https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/7353

Kabras Rugby Club v Mairura & another (Civil Appeal E1273 of 2024) [2026] KEHC 7353 (KLR) (Civ) (21 May 2026) (Judgment) Neutral citation: [2026] KEHC 7353 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E1273 of 2024 WA Okwany, J May 21, 2026 Between Kabras Rugby Club Appellant and Nick Ongeri Mairura 1st Respondent Kabras Sugar Rugby Football Club 2nd Respondent (Being an appeal form the determination of the Office of the Data Protection Commissioner (ODPC) delivered on 11th October 2024 in Complaint No. 1069 of 2024) Judgment Background 1.On or about 14th February 2023, posters were published on social media platforms advertising a rugby match between Kabras Rugby Club and KCB Rugby Club. The said publications featured the image of the 1st Respondent. The 1st Respondent’s claim was that his image was used without his consent and for purposes of marketing the match. 2.The 1st Respondent lodged a Complaint before the Data Protection Commissioner (the Commissioner) on 11th July 2024, alleging unlawful use of his personal data and violation of his constitutional right to privacy. 3.Upon receipt of the Complaint, the Commissioner issued notifications and later joined the Appellant as a party (2nd Respondent) to the Complaint, on the basis that it was substantially involved in the impugned publications. 4.The Appellant objected to its joinder and maintained that it was not only not a party to the original Complaint but that no allegations had been made against it and further, that it was a distinct legal entity from the 2nd Respondent. 5.Despite the objection, the Commissioner proceeded to determine the Complaint and ultimately found the Appellant liable and awarded damages of Kshs. 750,000 to the 1st Respondent. 6.Dissatisfied with the said determination in its entirety, the Appellant lodged this appeal challenging both the finding of liability and the quantum of damages. The Appeal 7.The Appellant’s challenge to the Commissioner’s decision is multi-faceted and is based on several grounds that may be summarised as follows:a.That the joinder of the Appellant to the Complaint was irregular and unlawful;b.That no proper investigations were conducted;c.That the Appellant was denied a fair hearing contrary to Articles 47 and 50 of the Constitution;d.That no nexus was established between the Appellant and the alleged wrongdoing;e.That the Commissioner disregarded the Appellant’s response;f.That the award of damages was excessive, arbitrary, and unsupported by evidence;g.That the entire determination was against the weight of evidence and the law. 8.The appeal was canvassed by way of written submissions which I have considered. The Appellant’s Submissions 9.The Appellant submitted that its joinder to the Complaint was fundamentally flawed as there were no pleadings or allegations directed against it and therefore no basis upon which it could be made a party. 10.It further contended that the Commissioner did not conduct investigations as required under the Data Protection Act. In particular, it pointed to the absence of witness statements, documentary evidence, forensic examination of electronic platforms and any investigation report. 11.The Appellant also asserted that its right to fair administrative action under Article 47 of the Constitution and its right to a fair hearing under Article 50 of the Constitution were violated. It argued that it was not furnished with evidence against it, nor given a meaningful opportunity to respond to the allegations, if any, levelled against it and that its response was ignored. 12.On liability, the Appellant maintained that it is a distinct entity from the 2nd Respondent and that no evidence was adduced to establish a nexus between it and the impugned publications. 13.On damages, the Appellant submits that the award of Kshs. 750,000 was excessive and unsupported by evidence of actual loss or harm. The 1st Respondent’s Submissions 14.The 1st Respondent opposed the appeal and supported the Commissioner’s determination. It submitted that the Commissioner properly exercised her discretion under Regulation 12 of the Data Protection Regulations in joining the Appellant as a party, given its involvement in the impugned publications. 15.On the right to fair hearing, the 1st Respondent submitted that the Appellant was notified of the Complaint, was given multiple opportunities to respond but that it failed to utilize those opportunities. 16.It was further submitted that the right to be heard is satisfied where a party is given an opportunity to present its case, whether or not that opportunity is taken. 17.On liability, the 1st Respondent contended that the Appellant did not deny its association with the social media platforms used to publish the images and that the publications were made for its commercial benefit. 18.On damages, reference was made to Section 65 of the Data Protection Act (the Act) for the argument that it expressly allows compensation for both financial and non-financial harm, including distress. The respondent added that the award was therefore lawful and justified. Issues for Determination 19.Having considered the pleadings and submissions, I find that the following issues arise for determination:a.Whether the joinder of the Appellant was lawful;b.Whether the Appellant was accorded a fair hearing;c.Whether the Commissioner conducted investigations in accordance with the law;d.Whether a nexus was established between the Appellant and the impugned publications;e.Whether the finding of liability was justified;f.Whether the award of damages was excessive or unwarranted; Analysis and Determination 20.As the first appellate court, this court is required to reanalyse and re-evaluate the evidence presented before the trial court with a view to arriving at its own independent findings while bearing in mind that it neither saw nor heard the witnesses testify. (See Selle v Associated Motor Boat Co. Ltd [1968] EA 123). 21.The applicable law on joinder of parties in this matter is Regulation 12 of the Data Protection Regulations (Regulations) which empowers the Commissioner to join any person whose presence is necessary for effective determination of the Complaint. In the impugned decision rendered on 11th October 2024, the Commissioner explained the circumstances that led to the joinder of the Appellant to the proceedings as follows: -“7.Pursuant to Regulation 11 of the Enforcement Regulations, on 19th and 22nd July 2024, this Office through e-mail and physically by hand delivery notified the Respondent of the Complaint filed against it vide a letter dated 18th July 2024 referenced ODPC/CONF/1/5 VOL II (47) and required their response within 21 days.8.The 2nd Respondent, through their Advocates, responded to the notification of the Complaint letter vide email on 27th August 2024 attaching an undated letter referenced OOS/GEN/KAB/01.9.On the said letter referenced OOS/GEN/KAB/01 and sent through e-mail on 27th August 2024, the 2nd Respondent contended that the Complainant had brought action against a wrong and non-existent party, Kabras Sugar Rugby Football Club. They stated that they were registered as Kabras Rugby Club and not Kabras Sugar Rugby Football Club as cited by the Complainant in his Complaint Form DPC 1. 10.On 6th September 2024, based on the above assertions and upon confirming the said position, the Data commissioner exercising her powers as envisaged under Regulation 12(1) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 enjoined the 2nd Respondent, Kabras Rugby Club, as a respondent in this matter. 11.Regulation 12 (1) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 provides that where it appears to the Data Commissioner, or by application by either the Complainant or the Respondent, that its is necessary that a person becomes a party to a Complaint, the Data Commissioner may order that person to be enjoined as a party. [Emphasis supplied].12.The decision to enjoin the 2nd Respondent, Kabras Rugby Club, as a Respondent in this matter was communicated to it on 9th September 2024. On the said Notice to enjoin, the Complaint was attached and the 2nd Respondent was required to respond to the Complaint within 21 days.13.On 10th September 2024, the 2nd Respondent through their advocates contested its joinder stating that they were not served by any application for joinder from the Complainant.14.On the same date, 10th September 2024, the Data Commissioner responded to the 2nd Respondent stating that the joinder of the 2nd Respondent was by the Data Commissioner as provided in Regulation 12(1) above. Additionally, Section 61 of the Act which provides for obstruction of the Data Commissioner was brought to the attention of the 2nd Respondent.” 22.Top of Form 23.From the above extract of the Commissioner’s decision, it is clear that the 1st Respondent’s Complaint was initially lodged and served upon the Kabras Sugar Rugby Football Club. Upon receipt of the Complaint, the Appellant’s counsel wrote to the Commissioner indicating that the Appellant and the party named as the 2nd Respondent in the Complaint are 2 different entities. I have perused the Appellant’s advocates’ said letter which stated, in part, as follows:“First and foremost we note that the Complaint is against Kabras Sugar Rugby Football Club however the same was served upon Mr. Edwin Esilaba, the Chairman of Kabras Rugby Club. These are 2 different and distinct legal entities and in this regard our client are strangers to the allegations made against Kabras Sugar Rugby Football Club and cannot answer to the allegations made against them.Our further instructions are that there is no club known as Kabras Sugar Rugby Football Club.” 24.The record reveals that it was on the basis of the Appellant’s disclosure of its correct identity that the Commissioner invoked the provisions of Regulation 12 (1) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 (the Regulations) to enjoin the Appellant to the proceedings. The said Regulation stipulates as follows: -“Where it appears to the Data Commissioner, or by application by either the complainant or the respondent, that it is necessary that a person becomes a party to a Complaint, the Data Commissioner may order that person to be enjoined as a party.” 25.A simple reading of the above provision is that it gives the Data Commissioner power to add (“enjoin”) another person or entity into an existing Complaint if their participation is considered necessary for the proper determination of the matter. This joinder can happen on the Commissioner’s own initiative or after an application by either the complainant or the respondent. 26.I therefore find that the joinder of the Appellant to the proceedings was lawful, necessary and within the Commissioner’s discretion. 27.I also note that the joinder was communicated to the Appellant who, through their advocates’ email dated 10th September 2024 responded as follows: -“We refer to your email of 9th September, 2024 which indicated that you had attached a notice to enjoin Kabras Rugby Club however we have noted that there is no such notice attached seeking to enjoin Kabras Rugby Club by the Complainant. What has been attached is the initial complaint filed by the complainant and it does not include any complaints against Kabras Rugby Club and if the complaint is as it has been forwarded in the email of 9th September, 2024 then our simple response is that there is no claim against Kabras Rugby Club and the same should be dismissed with costs.We want to voice our concerns as to how this matter is being handled by the commission which contravenes the express provision of Article 47 which guarantees every citizen right to fair administrative action and Article 50 which guarantees every citizen right to a fair hearing as follows1.The Complainant filed a complaint against Kabras Sugar Rugby Football Club and the same was served on the Chairman of Kabras Rugby Club, who instructed us and we did file a response to the complaint and we were waiting for directions/decision to be made and the same be communicated to the parties however from the communication of 9th September, 2024 it seems that the matter proceeded in exclusion of the Respondents, a decision was made that was detrimental to the interests and rights of the Respondent but it was only communicated to the Complainant who relied on that decision to try and enjoin Kabras Rugby Club.2.We have noted with a lot of concerns that we have not been served with any application by the Complainant seeking to join Kabras Rugby Club into the suit and from the Complaint served upon our Clients, Kabras Rugby Club is not a party to the proceedings and there is no claim against Kabras Rugby Club which leads us to the conclusion that the Commission has jumped into the arena of litigants and is the one seeking to prosecute the complaint on behalf of the complainant by acting suo moto and are seeking to join Kabras Rugby Club into the suit/complaint without being moved by the any party.3.The Black Law dictionary define “enjoin” as an act of prohibiting someone from performing (a particular action) by issuing an injunction. In this regard Kabras Rugby Club cannot be enjoined as a Respondent as the email of 9th September, 2024 purports.In view of the foregoing we do demand that the Commission to serve us with the following documents1.Decision that was made after we had filed our response to the complaint.2.The Application made by the Complainant seeking to join Kabras Rugby Club to the suit as Respondents, complete with the email communication that forwarded the application to the Commission from the Complainant’s advocates.” 28.The contents of the above letter reveal that the Appellant’s advocates proceeded from the notion that a formal application was to be filed before the Commissioner for the Appellant’s joinder to the proceedings. As I have already stated in this in this judgment, joinder can, under Regulation 12 (1) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, happen on the Commissioner’s own initiative. 29.My above finding on the lawfulness of the joinder notwithstanding, the question that still begs an answer is whether the Appellant was accorded a fair hearing after it was brought into the proceedings. 30.The record shows that the Complaint was initially framed against “Kabras Sugar Rugby Football Club,” an entity which the Appellant maintained was distinct from itself and, indeed, non-existent. It was only after the Appellant’s advocates pointed out the discrepancy that the Commissioner invoked Regulation 12(1) and proceeded to enjoin the Appellant to the proceedings. 31.While the Commissioner was legally entitled to enjoin the Appellant, I find that the peculiar circumstances surrounding the initial mix up in the identity of the Rugby Club called for greater procedural safeguards to ensure that the Appellant fully understood the case it was required to answer. The Appellant’s response dated 10th September 2024 clearly raised concerns that no Complaint or allegations had specifically been directed against it and requested to be furnished with the relevant documents and particulars forming the basis of its joinder. It is noteworthy that the notice of joinder sent to the Appellant had the reference; Notice to enjoin Kabras Rugby Club as a Respondent in Complaint No. ODPC/COMP/1069/2024 filed against Kabras Sugar Rugby Football Club by Nick Ongeri. (Emphasis added). 32.In my view, once the Commissioner accepted that the original Complaint had been directed at a different entity and thereafter proceeded to enjoin the Appellant as a respondent, fairness demanded that the Appellant be afforded a fresh and meaningful opportunity to respond to the allegations specifically made as against it. This would have included clear notification of the precise claims levelled against the Appellant, disclosure of the material intended to be relied upon and adequate time to respond thereto. 33.Articles 47 and 50 of the Constitution require administrative bodies to act fairly, reasonably and in a manner that accords every affected party an opportunity to be heard before adverse findings are made against them. The right to a fair hearing is not a mere procedural technicality but a substantive constitutional guarantee. 34.Although the Commissioner maintained that the Appellant had been notified and granted an opportunity to respond to the Complaint, I find that it was not fair to expect the Appellant to answer to a Complaint made against an incorrectly identified Respondent. In the circumstances of this case, I am persuaded that the Appellant’s Complaint that it did not receive a fair opportunity to defend itself was not without merit. 35.In light of the above finding, I find that it is not necessary to conclusively determine the remaining issues touching on liability, nexus and the propriety of the award of damages, as these are matters that properly fall for reconsideration upon a procedurally fair hearing before the Commissioner. 36.Accordingly, the appeal succeeds on the ground that the Appellant was denied a fair hearing owing to the initial confusion and mix up regarding the true identity of the Rugby Club against whom the Complaint was lodged. 37.Consequently, I allow the appeal and set aside the determination of the Office of the Data Protection Commissioner delivered on 11th October 2024 in Complaint No. 1069 of 2024. 38.The matter is hereby remitted back to the Data Protection Commissioner for fresh hearing and determination in accordance with the Constitution, the Data Protection Act and the applicable Regulations, with due regard to the Appellant’s right to fair administrative action and fair hearing. 39.Each party shall bear its own costs of the appeal.It is so ordered. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 21ST DAY OF MAY 2026.HON W. A. OKWANYJUDGEIn the presence ofOlendo for ApplicantWesonga for Kanjama(Senior Counsel) for 1st for RespondentUbah - Court Assistant