A POUND OF FLESH FOR 3,000 DUCATS, AND SOME DATA: AN APPRAISAL ON THE ADEQUACY OF DATA PROTECTION LAW IN DIGITAL LENDING IN KENYA

Abstract

Since the introduction of M-Shwari as a digital lender by Commercial Bank of Africa in 2012, the lending market has seen a proliferation of digital lenders that are largely unregulated. The lenders provide seemingly cheap loans whose interest is huge when the Annual Percentage Rate (APR) is calculated from the weekly, bi-weekly, or monthly payment requirements. The lenders operate through apps that are uploaded to App Stores and pulled down at will. They require their customers to ‘accept’ terms and conditions before accessing the loans, and these terms sometimes allow the lenders unfettered access to customer data which they use and abuse in equal measure. The lenders use such customer data to issue threats, to contact those on the contact lists of the customers’ phonebook, and to report them on Credit Reference Bureaus (CRBs). Based on this mode of operation, these lenders have rightfully earned the name “shylocks”.
Through the Central Bank of Kenya (Amendment) Act of 2020, the Central Bank of Kenya (CBK) has been empowered to regulate the activities of these digital lenders. However, this paper raises key concerns on such powers because the mode of operation of these digital lenders is such that the CBK may not adequately regulate them. Does the CBK have capacity to trace the uploading of the apps to App Stores to ensure that they have been uploaded there after obtaining the requisite license? What are the consequences of breach of data privacy and dignity of the customer by the digital lenders? Does the CBK have enough powers and capacity to protect consumers of these services from abuse by the digital lenders? The paper interrogates these issues within the relevant law and concludes that there is a lot more to be done as the available law is not adequate