Kenya Airways PLC v Obano (Civil Appeal E171 of 2024) [2026] KEHC 7059 (KLR) (Civ) (22 May 2026) (Judgment)

Kenya Airways PLC v Obano (Civil Appeal E171 of 2024) [2026] KEHC 7059 (KLR) (Civ) (22 May 2026) (Judgment) Neutral citation: [2026] KEHC 7059 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E171 of 2024 AN Ongeri, J May 22, 2026 Between Kenya Airways PLC Appellant and Jeremy Obano Respondent (Being an Appeal from the Office of the Data Protection Commissioner (ODPC) complaint No. 1775 of 2023 delivered on 15/12/2023) Judgment 1.The OPDC delivered determination on 15/12/2023 stating that the Appellant had infringed the Complainant’s right to access to his personal data and ordered the Appellant to facilitate access to the said data and to pay the complainant Kshs.250,000/- as compensation. 2.The Respondent in this Appeal was the Complainant in ODPC complaint No. 1775 of 2023. 3.The Respondent contacted the Appellant on 10/6/2023 via telephone call. The telephone call was recorded by the Appellant. 4.The telephone conversation was recorded, later the Respondent request for the telephone voice recording but the Appellant declined to give him. 5.The Appellant responded to the allegations and said among other things that the request was access to the recording was contrary to the health, safety and disability Act. 6.The ODPC found that one’s voice recording constitutes personal data and that the Respondents right to personal data was violated. 7.The ODPC gave the above orders. 8.The Appellant has appealed against the said orders on the following grounds.i.The Data Commissioner erred in law and in fact in finding that the Appellant had infringed the Respondent’s access to personal data.ii.The Data Commissioner erred in law and in fact when she rendered the impugned determination notwithstanding the fact the Appellant had not exhausted the internal mechanisms to address the grievance raised by the Respondent in complete disregard of Article 159 of the Constitution of Kenya as well as the doctrine exhaustion of remedies.iii.The Data Commissioner erred in law in awarding compensation of “Kshs. 250,000” to the Respondent without any legal basis or justification. 9.The parties filed written submissions as follows; The Appellant submitted that this matter originated from a complaint filed by the respondent, Jeremy Obano, who alleged that Kenya Airways denied him access to a phone call recording made in June 2023. 10.The Data Commissioner found that the respondent's right to access his personal data had been infringed and ordered Kenya Airways to pay him 250,000 Kenyan Shillings in compensation. 11.Dissatisfied with this ruling, Kenya Airways appealed on three primary grounds, that the Data Commissioner failed to provide a procedurally fair process, and that it had issued its decision prematurely while internal dispute mechanisms were ongoing, and that it awarded financial compensation without legal basis or proof of actual damage. 12.The appellant first argues that the Data Commissioner violated the principles of fair administrative action enshrined in Article 47 of the Kenyan Constitution, the Fair Administrative Actions Act, and the Data Protection Regulations. 13.Kenya Airways highlights that upon receiving notice of the complaint, it informed the regulator that internal resolution mechanisms were currently ongoing and expressed full willingness to cooperate. 14.Despite this, the Data Commissioner proceeded straight to a final determination without further engaging the appellant. 15.Drawing heavily on established case law, specifically a High Court decision by Justice Mrima, the appellant contends that the statutory and constitutional framework mandatorily requires the Data Commissioner to first promote alternative dispute resolution, such as negotiation, mediation, or conciliation. 16.By skipping these introductory steps and failing to show any record of attempting mediation, the regulator acted unlawfully and deprived the airline of a fair hearing. 17.Building on this procedural flaw, the appellant invokes the exhaustion doctrine to argue that the Data Commissioner erred by rendering a judgment while internal complaints handling processes were actively in progress. Citing Court of Appeal jurisprudence, the appellant emphasizes that external or internal dispute resolution bodies should be fully utilized and exhausted before a formal tribunal or court steps in. 18.The regulator entirely ignored the ongoing internal resolution framework and rushed to a final determination and therefore the ruling constitutes a severe breach of procedural fairness and the rule of law. 19.Finally, the appellant asserts that the Data Commissioner’s award of 250,000 Shillings lacks any legal justification or evidentiary foundation. Under Section 65 of the Data Protection Act, compensation is tied directly to suffering actual damage or distress as a result of a statutory contravention. 20.However, the appellant points out that the respondent failed to prove any specific damage arising from the withheld phone recording. 21.Instead, the respondent's grievances focused entirely on unrelated operational issues, such as poor customer service and the airline's failure to provide a wheelchair for his elderly mother. 22.The appellant argues that evaluating customer service or health and safety violations completely falls outside the legislative jurisdiction of the Data Commissioner, whose mandate is restricted strictly to data protection issues. 23.Relying on constitutional principles, the appellant concludes that a rights violation does not automatically entitle an individual to financial compensation without rigorous scrutiny and proof of loss. 24.Finally, the Appellant submitted that because the monetary award was speculative, excessive, and arbitrary, the court should set aside the Data Commissioner's entire determination. 25.The Respondent submitted that the background of the dispute traces back to a request made by the respondent asking Kenya Airways to arrange a wheelchair for his elderly mother at the airport. 26.The airline failed to provide the wheelchair, prompting the respondent to make a phone call on June 10, 2023, which was recorded by Kenya Airways. 27.The respondent repeatedly requested access to this voice recording, but the airline refused, which compelled him to file a complaint with the Office of the Data Protection Commissioner (ODPC). 28.In these submissions, the respondent frames two primary issues for the High Court's determination, whether the ODPC was correct in holding that the airline infringed upon the respondent's data access rights, and whether the awarded compensation was reasonable. 29.Addressing the first issue, the respondent points to the statutory definitions under Section 2 of the Data Protection Act (DPA), arguing that he qualifies as a "data subject" and that the recorded phone call containing his voice constitutes "personal data". 30.Under Section 26(b) of the DPA, a data subject has an explicit right to access their personal data in the custody of a data controller or processor. 31.Kenya Airways admittedly refused to grant access to the recording, and continues to withhold it, the respondent argues that the airline contravened the law. 32.Furthermore, responding to the airline's claim that it was denied a fair hearing or proper administrative procedure, the respondent cites the High Court precedent Muthoni v Solpia Kenya Limited, which established that the ODPC possesses wide discretionary powers regarding how it conducts investigations and that inviting a party to respond to a complaint satisfies the requirements of an investigative hearing. 33.Therefore, the respondent asserts the ODPC was entirely correct in holding the appellant liable. 34.Regarding the second issue of compensation, the respondent contends that the award of Ksh 250,000 was reasonable and fully grounded in law. 35.Relying on the case of Aventus Technology Limited v Ndambuki, the respondent highlights that Section 65 of the DPA expressly permits compensation for non-pecuniary harms such as distress and inconvenience. 36.The submissions note that the ODPC's discretionary award aligns well with judicial precedents, pointing out that courts upheld an award of Ksh 200,000 for similar violations in Solpia Kenya Limited v Muthoni and deemed Ksh 300,000 appropriate for emotional distress in Wanjiru v Machakos University. 37.As the award falls squarely within the range of comparable cases and serves the required purpose of deterring unlawful data practices, the respondent argues it is legally justified. 38.The respondent concludes that the Data Commissioner’s determination was thoroughly grounded in both law and fact, and he prays that the High Court dismiss the appeal with costs awarded in his favor. 39.The issues for determination in this appeal are as follows;i.whether the Office of the Data Protection Commissioner violated the principles of fair administrative action and the doctrine of exhaustion of remedies by determining the complaint while internal dispute resolution mechanisms were ongoing, andii.whether the respondent proved actual damage or distress under Section 65 of the Data Protection Act to justify the award of compensation of 250,000 Kenyan Shillings. 40.Under Article 47 of the Constitution of Kenya and the Fair Administrative Actions Act, the Office of the Data Protection Commissioner is bound by principles of administrative justice to afford parties a fair hearing and engagement. 41.By rushing to a final determination upon receiving notice that internal resolution procedures were active, and completely bypassing the statutory expectation to encourage alternative dispute resolution, the Data Commissioner acted prematurely and in breach of the doctrine of exhaustion of remedies. 42.Where a specific internal or statutory mechanism for dispute resolution is provided, that mechanism must be exhausted before external tribunals or courts step in to issue final determinations. 43.Furthermore, regarding the award of financial compensation, Section 65 of the Data Protection Act dictates that an individual is entitled to compensation only when they have suffered actual damage or distress as a direct result of the statutory contravention. 44.In this instance, the respondent's grievances focused heavily on unrelated operational service shortcomings, specifically the airline's failure to provide a wheelchair. 45.A mere violation of a legal right does not automatically translate into financial compensation without strict evidentiary proof of loss or quantifiable distress directly tied to that breach. 46.I find that the arbitrary award of 250,000 Kenyan Shillings lacked proper legal and evidentiary foundation. 47.The appeal is allowed. While the High Court recognizes that recorded voice conversations containing personal identifiers constitute personal data under Section 2 of the Data Protection Act, statutory bodies must act within constitutional boundaries of procedural fairness. 48.The ODPC exceeded its mandate by essentially punishing the airline for bad customer service (the wheelchair issue) disguised as a data protection penalty. 49.Consequently, the determination of the Office of the Data Protection Commissioner delivered on 15th December 2023 is hereby set aside in its entirety. 50.Each party to bear its own costs of this appeal. DATED, SIGNED AND DELIVERED ONLINE VIA MICROSOFT TEAMS AT NAIROBI THIS 22ND DAY OF MAY, 2026.A. N. ONGERIJUDGEIn the presence of:Miss Leyla Ahmed for the AppellantMr Ondiwa for the RespondentChrispine – Court Assistant