https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/6200

Ceres Tech Ltd v Office of the Data Protection Commissioner (Civil Appeal E166 of 2025) [2026] KEHC 6200 (KLR) (Civ) (7 May 2026) (Judgment) Neutral citation: [2026] KEHC 6200 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E166 of 2025 WA Okwany, J May 7, 2026 Between Ceres Tech Limited Appellant and Office of the Data Protection Commissioner Respondent (Being an appeal from the determination of the Office of the Data Protection Commissioner (ODPC) dated 15th January 2025) Judgment Background 1.The Complainant herein, one Anthony Mwendwa Kinoti, filed a complaint before the Respondent alleging that the Appellant had unlawfully processed his personal data and demanded repayment of a loan he had neither applied for nor received. 2.On 3rd September 2024, the Respondent discontinued the original complaint on the basis that it constituted fraud thus falling outside its mandate. Subsequently, on 18th October 2024, the Complainant reinstated the complaint pursuant to Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations, alleging violations of his right to privacy. 3.The Respondent notified the Appellant of the reinstated complaint through a letter dated 19th December 2024 in which it granted the Appellant 21 days to respond. 4.The Appellant did not file a response and on 15th January 2025, the Respondent issued a determination finding violations of Sections 25, 26, 28, 29, 30 and 41 of the Data Protection Act ( the Act) and awarded the Complainant Kshs. 700,000 as compensation. 5.The Appellant was aggrieved by the said decision and filed this appeal challenging both the process and substance of the determination. The Appellant avers that the Respondent acted without jurisdiction, misapplied the law, misapprehended the facts, violated Article 47 of the Constitution, and imposed an arbitrary and disproportionate penalty. 6.The Respondent, on its part, maintained that the decision is lawful, procedurally fair, and properly grounded in statute. 7.The appeal was canvassed by way of written submissions which I have considered. The Appellant’s Submissions 8.The Appellant submitted that the Respondent lacked jurisdiction to determine the complaint, having earlier discontinued it on the ground that it concerned fraud which is a matter outside the Respondent’s statutory mandate. It is contended that the subsequent reinstatement and determination violated the doctrines of legal certainty, legitimate expectation, and ultra vires action. 9.The Appellant further argued that the Respondent misapplied the Data Protection Act, failed to distinguish identity fraud by a third party from unlawful data processing, and improperly imposed liability without proof of intent or negligence. The Appellant maintained that no evidence was adduced to show unlawful collection, processing, or transmission of personal data attributable to it. 10.It is also submitted that the Respondent violated Article 47 of the Constitution by relying on unverified and selective evidence, failing to consider exculpatory material, and denying the Appellant a fair and reasonable administrative process. 11.The Appellant contended that the award of Kshs. 700,000 was arbitrary and disproportionate. It added that the award was imposed without a structured assessment of culpability, harm, or mitigating factors, and should be set aside with costs. The Respondent’s Submissions 12.The Respondent submitted that it acted within jurisdiction, emphasizing that the appeal concerns the reinstated complaint, not the original complaint that had been discontinued. It argued that Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations expressly empowers the Respondent to reinstate a complaint upon provision of additional material. 13.The Respondent maintained that the Appellant was duly notified of the reinstated complaint, granted sufficient time to respond, and failed to do so, thereby entitling the Respondent to proceed to determination based on the available evidence. 14.It was further submitted that investigations established multiple violations of the Data Protection Act, including unlawful collection, inaccurate processing, failure to notify the data subject, and continued processing despite objection. The Respondent contended that these actions infringed the Complainant’s constitutional right to privacy. 15.On compensation, the Respondent submittd that Section 65 of the Act grants discretion to award compensation for both financial and non-financial harm, and that the award of Kshs. 700,000 was reasonable, justified, and aimed at vindicating the Complainant’s constitutional rights. The Respondent urged the Court to dismiss the appeal with costs. Issues for Determination 16.Having considered the record and the parties’ submissions, I find that the following issues arise for my determination: -a.Whether the Respondent had jurisdiction to determine the complaint;b.Whether the Respondent violated Article 47 and principles of fair administrative action;c.Whether the Respondent misapplied the Data Protection Act, 2019;d.Whether the penalty imposed was arbitrary and disproportionate. Analysis and Determination Jurisdiction 17.It is trite that jurisdiction is everything without which a court cannot act or move one more step. (See Owners of the Motor Vessel “Lillian S” vs. Caltex Oil (Kenya) Ltd (1989) KLR 1.) 18.In Samuel Kamau Macharia & Another vs. Kenya Commercial Bank Ltd & 2 Others [2012] eKLR, the Supreme Court stated that: -“A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the Constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law.” 19.In this case, it was not disputed that the Respondent carried out its own investigations on the complainant’s initial complaint and found that the said complaint, as presented, amounted to fraud and fell outside its mandate. The Respondent stated as follows, in part, in its letter dated 3rd September 2024 discontinuing the complainant’s initial complaint: -“Upon review of the complaint, the evidence adduced and investigations carried out by the Office, the Office found no link between the mobile phone number 0785690785 allegedly used to contact the Complainant, and Ceres Tech Limited T/A as Rocket Pesa. An examination of Ceres Tech Limited’s database did not reveal the aforesaid mobile phone number or any information related to the Complainant including his name, mobile phone number and National Identification Number. No records were found on the Respondent’s database indicating that the Complainant had a loan with the Respondent. Additionally, the mobile phone number 0727200234 that was allegedly used to obtain the loan did not appear on the Respondent’s database.The Office notes that this is a case of fraud which is not within the mandate of the Data Commissioner and therefore advice that it be pursued through the Directorate of Criminal Investigations (DCI) – Cybercrimes Unit.This is therefore to communicate the decision of the Office to discontinue the complaint filed against Ceres Tech Limited in line with Regulation 7(1)(a) of the Regulations. However, you may re-institute this complaint upon providing grounds for the restitution.” 20.Through his letter to the Respondent dated 18th October 2024, the complainant sought the reinstatement of the complaint against the Appellant on the basis that he had secured additional material allegedly disclosing violations of his right to privacy. In the said letter, the complainant informed the Respondent that he had earlier reported the case to the Director of Criminal Investigations (DCI) Cybercrimes Unit, which carried out investigations and produced findings that support the reinstatement of the complaint. 21.The complainant alleged that the Appellant breached the Data Protection Act by giving false and misleading information, particularly by denying any link to the phone numbers involved and claiming that the loan was not obtained through their system yet the DCI investigations led to the arrest of the owner of the number used to obtain the loan, who confessed to receiving and settling the loan. 22.The complainant presented an Mpesa statement confirming an alleged payment of Kshs. 8,000 to RocketPesa through the Appellant’s Paybill number and argued that this evidence proved the Respondents’ involvement and wrongdoing. He cited similar determinations by the Respondent and legal principles to support his claim, and stated that the experience has caused him emotional and financial distress. He urged this court to compel the Appellant to pay him Ksh 3,000,000 in damages and that a fine of Ksh 5,000,000 be issued against them under the Data Protection Act. 23.Upon receipt of the complainant’s second complaint, the Respondent alleged that he wrote to the Appellant on 19th December 2024 informing it to respond to the said complaint within 21 days from the date of service with the complaint. From the record, it is not clear if the Appellant was served with the said order and second complaint. 24.On 18th December 2024, the Respondent sought and obtained the following orders in Milimani MCCRMISC No. E4657 of 2024: -“a)That search warrant is hereby issued to Maryanne Serem, an Investigating officer, with the Data Protection Commissioner, or any other officer attached to the and authorized by the applicant, to have access to, inspect/investigate, obtain information, lift and carry away as exhibits certified copies of the respondent's digital and manual records, system(s) database (s) pertaining to the complaint under investigation of the following personal data:-Mobile Number- 0708xxxx61Mobile Number- 0727xxxx34Mobile Number- 0785xxxx85Name- kelvin Gitobu KirimiName -Antony Mwenda kinotiNational Identification NO. 31xxxx75b.That the orders of this honorable court be served upon the relevant Director/Manager of the respondent herein.” 25.It is however not clear, from the record, if the Respondent conducted the investigations as stated in the said court order or at all. The record contains an investigations report dated 10th January 2025 which reveals that the evidence the Respondent collected were: -i.Screenshot of the Complainant’s text messages as provided;ii.Screenshot of the Paybill number 40xxx15 registered under the Appellant’s name. 26.The Respondent’s investigators concluded that: -i.The Appellant committed an offence under Section 57 (3) of the Act by providing false information to the Respondent’s office during the course of the investigations;ii.The Appellant violated the Complainant’s rights;iii.The Appellant has failed to provide a response to the re-instituted complaint (2nd Notification letter) dated 19th December 2024. 27.The said investigators recommended the Appellant’s prosecution for committing an offence under Section 57 of the Act, an order for compensation of the Complainant and the issuance of an Enforcement Notice upon the Appellant. 28.The Respondent acted on its investigators’ recommendations by making a Determination dated 15th January 2025 in which it issued the following orders that are the subject of this appeal: -i.The Respondent is hereby found liable for violating the Complainant’s right to be informed of the use to which his personal data was to be put, his right to object to the processing of his personal data, and for unlawfully processing the Complainant’s personal data.ii.A recommendation for prosecution is hereby made to the Director of the Respondent’s Company, for obstruction of the Data Commissioner in exercise of their powers and giving the Data Commissioner information which is false and misleading in any material aspect, pursuant to Sections 61(a) & (d) of the Act.iii.An enforcement notice to hereby be issued to the Respondent.iv.The Respondent is hereby ordered to pay the Complainant Kenya Shillings Seven Hundred thousand (KES 700,000) as compensation.v.Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days. 29.From the above narration of the sequence of events that culminated in the Respondent’s impugned decision and my observation that is not clear if the Appellant was served with 2nd Complaint and the court order dated 18th December 2024, I find that the entire process undertaken by the Respondent was not transparent. I also find that the Respondent violated Article 47 of the Constitution which guarantees lawful, reasonable, and procedurally fair administrative action. 30.In Judicial Service Commission vs. Mbalu Mutava & Another [2015] eKLR, it was held that fair administrative action includes notice of the charge, adequate time to respond, and a hearing by an impartial tribunal. 31.In the present case, it is not clear, from the record, if the Appellant was served with the reinstated complaint and/or the letter dated 19th December 2024 allegedly requiring it to respond within 21 days. The absence of proof of service is a material defect which goes to the root of the process. 32.The Respondent proceeded on the assumption that the Appellant had not responded to the complaint and relied on that assumption to make far-reaching conclusions and impose liability and compensation against the Appellant. 33.It is also noteworthy that the Respondent rendered its determination on 15th January 2025, which was less than one month after the alleged letter notifying the Appellant of the reinstated complaint. This court takes judicial notice of the fact that the period in question included the December holiday season when many institutions scale down or shut down their operations. 34.In the circumstances of this case, I find that the Respondent’s process was rushed, opaque and did not meet the constitutional standard of fairness required under Article 47. 35.As I have already noted in this judgment, the Respondent’s evidence, as contained in its investigations report dated 10th January 2025, was limited to screenshots of the Complainant’s text messages and Paybill number 4096615 allegedly registered under the Appellant’s name. With tremendous respect to the Respondent, I find that such evidence, without more, could not form a proper basis for the far-reaching findings made against the Appellant, including unlawful processing of personal data, obstruction, and recommendation for prosecution. 36.I have perused an M-Pesa statement dated 15th October 2024 that the Complainant relied upon to advance the claim that his personal data was unlawfully processed to demand a loan that he neither applied for nor received. I note that the said statement is in the name of one of one Kelvin Gatobu Kirimi who was not the Claimant before the Respondent. No material was placed before this court to show the nexus between the said Kelvin Gatobu and the Complainant or the Appellant for that matter. It is instructive to note that the Respondent arrived at the conclusion that Appellant unlawfully processed the Complainant personal data without establishing any direct link between Complainant and the Appellant. 37.The Respondent did not demonstrate that it conducted any meaningful investigation pursuant to the court order dated 18th December 2024. The Respondent further failed to demonstrate that it established, on evidence, unlawful processing attributable to the Appellant as opposed to identity fraud by a third party. It is also noteworthy that while the basis of the Complainant’s reinstitution of the 2nd complaint was that investigations carried out by the DCI had revealed that the Appellant was responsible for the false demand for loan repayments, no such report by the DCI was filed before the Respondent to confirm the allegations. 38.I further note that the Respondent did not address the Appellant’s consistent position that the incident arose from fraudulent impersonation by a third party. My finding is that the Respondent’s reliance on unverified evidence, without confronting exculpatory material, violated the principle of audi alteram partem. In Kenya Data Networks Ltd vs. Benson Kinyua [2013] eKLR, it was held that regulators must not only act fairly but must ensure that the facts underlying enforcement action are accurate and comprehensive. In the present case, it is apparent that the Respondent did not carry out any meaningful investigations but merely relied on the fact that the Appellant did not file a response to the 2nd complaint and went ahead to make the impugned determination. 39.My finding is that the Respondent acted ultra vires its statutory jurisdiction. I say so because while it is true that Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations allows a complainant to reinstitute a complaint upon providing further material, such reinstatement does not oust the Respondent’s duty to ensure that investigations are meaningful, credible and fair. 40.It is trite that where statutory bodies, such as the Respondent herein, exercise powers beyond those conferred by law, then such actions are null and void for want of jurisdiction. (See Owners of the Motor Vessel “Lillian S” case (supra). In this case, the Respondent previously discontinued the complaint on the express basis that the matter amounted to fraud and fell outside its mandate. I find that even though the complainant later presented alleged additional material, the Respondent was still under a constitutional and statutory duty to ensure that any subsequent handling of the complaint complied with the threshold of fair administrative action and the minimum standards of procedural fairness. 41.The Respondent was further obligated to comply with the rules of natural justice before making adverse findings against the Appellant, including the right to adequate notice and opportunity to be heard. Whether the Data Protection Act was Misapplied 42.The Respondent’s determination cited violations of Sections 25, 26, 28, 29, 30 and 41 of the Data Protection Act. My view is that for such findings to stand, there must be credible evidence showing that the Appellant collected, processed, disseminated, or retained the Complainant’s personal data in a manner inconsistent with the Act. 43.In the absence of verified evidence showing the link between the alleged communications, the alleged loan demand, and the Appellant’s actual systems or records, I am not persuaded that the Respondent discharged the burden necessary to justify the findings made. 44.While the Respondent argued that the Appellant failed to respond to the reinstated complaint, failure to respond alone cannot operate as conclusive proof of wrongdoing. As I have already stated in this judgment, the Respondent still had a duty to carry out investigations and establish the alleged unlawful conduct on evidence. 45.I therefore find that the Respondent misapprehended the facts and misapplied the Act as against the Appellant. Whether Compensation of Kshs. 700,000 Was Arbitrary 46.The Respondent awarded the complainant Kshs. 700,000 as compensation. 47.I find that while Section 65 of the Data Protection Act allows an award of compensation, such compensation must be grounded on evidence, must be rational, and must follow a fair process. 48.Having regard to my finding that the Respondent’s process was not transparent, lacked proof of service, relied on unverified evidence, and violated Article 47 and natural justice, I find that the award of Kshs. 700,000 was not sustainable. 49.I further find that the Respondent’s orders recommending prosecution and issuing enforcement measures were reached without adequate investigations and cannot stand in the circumstances of this case. Disposition 50.In the end, I find that the appeal has merit and I therefore make the following orders: -a.The appeal is hereby allowed.b.The determination of the Office of the Data Protection Commissioner dated 15th January 2025 is hereby set aside in its entirety.c.Any consequential orders arising from the said determination, including the award of Kshs. 700,000, the recommendation for prosecution, and enforcement notice are hereby vacated.d.The matter is hereby remitted back to the Office of the Data Protection Commissioner for reconsideration and determination afresh, subject to compliance with Article 47 of the Constitution, the Fair Administrative Action Act, and the rules of natural justice, including proof of service and meaningful investigations.e.Each party shall bear its own costs. 51.Orders accordingly. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 7TH DAY OF MAY 2026.HON W. A. OKWANYJUDGEIn the presence ofNo appearance for AppellantNo appearance for RespondentMwaura for Interested PartyAbdirzak - Court Assistant