to pay Ngolo 1 million Kenyan shillings in compensation and take corrective measures. On February 24, 2025, the ODPC issued an enforcement notice requiring the company to complete remediation within 45 days.
Platinum Credit subsequently appealed to the High Court, arguing that the ODPC had conducted unfair and biased proceedings, and maintained that Ngolo had never been its customer and his number was not in the company’s database. The company stated that an investigation found one of the contact numbers belonged to an independent sales agent whose contract had been terminated. On August 18, 2026, the High Court in Nairobi dismissed Platinum Credit’s appeal. The judge found that the ODPC had duly considered the complainant’s allegations, the company’s responses, and the evidence, and that the awarded amount “fell within the commissioner’s reasonable discretionary scope.” The court noted that Platinum Credit had failed to prove any impropriety in the ODPC’s ruling. Additionally, Platinum Credit was fined 400,000 Kenyan shillings by the ODPC in another similar case involving Samuel Kamau Waweru.
This case marks one of the highest compensation awards for A2P SMS violations in Kenya to date, and has been upheld by the High Court as a final ruling. Companies cannot evade legal liability by attributing violations to “independent sales agents” — data controllers bear non-derogable supervisory responsibility for the actions of third-party agents.
