https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/6856

Jaggys (Kienyeji Chicken v Gichunge (Civil Appeal E657 of 2024) [2026] KEHC 6856 (KLR) (Civ) (14 May 2026) (Judgment) Neutral citation: [2026] KEHC 6856 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E657 of 2024 WA Okwany, J May 14, 2026 Between Jaggys (Kienyeji Chicken Appellant and Jackson Gichunge Respondent (Being an appeal from the determination of the Office of the Data Protection Commissioner (ODPC) delivered on 26th April 2024) Judgment Background 1.The parties herein had a commercial transaction in which the Respondent purchased chicken worth Kshs. 2,800 from the Appellant and paid through the M-Pesa mobile money platform. 2.The Respondent lodged a complaint before the Office of the Data Protection Commissioner (ODPC) alleging that after purchasing chicken from the Appellant and making payment through M-Pesa, the Appellant extracted and used his phone number from the payment confirmation and proceeded to send unsolicited promotional and feedback messages without his consent. 3.The complaint particularly related to a marketing message allegedly sent to the Respondent on 29th January 2024 at about 4:40 p.m. promoting the Appellant’s chicken business and listing various branches and contact numbers. 4.The Appellant contended that the communication was sent in good faith and formed part of after-sale customer engagement and marketing. The Appellant further asserted that the Respondent did not request the Appellant to cease communication before lodging the complaint before the Data Commissioner. 5.Upon considering the complaint and the parties’ responses, the Learned Data Commissioner found that the Appellant had unlawfully processed the Respondent’s personal data contrary to the Constitution of Kenya, the Data Protection Act, 2019, (the Act) and the Data Protection (General) Regulations, 2021. 6.The Commissioner awarded the Respondent compensation in the sum of Kshs. 250,000/= for unlawful use of his personal data for direct marketing purposes. The Appeal 7.Aggrieved by the decision, the Appellant filed the present appeal challenging both liability and the award of damages. The Appellant raised, inter alia, the following grounds of appeal: -a.That the Learned Data Commissioner erred in law and fact in finding that the Appellant unlawfully processed the Respondent’s personal data.b.That the Commissioner failed to properly consider the Appellant’s response and submissions.c.That the Commissioner erred in law in interpreting Regulation 15 of the Data Protection (General) Regulations, 2021.d.That the Respondent ought to have first objected to or notified the Appellant before lodging a complaint with the ODPC.e.That the Commissioner failed to establish the extent of damages suffered.f.That the award of Kshs. 250,000/= was excessive, unlawful, punitive, and contrary to Regulation 15(4) of the Regulations.g.That the Commissioner erred in finding that the Respondent had proved his case to the required standard. The Appellant’s Submissions 8.The Appellant submitted that the messages sent to the Respondent were customer engagement and after-sale service communications rather than unlawful marketing. 9.Reliance was placed on Section 36 of the Data Protection Act and Regulations 8(7), 15(1)(d), and 15(1)(e) of the Data Protection (General) Regulations, 2021. The Appellant submitted that these provisions permitted direct marketing communications where the data subject had not opted out and where a simplified opt-out mechanism existed. 10.It is the Appellant’s position that the Respondent never objected to the communications nor requested cessation before approaching the ODPC. 11.The Appellant further argued that the Respondent acted prematurely and in haste by failing to first engage the Appellant internally before lodging the complaint. 12.On damages, the Appellant submitted that Regulation 15(4) only contemplates a maximum penalty of Kshs. 20,000/= for breach relating to marketing communications and therefore the award of Kshs. 250,000/= was excessive and unlawful. 13.It was also submitted that Sections 56 and 72 of the Data Protection Act do not provide for compensatory remedies as interpreted by the Respondent and the Commissioner. 14.According to the Appellant, Section 56 merely establishes complaint procedures before the Commissioner while Section 72 creates offences and criminal sanctions rather than civil compensation. 15.The Appellant also contended that the Commissioner exceeded her statutory mandate by granting excessive compensation without proof of actual loss or damage. 16.It was further argued that the Appellant is a small business entity and that the award imposed a disproportionate burden upon it. The Respondent’s Submissions 17.The Respondent opposed the appeal and submitted that the Commissioner correctly interpreted and applied the law as his phone number was disclosed solely for purposes of facilitating payment through M-Pesa and not for marketing or promotional communication. 18.The Respondent submitted that the Appellant extracted and repurposed his personal data without prior notice, lawful basis, or express consent contrary to the Data Protection Act. 19.It was contended that Sections 25, 28, 29, 30, 32, and 37 of the Data Protection Act require personal data to be processed lawfully, fairly, transparently, and strictly for the purpose for which it was collected. 20.The Respondent submitted that consent under Section 2 of the Act must be express, unequivocal, informed, and freely given. 21.The Respondent further argued that under Section 32(1), the burden of proving consent rests upon the data controller or processor and that the Appellant failed to discharge that burden. 22.The Respondent submitted that Regulation 15(1) sets out cumulative conditions for lawful direct marketing, namely; collection of personal data directly from the data subject, notification that direct marketing is an intended purpose, consent by the data subject, provision of a simplified opt-out mechanism and absence of an opt-out request. 23.According to the Respondent, the Appellant failed to satisfy all these conditions. 24.The Respondent also contended that there is no legal requirement compelling a data subject to first object to a data controller before filing a complaint before the ODPC. 25.Reliance was placed on Section 56 of the Data Protection Act which grants any aggrieved data subject the right to directly lodge a complaint with the Commissioner. 26.On damages, the Respondent submitted that Section 65 of the Act expressly allows compensation for both financial and non-financial loss, including distress. 27.The Respondent further argued that the Commissioner properly considered the nature of the infringement, emotional distress, inconvenience, and the need for deterrence. 28.The Respondent relied on the decisions in M W K & another v Attorney General & 3 others [2017] eKLR where Kshs. 4,000,000/= was awarded for violation of constitutional rights; and Ann Njoki Kumena vs. KTDA Agency Ltd [2019] eKLR where damages were awarded for violation of privacy rights. 29.The Respondent submitted that the award of Kshs. 250,000/= was modest, proportionate, and justified. Issues for Determination 30.Having considered the Record of Appeal, the impugned decision, and the parties’ submissions, I find that the issues arising for determination are:a.Whether the Appellant unlawfully processed the Respondent’s personal data.b.Whether the Appellant complied with the legal requirements governing direct marketing under the Data Protection Act and Regulation 15 of the Data Protection (General) Regulations, 2021.c.Whether the Respondent was required to first notify or object to the Appellant before lodging a complaint with the ODPC.d.Whether the Learned Data Commissioner failed to consider the Appellant’s response.e.Whether the Respondent proved his case to the required standard.f.Whether the award of Kshs. 250,000/= was lawful, proportionate, and justified. Analysis and Determination 31.This being a first appeal, this Court is required to re-evaluate the evidence presented before the trial court afresh and draw its own conclusions, while bearing in mind that it did not hear or see the witnesses who testified. (See Peters vs. Sunday Post Ltd [1958] EA 424). 32.This court, as an appellate court, must therefore proceed cautiously and only interfere where the trial court misapprehended the evidence, acted on wrong principles, or reached a plainly erroneous conclusion. 33.On whether the Appellant unlawfully processed the Respondent’s personal data, Article 31 of the Constitution guarantees every person the right to privacy, including the right not to have information relating to their private affairs unnecessarily required or revealed. 34.Section 25 of the Data Protection Act (the Act) obligates data controllers and processors to ensure that personal data is processed lawfully, fairly, and transparently. 35.Section 30(1) of the Act prohibits processing of personal data unless the data subject consents to the processing for one or more specified purposes or unless another lawful basis exists. 36.Section 37 further prohibits use of personal data for commercial purposes unless express consent has been obtained. 37.The evidence before the Commissioner demonstrated that the Respondent’s phone number was obtained from an M-Pesa transaction and subsequently used to send unsolicited promotional and feedback messages. 38.The Appellant admitted using the Respondent’s phone number but did not demonstrate that express consent had been sought or obtained for direct marketing. 39.It is my finding that the Respondent’s phone number was utilized solely for purposes of facilitating payment and not for commercial advertising or solicitation. My take is that repurposing the data for marketing without consent amounted to further processing inconsistent with the original purpose of collection contrary to Section 30(2) of the Act. 40.The Appellant also failed to demonstrate compliance with Sections 28 and 29 regarding notice and disclosure of the intended purpose of processing. Accordingly, this Court is satisfied that the Learned Data Commissioner properly found that the Appellant unlawfully processed the Respondent’s personal data. 41.On whether the Appellant complied with Regulation 15(1) of the Data Protection (General) Regulations, I note that the said Regulation establishes cumulative conditions that must be satisfied before direct marketing may lawfully occur. The Regulation requires proof that; the data was collected directly from the data subject, the data subject was informed that direct marketing was an intended purpose, the data subject consented to such use, a simplified opt-out mechanism was provided and the data subject had not opted out. 42.I note that the Appellant selectively relied on Regulation 15(1)(e) relating to opt-out requests while ignoring the mandatory requirements under subparagraphs (a) to (d). 43.This Court agrees with the Respondent that the conditions under Regulation 15(1) are cumulative and not disjunctive. No evidence was produced to show that the Respondent was informed that his data would be used for marketing, nor that consent was obtained, nor that an opt-out mechanism existed. 44.I find that the Appellant’s reliance on the Respondent’s failure to opt out cannot cure the initial absence of consent. I therefore find that the Appellant failed to comply with Regulation 15. 45.On whether the Respondent was required to first notify the Appellant before lodging a complaint, Section 56(1) of the Data Protection Act expressly grants a data subject the right to lodge a complaint with the Data Commissioner upon infringement or potential infringement of rights. The Act imposes no requirement for prior notice, warning, objection, or internal complaint procedures before approaching the ODPC. 46.I am therefore not persuaded that the Respondent acted prematurely and find that once the Respondent received unsolicited marketing communication without consent, the alleged violation had already crystallized and the Respondent was entitled to seek immediate redress before the Commissioner. 47.On whether the Commissioner failed to consider the Appellant’s response, the record reveals that the Commissioner considered the Appellant’s response, including its explanation that the communications were feedback and customer engagement messages. 48.The Commissioner found that the Appellant had failed to establish a lawful basis for processing the Respondent’s personal data. 49.I find no evidence to show that the Commissioner ignored or failed to evaluate the Appellant’s response. On the contrary, the Commissioner weighed the evidence and reached conclusions grounded in the law and the facts presented. 50.On whether the Respondent’s case was proved to the required standard, I note that the Respondent produced screenshots of unsolicited messages, explained how his phone number had been obtained from the M-Pesa transaction, and denied ever giving consent for such messages. 51.The applicable standard in civil matters is proof on a balance of probabilities (SeeWilliam Kabogo Gitau vs. George Thuo & 2 Others [2010] 1 KLR 526). 52.I note that the Appellant admitted use of the Respondent’s number but did not tender any lawful basis or consent. 53.I am satisfied that the Respondent proved his case on a balance of probabilities. 54.Turning to the legality, proportionality and justification of the award of Kshs. 250,000/=, I note that the Appellant challenged said award as excessive, punitive, and unsupported by law, contending that Regulation 15(4) of the Data Protection (General) Regulations limits compensation to Kshs. 20,000/=. 55.The Respondent, on the other hand, maintained that the award was compensatory and intended to vindicate the infringement of privacy rights, emotional distress, inconvenience, and the unlawful use of personal data for direct marketing purposes. 56.I have carefully considered the competing arguments on the issue of the award and I find that there is no doubt that the Data Protection Act empowers the Data Commissioner to grant compensation where a data subject suffers harm as a result of unlawful processing of personal data. Section 65(1) of the Act expressly provides that a person who suffers damage arising from contravention of the Act is entitled to compensation. Further, Section 65(4) recognizes non-financial harm, including distress. 57.I therefore find that the Commissioner had jurisdiction to award compensation for emotional distress, inconvenience, and infringement of privacy rights. 58.While this Court concurs that compensation was warranted in the circumstances of this case, it is also trite that an appellate court is entitled to interfere with an award of damages where it is shown that the award was excessive, based on wrong principles, or disproportionate to the injury suffered. 59.The unlawful conduct complained of involved the extraction and use of the Respondent’s mobile number obtained through an M-Pesa transaction for unsolicited marketing communication without consent. It is instructive to note that the infringement consisted principally of unsolicited promotional and feedback messages. I also note that it was not established that the Respondent’s data was disseminated to third parties. No financial loss was demonstrated and neither was it established that there was prolonged harassment or repeated systematic misuse beyond the impugned unsolicited messages. It is noteworthy that the breach, though unlawful, was limited in scope and nature as the matter involved a small-scale commercial transaction rather than large-scale exploitation of personal data. 60.The Court nevertheless recognizes that privacy rights under Article 31 of the Constitution and the Data Protection Act are fundamental and deserving of protection. The misuse of personal data, without consent, undermines public confidence in digital transactions and must attract meaningful sanctions sufficient to deter similar conduct. 61.The Court is also guided by the principle that damages in data protection matters should be fair, moderate, proportionate, and reflective of the actual infringement proved. In this case, I note that the transaction that the parties entered into was a purchase of chicken for the sum of Kshs. 2,800/=. 62.In the circumstances of this case and bearing in mind the value and the nature of the parties’ transaction, I find that the award of Kshs. 250,000/=, though lawful, was on the higher side more so considering the limited extent of the violation proved before the Commissioner. 63.The Court is satisfied that an award of Kshs. 50,000/= would adequately compensate the Respondent for the infringement of his privacy rights, emotional distress, inconvenience, and unlawful processing of his personal data while at the same time serving the deterrent purpose contemplated under the Data Protection Act. 64.Accordingly, the award of Kshs. 250,000/= made by the Learned Data Commissioner is hereby set aside and substituted with an award of Kshs. 50,000/= together with interest at court rates from the date of this judgment until payment in full. 65.Since the appeal is partially successful, on the aspect of the award, I direct that parties shall bear their own costs of the appeal. 66.Orders accordingly. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 14TH DAY OF MAY 2026.HON W. A. OKWANYJUDGEIn the presence ofMakori for Kinyanjui for AppellantShem Dickson for RespondentAbdirzak - Court Assistant