https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/7645

DMI Education Serviced Ltd t/a St. Joseph International Science School v BO (Suing on Behalf of E. Legal Guardian of KDA Minor) (Civil Appeal E419 of 2025) [2026] KEHC 7645 (KLR) (Civ) (2 June 2026) (Judgment) Neutral citation: [2026] KEHC 7645 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E419 of 2025 AN Ongeri, J June 2, 2026 Between DMI Education Serviced Ltd t/a St. Joseph International Science School Appellant and BO (Suing on Behalf of E. Legal Guardian of KDA Minor) Respondent (Being an appeal from the determination and order of the Data Commissioner at Nairobi (Immaculate Kassait, CBS) delivered on 4th February, 2025 in ODPC Complaint NO 1824 of 2024) Judgment 1.The Data Commissioner made a determination that the Appellant was liable for using a minor’s personal data without express consent. 2.The Commissioner first outlined the background, noting that a complaint was received on 9 December 2024 regarding the use of a minor’s image on an advertisement billboard without parental consent. 3.The Office notified the Appellant school of the complaint by letter dated 9 December 2024 and requested a response and relevant documentation, but the Commissioner found that the Appellant did not reply to this notification. 4.The Commissioner then established that the undisputed facts were that the Appellant had taken the minor’s photograph while introducing a new school uniform and placed that image on a banner or mini-board to advertise the uniform to the school population, although the banner had since been pulled down. 5.The main issue was whether the Appellant had obtained express consent from the minor’s parent to process the minor’s personal data for commercial purposes. 6.The Commissioner applied Section 33 of the Data Protection Act, which prohibits processing a child’s personal data unless consent is given by the parent or guardian, and Section 30(1)(a), which requires data subject consent for processing. 7.Furthermore, Section 37(1)(a) was cited, which prohibits using personal data for commercial purposes without express consent. 8.The Commissioner noted that under Section 32(1), the burden of proof for establishing consent rests upon the data controller. 9.The Appellant failed to adduce any evidence of consent from the minor’s parent and the Commissioner found that the Appellant had not discharged this burden. 10.Consequently, the Commissioner determined that the Appellant did not obtain express consent to process the minor’s personal data for commercial purposes. 11.On the issue of remedies, the Commissioner noted that the complainant sought compensation and that Regulation 14(3)(e) of the Enforcement Regulations permits an order for compensation. 12.Having found the Appellant liable for using the minor’s personal data without express consent, the Commissioner ordered the Appellant to pay the minor’s parents an amount of Kshs. 700,000. 13.The parties were advised of their right to appeal to the High Court within thirty days. 14.The Appellant has appealed against the determination by the Commissioner on the following grounds;i.That the Data Commissioner erred in law and in fact by proceeding to render a unilateral Determination on the Respondent's Complaint without satisfying herself as to whether the Complaint and/or any other Notification had properly been served upon the Appellant to enable it generate a Response to the Complaint.ii.That the Data Commissioner erred in law and in fact by proceeding to unilaterally arrive at a Determination as against the Appellant despite there being no evidence to the effect that service and/or notification was effected as by law required to enable the Appellant confront its accuser.iii.That the Data Commissioner erred in law and in fact by failing to consider the implications of her unilateral Determination without necessarily taking into account the fact that the Appellant is likely to suffer untold prejudice and injustice.iv.That the entry of the Determination without the involvement of the Appellant herein was farfetched in the circumstances and the learned Data Commissioner disregarded the basic tenets underscoring the right to a fair hearing and thus overstretched her discretion, consequently affecting contentious and substantive issues without giving due consideration of the Appellant's position in the matter.v.That the award of Kes. 700,000/- was excessive and highly punitive in the circumstances. 15.The parties filed written submissions in the appeal as follows; The Appellant submitted that it is appealing against the entire determination rendered on February 4, 2025, by the Office of the Data Protection Commissioner (ODPC) in Complaint No. 1824 of 2024, which was brought by Benjamin Ouma on behalf of a minor. 16.The main grievance of the appeal is that the Data Commissioner made a unilateral decision and proceeded ex parte without satisfying herself that the Appellant had been properly served with the complaint, thereby denying the school an opportunity to respond. 17.The Appellant supports this by providing evidence in its Record of Appeal that the school had already closed for holidays at the time the complaint was allegedly served. 18.By condemning the Appellant unheard, the ODPC is said to have committed a procedural flaw that directly violates the fundamental right to a fair hearing guaranteed under Article 50(1) of the Constitution, as well as the provisions of the Data Protection Act and its 2021 Complaints Handling Procedure and Enforcement Regulations. 19.To reinforce this principle of natural justice, they cited Judicial Service Commission v Mbalu Mutava & Another [2015] eKLR , highlighting that the right to be heard is sacrosanct whenever adverse orders are contemplated. 20.Furthermore, the Appellant challenges the financial aspect of the determination, arguing that the award of Kes 700,000 in damages is excessive, punitive, and entirely unsupported by a proportionality analysis or a consideration of the school's version of events. 21.Relying on Kenya Power & Lighting Company Ltd v Nathan Karanja Gachoka & another [2016] KEHC 1362 (KLR), the Appellant notes that damages must be commensurate with actual harm suffered and that courts should interfere with punitive, unsubstantiated awards. 22.Invoking Peters v. Sunday Post Ltd. to demonstrate the authority of appellate courts to rectify decisions that occasion a miscarriage of justice, the Appellant contends that this case clearly meets the threshold for judicial intervention. 23.The Appellant asserts that the ODPC's determination is legally unsustainable and severely impacts its operations and standing. 24.Consequently, the school prays that the High Court allow the appeal, set aside the determination in its entirety, reinstate the original complaint dated November 7, 2024, to allow the Appellant to file a response for a merit-based hearing, and award the Appellant the costs of the appeal. 25.The Respondent submitted that he opposed appeal brought by the Appellant, DMI Education Services (trading as St. Joseph International Science School). 26.The appeal arises from a February 4, 2025 determination by the Office of the Data Protection Commissioner (ODPC), which entered a judgment and awarded Kshs. 700,000 against the Appellant. 27.The Respondent submitted that as a first appellate court, the High court should re-evaluate the record, disallow the appeal entirely with costs. 28.Regarding whether the Commission erred by entering an award in the Appellant's absence, the Respondent argues that the determination was procedurally sound and lawful. 29.Under Regulation 11(2) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, the Commissioner is explicitly empowered to determine a complaint if a respondent fails to reply within 21 days of notification. 30.The ODPC record indicates that the notification was physically served at the school on December 11, 2024, leaving the allegations uncontroverted. 31.While the Appellant claims service occurred during school holidays, the Respondent counters that the end-of-term letter merely updated parents and did not establish that school administration was unavailable or incapacitated from responding. 32.Consequently, the Appellant's failure to engage cannot be blamed on procedural impropriety. 33.On the issue of the award amount, the Respondent asserts that the Kshs. 700,000 compensation is neither excessive nor punitive. 34.Under Regulation 14, the Data Commissioner possesses clear statutory discretion to order compensation for a data subject upon concluding an investigation. 35.The Respondent contends this sum is proportionate and fully consistent with established jurisprudence. 36.To support this, they cited the case of Grain Industries Limited v Mbuvu & another (Civil Appeal E186 of 2024) [2024] KEHC 14003 (KLR), where the High Court upheld a higher ODPC award of Kshs. 1,000,000 for the unauthorized use of a subject's images on a marketing billboard, YouTube, and social media platforms. 37.Finally, the Respondent strongly opposes the Appellant’s request to reinstate and rehear the complaint on its merits at the ODPC. 38.They maintain that because the Appellant was duly notified and afforded a statutory opportunity to participate, their subsequent failure to do so does not justify reopening a legally settled matter. 39.The ODPC operated entirely within its statutory mandate and strictly followed procedural requirements and the Respondent submits that there is no basis in law or fact to refer the case back to the Commission. 40.The Respondent asks the court to dismiss the appeal. 41.The issues for determination in this appeal are as follows;i.Whether the Data Commissioner violated the Appellant’s right to a fair hearing and fair administrative action.ii.Whether the award of Kshs. 700,000 in compensation was excessive and punitive. 42.Regarding the first issue, the right to a fair hearing is not a mere technicality but a very important principle of natural justice, enshrined in Article 50(1) of the Constitution of Kenya, 2010, which provides that every person has the right to have any dispute that can be resolved by the application of law decided in a fair and public hearing before a court or, if appropriate, another independent and impartial tribunal or body. 43.Tied to this is the guarantee to fair administrative action as set out in Article 47 of the Constitution, which is further buttressed by the Fair Administrative Action Act, 2015. 44.This Act provides that where an administrative action is likely to adversely affect the rights or fundamental freedoms of any person, that person is entitled to prior and adequate notice of the nature and reasons for the administrative action, an opportunity to be heard and to make representations, and reasons for the decision. 45.The Court of Appeal in the authoritative case of Judicial Service Commission v Mbalu Mutava & Another (supra) clarified that the rules of natural justice, in particular the right to a fair hearing, apply not only to bodies having a duty to act judicially but also to bodies exercising administrative duties. 46.In that case, the court identified three key features of natural justice as the right to be heard by an unbiased tribunal, the right to have notice of charges of misconduct, and the right to be heard in answer to those charges. 47.The Data Commissioner, as a public body exercising quasi-judicial powers under the Data Protection Act, was unquestionably bound by these constitutional strictures. 48.The Appellant’s main grievance is that the Data Commissioner proceeded to make a unilateral and adverse determination without satisfying herself that the Appellant had been properly served with the complaint. 49.The Appellant provided evidence in its Record of Appeal that the school had already closed for holidays at the time the complaint was allegedly served on December 11, 2024. 50.The Appellant argues that by condemning it unheard, the Office of the Data Protection Commissioner committed a procedural flaw that directly violates its fundamental rights. 51.In response, the Respondent argues that the determination was procedurally sound and lawful, citing Regulation 11(2) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, which empowers the Commissioner to determine a complaint if a respondent fails to reply within 21 days of notification. 52.The Respondent further contends that the notification was physically served at the school on December 11, 2024, and that the Appellant’s end-of-term letter to parents does not prove that the school administration was unavailable. 53.This Court finds the Respondent’s argument unconvincing for several reasons. While Regulation 11(2) does grant the Commissioner the power to proceed ex parte, this power is not absolute and must be exercised in a manner that respects the overarching constitutional principles of fairness. 54.The right to be heard is not ousted merely because a time limit has expired. The duty to act fairly requires that before proceeding to make a determination that will adversely affect a party, the Commissioner must first ensure that there is credible evidence that the notification was indeed received or that every reasonable effort was made to bring it to the attention of the respondent. 55.In the instant case, the Appellant raised a plausible and uncontroverted factual assertion that the school was closed for the holidays. 56.In such circumstances, it was incumbent upon the Data Commissioner to conduct a further inquiry or seek alternative means of service to guarantee that the Appellant was aware of the proceedings against it. 57.A determination based on a presumption of service that is directly challenged on reasonable grounds cannot be said to be procedurally fair. 58.Furthermore, this Court is guided by the principle that a determination of whether or not a party was afforded a fair hearing is a matter of fact that depends on the circumstances of each case. 59.In this case, the circumstances strongly militate against a finding of procedural fairness. The Appellant is an educational institution. To assume that its administration would simply ignore a serious legal complaint concerning the use of a minor’s image is a grave assumption, especially when the Appellant has come forth with a reasonable explanation that the service may have been attempted during a period when the school was not in operation. 60.In the persuasive case of Grain Industries Limited v Mbuvu & another (supra), the High Court at Mombasa had occasion to consider a similar grievance regarding a violation of due process by the Data Commissioner. 61.In that case, the appellant had raised an issue that it was not provided with the respondent’s rejoinder before the determination was made. 62.The court proceeded to evaluate the procedural fairness of the Commissioner’s actions. Although the court ultimately found that the timeline for delivery of the determination was met, the case clearly establishes that the High Court will scrutinize the proceedings before the Data Commissioner to ensure that a party’s right to a fair hearing was not violated. 63.The instant case presents an even stronger scenario for judicial intervention, as the Appellant here was allegedly not served at all at a time it could reasonably respond, unlike in the Grain Industries case where a response was filed. 64.To allow the determination to stand in these circumstances would be to elevate procedural regulations over the constitutional right to a fair hearing, a course that is impermissible under Article 25(c) of the Constitution, which provides that the right to a fair hearing is one of the rights that cannot be limited. 65.The Data Commissioner, in her haste to enforce the timelines under the Act, overstretched her discretion and disregarded the basic tenets of natural justice, thereby occasioning a miscarriage of justice. 66.Having found that the Appellant was denied a fair hearing, the second issue concerning the quantum of damages awarded becomes secondary, but it is one that this Court will briefly address to underline the prejudice suffered by the Appellant. 67.The Appellant argues that the award of Kshs. 700,000 was excessive, punitive, and unsupported by a proportionality analysis or consideration of the school’s version of events. 68.The Respondent, on the other hand, contends that the sum is proportionate and consistent with established jurisprudence, citing the same Grain Industries Limited v Mbuvu & another case, where the High Court upheld a Kshs. 1,000,000 award for the unauthorized use of a subject’s images on a marketing billboard, YouTube, and social media platforms. 69.This Court notes that the assessment of damages is a discretionary exercise. However, the power of a first appellate court to interfere with an award of damages is well settled. 70.In Kenya Power & Lighting Company Ltd v Nathan Karanja Gachoka & another (supra), the court held that an appellate court will be slow to interfere with the discretion of a trial court or tribunal in assessing damages unless it is demonstrated that in assessing the damages, the court acted on wrong principles, took into account irrelevant factors, or left out a relevant factor, or that the award is so inordinately high or low as to be an entirely erroneous estimate of the damage suffered. 71.In the present case, because the Data Commissioner proceeded ex parte without hearing the Appellant’s side of the story, there is no evidence on record regarding the specific nature of the advertisement, its reach, its duration, or any mitigating factors that the school might have raised. 72.The award of Kshs. 700,000 was therefore made in a vacuum, without a full understanding of the facts. 73.While the protection of a minor’s personal data is of paramount importance, especially under Section 33 of the Data Protection Act which prohibits processing a child’s personal data without parental consent, any award of compensation must be grounded in a proper evidentiary foundation following a hearing that accords both parties a fair opportunity to be heard. 74.This lack of a proper foundation is another reason why the entire determination cannot be sustained. 75.In conclusion, this Court finds that the appeal has merit. The determination of the Data Commissioner was a clear violation of the Appellant’s constitutional right to a fair hearing and fair administrative action. 76.The decision was made without jurisdiction to the extent that it was made without ensuring the Appellant was properly notified and given an opportunity to be heard. 77.The rules of natural justice are not empty formalities; they are the bedrock upon which all administrative and judicial decisions must rest. 78.Consequently, the appeal is hereby allowed. The final orders of this Court are as follows;i.The Determination of the Data Commissioner delivered on February 4, 2025, in ODPC Complaint No. 1824 of 2024, is hereby set aside in its entirety.ii.The matter is referred back to the Data Commissioner for hearing afresh.iii.Each party shall bear its own costs of this appeal, given the nature of the dispute and the fact that the appeal has succeeded. 79.Orders to issue accordingly. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 2ND DAY OF JUNE 2026ASENATH ONGERIJUDGEIn the presence ofMr Momanyi holding brief for Mr Makori for the AppellantMiss Kariuki for the RespondentChrispine - Court Assistant