Platinum Credit is once again under intense scrutiny after a ruling by the Office of the Data Protection Commissioner (ODPC) exposed what privacy advocates describe as a growing culture of data abuse in Kenya’s lending sector.
At the center of the case is Samuel Kamau, a Kenyan who found himself repeatedly targeted with loan marketing calls and text messages from Platinum Credit despite never applying for a loan, visiting the company, or giving consent for his personal information to be used.
The case has brought fresh attention to a troubling practice known as data inversion, where personal information collected through unknown or questionable channels is turned against the very people it belongs to.
Instead of serving the interests of citizens, their private data becomes a tool for aggressive marketing and profit-making.
According to findings by the ODPC, Platinum Credit unlawfully processed Kamau’s personal data and used his phone number for unsolicited marketing.
The company attempted to distance itself from responsibility by claiming the individual making the calls was not its agent. However, investigations by the regulator established otherwise.
The ODPC found the company liable, ordered it to pay Kamau KSh 400,000 in compensation, issued an enforcement notice, and went a step further by recommending prosecution of the company’s directors for allegedly providing false information to the regulator.
The ruling paints a worrying picture of how some lenders handle personal information. Instead of obtaining clear and informed consent before contacting potential customers, companies acquire phone numbers from unclear sources and begin relentless marketing campaigns.
For ordinary Kenyans, the result is constant interruptions, unwanted messages, and growing concerns about how their private details ended up in corporate databases.
The defense used by Platinum Credit is one regulators have increasingly rejected. Blaming agents or third parties does not remove responsibility from a company benefiting from the marketing campaign.
Under Kenya’s Data Protection Act of 2019, organizations must demonstrate that consent was freely given, informed, specific, and unambiguous. The burden of proof rests with the company, not with the individual receiving unwanted calls.
Kamau’s experience reflects complaints raised by many Kenyans over the years. Numerous people have reported receiving loan offers from institutions they have never interacted with.
Some ignore the messages. Others block numbers or change their contacts altogether. Few pursue formal complaints, allowing the cycle to continue largely unchecked.
The KSh 400,000 compensation awarded to Kamau is significant because it recognizes that privacy violations have real consequences. Unsolicited marketing is not merely an inconvenience.
It represents an invasion of personal space and a loss of control over information that should remain protected. Every unwanted call serves as a reminder that someone’s personal data may have been obtained and used without permission.
More troubling is the recommendation to prosecute Platinum Credit’s directors for allegedly misleading the regulator. Such allegations raise serious questions about corporate accountability and transparency.
If companies are willing to provide inaccurate information during investigations, public confidence in their commitment to data protection naturally comes into question.
The Platinum Credit case is bigger than one company and one complainant. It highlights a wider problem in Kenya’s digital economy where personal data is often treated as a commodity rather than a protected right.
The ruling sends a clear message that phone numbers are not free assets for lenders to exploit and that consent cannot be assumed or invented after the fact.
Kamau’s victory demonstrates that citizens can fight back when their privacy is violated. It also serves as a warning to lenders that the era of collecting data first and explaining later is increasingly becoming a costly mistake.
The real question now is whether Platinum Credit and others facing similar accusations will change their practices or continue testing the limits of Kenya’s data protection laws.
