https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/9290

Megatank Solar Energy Ltd v Nyaga & another (Civil Appeal E928 of 2025) [2026] KEHC 9290 (KLR) (Civ) (25 June 2026) (Judgment) Neutral citation: [2026] KEHC 9290 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Law Courts) Civil Civil Appeal E928 of 2025 WA Okwany, J June 25, 2026 Between Megatank Solar Energy Limited Appellant and Ruth Murugi Nyaga 1st Respondent Xinda Accounting Firm 2nd Respondent (Being an appeal from the the determination of the Office of the Data Protection Commissioner (ODPC) in Complaint No. 0682 of 2025 delivered on 11th August 2025) Judgment Background 1.The 1st Respondent herein was employed by the Appellant between April 2024 and April 2025. During the course of her employment, her personal mobile telephone number was used as the contact number for the Appellant's KRA eTIMS/iTax registration and integration processes. 2.The Appellant contends that the registration was undertaken with the knowledge, participation and implied consent of the 1st Respondent. The 1st Respondent, on the other hand, maintains that she never granted express consent for her personal telephone number to be used as the official contact number for the Appellant's tax and commercial operations. 3.The 1st Respondent subsequently, requested that her telephone number be removed and replaced with another number. She states that despite such requests, she continued to receive communications from the Appellant's customers and persons seeking tax-related information associated with the Appellant's business. She therefore lodged a complaint before the Office of the Data Protection Commissioner (ODPC) alleging unlawful processing of her personal data. 4.Upon investigation, the Commissioner found that the Appellant had failed to demonstrate that it obtained the 1st Respondent’s express consent as required by the law and had therefore violated the 1st Respondent's rights under the Data Protection Act. 5.The Commissioner also found that the Appellant unlawfully processed the 1st Respondent's personal telephone number for commercial and tax regulatory purposes without obtaining the requisite consent under the Data Protection Act, 2019. The Commissioner consequently awarded compensation of Kshs. 400,000 but dismissed the complaint against the 2nd Respondent. The Appeal 6.Aggrieved by the Commissioner’s determination, the Appellant lodged the present appeal seeking orders to set aside the said decision in its entirety. The grounds in the Appellant's appeal may be summarized as follows:a.The Commissioner erred in finding that consent had not been established.b.The Commissioner failed to appreciate evidence showing the 1st Respondent's participation in the registration process.c.The Commissioner ignored evidence demonstrating that the Appellant acted upon the request to replace the number.d.The findings were unsupported by the evidence.e.The Commissioner failed to follow precedent.f.The award of Kshs. 400,000 was excessive and unreasonable.g.The Commissioner improperly exercised discretion. 7.The appeal was canvassed by way of written submissions which I have considered. The Appellant's Submissions 8.The Appellant submitted that the 1st Respondent was fully aware that her telephone number was used in the registration process. Reliance was placed on communications in which the 1st Respondent requested replacement of the number and even proposed an alternative number. According to the Appellant, those communications demonstrate knowledge and acquiescence. 9.The Appellant further argued that the 1st Respondent shared One-Time Password (OTP) verification codes necessary for registration and that she actively assisted in the registration process. 10.The Appellant added that the 1st Respondent’s request for telephone number replacement was eventually implemented which evidence the Commissioner failed to appreciate. 11.On the award of damages, the Appellant argued that the award of Kshs. 400,000 is manifestly excessive. Reliance was placed on the decisions in ODPC Complaint No. 0697 of 2025 Andrew Endovo vs. Standard Investment Bank, where the sum of Kshs. 50,000 was awarded and ODPC Complaint No. 2109 of 2023 Emily Sila vs. Xerox Technology Company Limited, where damages were itemized under various heads. 12.The Appellant contended that a sum not exceeding Kshs. 100,000 would have been reasonable in the circumstances. The 1st Respondent's Submissions 13.The 1st Respondent supported the Commissioner's decision and submitted that the issue is not whether she knew her number had been used but whether she gave express consent as required by the Data Protection Act. According to the 1st Respondent, participation in a registration process or sharing OTP codes cannot substitute the statutory requirement for informed and express consent. 14.The 1st Respondent further submitted that the Appellant did not inform her that her number would become the official contact for tax and commercial operations. She emphasized that the Appellant never disclosed the nature, scope, purpose and consequences of the processing of her number and further, that her efforts to remove the number demonstrate objection rather than consent. 15.It was submitted that the unlawful processing continued even after she sought removal. Reliance was placed on Muthoni vs. Solpia Kenya Limited t/a Sista Kenya (Civil Appeal E164178 of 2024) [2025] KEHC 34 (KLR) where the High Court emphasized that the data controller bears the burden of proving that consent, under the Act, was obtained before processing and that consent for commercial use must be apparent and express. 16.Reference was also made to Emily Sila vs. Xerox Technology Company Limited (ODPC No. 2109 of 2023) where compensation was awarded for multiple violations of data protection rights and Cinderella Oyuke vs. Capstudio KE (ODPC Complaint No. 1548 of 2024) where substantial compensation was awarded for unauthorized commercial use of personal data. 17.The 1st Respondent submitted that the award of Kshs. 400,000 was reasonable and proportionate. Analysis and Determination 18.Having considered the record of appeal, submissions and applicable law, I find that the following issues arise:a.Whether the Appellant obtained valid consent for the use of the 1st Respondent's telephone number.b.Whether the Appellant violated the 1st Respondent's rights under the Data Protection Act, 2019.c.Whether the award of Kshs. 400,000 was excessive or unreasonable. 19.Section 2 of the Data Protection Act (the Act) defines consent as:Any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes. 20.Section 30(1)(a) of the Act prohibits processing personal data without consent while Section 32 places the burden of proof of consent upon the data controller. 21.Section 37(1) of the Act expressly provides that personal data shall not be used for commercial purposes unless express consent has been obtained. 22.This Court is persuaded by the reasoning in Muthoni vs. Solpia Kenya Limited t/a Sista Kenya (supra) where the Court emphasized that consent for commercial processing is not constructive or implied but must be express and demonstrable. 23.In the instant case, the Appellant relied heavily on One-Time Password (OTP) sharing, participation in registration and subsequent requests to replace the number as demonstration of the 1st Respondent’s consent. I however find that none of those matters establishes that the 1st Respondent was informed that her number would become the official tax contact, that customers would access it through tax documents, that it would be used for commercial purposes and how long such use would continue. 24.My view is that knowledge of use is not synonymous with consent. Similarly, participation in registration does not relieve a controller from proving compliance with statutory requirements. 25.I therefore agree with the Commissioner that the Appellant failed to discharge the burden imposed by Section 32 of the Act and find that the Appellant did not obtain the 1st Respondent’s consent to use her telephone number. 26.Section 26(a) of the Act grants every data subject the right to be informed of the use to which personal data is to be put while Section 26(c) grants the right to object to processing. 27.In the instant case, no material was placed before this court to show that the Appellant informed the 1st Respondent that her number would serve as the company's official eTIMS contact. It was not disputed that the 1st Respondent subsequently sought removal of the number and that despite those efforts, the number remained associated with the Appellant's tax profile for a significant period as customers continued to contact her regarding the Appellant's products and tax matters. 28.I find that the Appellant's conduct infringed the right to be informed, the right to object and the right to privacy protected under Article 31 of the Constitution. 29.It is my finding that the Commissioner correctly concluded that the Appellant unlawfully processed the 1st Respondent's personal data for commercial purposes. The Award 30.On whether the award was excessive, I note that Section 65 of the Act permits compensation for both financial and non-financial loss including distress. 31.The Appellant contended that the award of Kshs. 400,000 made by the Data Commissioner was manifestly excessive and disproportionate to the circumstances of the case. It was submitted that the Commissioner failed to sufficiently consider the evidence demonstrating that the 1st Respondent was aware of, and initially participated in the registration process that resulted in her telephone number being linked to the Appellant's eTIMS account. 32.It is trite that before interfering with an award of damages made by a trial court or tribunal, an appellate court must exercise considerable restraint. The law is settled that assessment of damages is a matter of judicial discretion and an appellate court will not ordinarily disturb such an award merely because it would have arrived at a different figure. Interference is only justified where it is demonstrated that the court below acted on wrong principles of law, took into account irrelevant factors, failed to take into account relevant factors, or where the award is so inordinately high or low as to represent an entirely erroneous estimate of the damage suffered. 33.The above principle was authoritatively stated in Butt vs. Khan [1982-88] 1 KAR 1, where the Court of Appeal held that an appellate court should not disturb an award of damages unless it is shown that the trial court proceeded on wrong principles or that the award was so excessive or so low as to amount to an erroneous estimate. The same position was reiterated in Kemfro Africa Ltd t/a Meru Express Services & Another vs. A.M. Lubia & Another [1982-88] 1 KAR 727, where the Court emphasized that appellate interference is only warranted where the award is based on a misapprehension of the evidence or application of the wrong legal principles. 34.Applying the principles stated in the above cited cases to the present appeal, I am satisfied that there exists sufficient basis for interference with the award made by the Commissioner. I find that while the Commissioner correctly found that the Appellant violated the 1st Respondent's rights under the Data Protection Act by failing to obtain the requisite express consent, insufficient weight was accorded to the mitigating circumstances disclosed by the evidence. In particular, the Commissioner did not adequately consider the 1st Respondent's active participation in the registration process, the absence of evidence of deliberate exploitation of her data, and the fact that steps were subsequently taken to replace the impugned telephone number once the complaint was raised. 35.The communication records produced by the Appellant reveal that on or about 15th November 2024, the 1st Respondent contacted representatives of the 2nd Respondent seeking replacement of the registered telephone number. The correspondence of 20th and 21st November 2024 demonstrates that the 1st Respondent proposed an alternative number and that the replacement process was undertaken. The evidence before the Commissioner further indicated that the registered number was changed on 21st November 2024. 36.As I have already found in this judgment, such participation did not amount to the express consent required under Sections 30 and 37 of the Data Protection Act for commercial processing of personal data, it is nevertheless a relevant factual consideration in assessing the extent of the infringement and the appropriate remedy. 37.Accordingly, I find that unlike cases involving deliberate or persistent refusal to rectify unlawful processing, the present matter discloses that steps were taken by the Appellant and the 2nd Respondent to address the 1st Respondent's concerns once the request for replacement was made. Although the Court agrees with the Commissioner that the Appellant did not obtain the express consent required by law and thereby violated the 1st Respondent's rights under the Data Protection Act, I find that the subsequent corrective action materially mitigates the gravity of the breach. 38.I am also mindful of the fact that damages under Section 65 of the Data Protection Act are compensatory rather than punitive. The purpose of such an award is to vindicate the data subject's rights and compensate for the infringement suffered, while maintaining proportionality to the nature and extent of the violation. 39.In the circumstances of this case, I find that the award of Kshs. 400,000 was inordinately high. I say so because the evidence on record reveals that there was an initial level of cooperation and participation by the 1st Respondent in the registration process, followed by a request for removal of the number which was subsequently effected. The breach therefore cannot be equated with cases involving deliberate exploitation of personal data, repeated non-compliance, or continued processing after clear refusal to comply with a data subject's objections. 40.Taking into account all the circumstances of the case, including the absence of proof of pecuniary loss, the mitigating steps taken to replace the number, and the need to uphold the statutory right to privacy while ensuring proportionality in the award of compensation, I find that an award of Kenya Shillings One Hundred Thousand (Kshs. 150,000) as compensation for the violation of the 1st Respondent's rights under the Data Protection Act will be appropriate. 41.Consequently, the award of the Office of the Data Protection Commissioner is hereby set aside and substituted as stated hereinabove. 42.Accordingly, the appeal succeeds, albeit partially, only on the issue of quantum and the Court makes the following final orders:a.The finding of liability against the Appellant for unlawful processing of the 1st Respondent's personal data is upheld.b.The finding that the Appellant failed to obtain the requisite consent under the Data Protection Act is affirmed.c.The award of Kshs. 400,000 made by the Office of the Data Protection Commissioner is set aside.d.In its place, judgment is entered in favour of the 1st Respondent in the sum of Kshs. 150,000 as nominal damages for violation of her rights under the Data Protection Act, 2019.e.Each party shall bear its own costs of the appeal.It is so ordered. DATED, SIGNED AND DELIVERED AT NAIROBI ON THIS 25TH DAY OF JUNE 2026.HON W A OKWANYJUDGEIn the presence of;No appearance for the AppellantOdhiambo for 1st RespondentAbdirzak – Court Assistant