In this episode of The Friendly Troll Podcast, host Josephine Kaaniru is joined by Mr. Kevin Mutiso, Chair of the Digital Financial Services Association of Kenya (DFSAK), to explore how the digital lending industry has evolved with regard to privacy practices, due to the enforcement of the Data Protection Act.

With just a smartphone and an ID number, Kenyans can access loans in minutes, no collateral, no bank branch, no guarantor needed. This convenience has made digital lending apps central to Kenya’s financial inclusion story. By some estimates, about 14% of Kenyan adults had taken a digital loan by 2019. But that convenience has always come with a less visible cost to borrowers: their right to privacy.

To decide whether to lend money, these apps don’t just assess income data. They analyse contacts, SMS messages, location history, browsing behaviour, and sometimes even call log data. They make decisions about creditworthiness using algorithms that remain opaque to users, and they often share data with third parties users may not even be aware of. As such, the conversation with Mr Kevin Mutiso reflects on how far the industry has come, and what still needs to change before Kenyan borrowers can access credit without compromising their privacy.

Resources

Report – Privacy and Data Protection Practices of Digital Lending Apps in Kenya- https://cipit.strathmore.edu/privacy-and-data-protection-practices-of-digital-lending-apps-in-kenya-report/
Guidance Note for Digital Credit Providers - https://www.odpc.go.ke/wp-content/uploads/2024/02/ODPC-Guidance-Note-for-Digital-Credit-Providers.pdf
ODPC Press Release, “ODPC to Audit 40 Digital Lenders And Issues Enforcement Notice Against A Health Service Provider” - https://www.odpc.go.ke/wp-content/uploads/2024/02/Approved-Press-Release-on-DCP039s-and-Health-Provider-1-1.pdf
Digital Financial Services Association of Kenya - https://www.dfsak.co.ke/

Don’t forget to subscribe for more episodes!

Music: Intro/Outro – https://pixabay.com/music/id-102694/

Financial Inclusion vs. Data Protection: Can We Have Both?