Catherine Wairimu Gabriel v Umba Microfinance Bank

Complaint upheld; enforcement notice conditional. ODPC, 4 September 2024.

Record ID

ke-odpc-2024-0081

Case reference

ODPC Complaint No. 803 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Catherine Wairimu Gabriel

Date decided

4 September 2024

Respondent type

private

Sector

banking

Violations

lack of consent, commercial use of personal data, unlawful processing

Provisions cited

s.25 DPA 2019, s.28(b) DPA 2019, s.37 DPA 2019, s.37(1) DPA 2019, s.56(1) DPA 2019, s.56 DPA 2019

Outcome

complaint upheld; enforcement notice conditional

Status

final

Source

Official document ↗

Source integrity

SHA-256 b058c3c28a79dfdb…

Record verified

30 July 2026

The facts

The complainant alleged that Umba Microfinance Bank sent her a direct marketing message without her knowledge or consent. She told the Office the remedy she sought was for the respondent to message only people who had directly contacted it. The ODPC found the respondent liable.

Orders and outcome

The respondent was ordered to erase the complainant's personal data from its records and stop sending her direct marketing messages, with proof of compliance to the Office within fourteen days of service of the determination, failing which an enforcement notice would issue. No compensation was ordered. Dated September 2024.

BANKING · CONSENT · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.