[2025] KEHC 8211 (KLR)

Metropolis Star Lab Kenya Ltd v Kioko & another (Civil Appeal E1140 of 2024) [2025] KEHC 8211 (KLR) (Civ) (12 June 2025) (Judgment)

Neutral citation: [2025] KEHC 8211 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Civil

Civil Appeal E1140 of 2024

AC Mrima, J

June 12, 2025

Between

Metropolis Star Lab Kenya Ltd

Appellant

and

Januaries Robert Kioko

1st Respondent

Ferdinand Wanga Makani

2nd Respondent

(Being an appeal from the Determination of the Data Commissioner [Immaculate Kassait, MBS] delivered on 6th September 2024 in ODPC Complaint No. 0784 as consolidated with Complaint No. 0916 of 2024)

Judgment

1. The technological advancements witnessed around the world in the field of information and communication have no doubt aided in enhancing development in many ways. However, several disputes and complaints arise in-between calling for settlement and more so, industry regulation. One cadre of such complaints are the two complaints between the parties in this matter.

2. In Kenya, the Office of the Data Protection Commissioner [hereinafter referred to as ‘the Office’] is a regulatory one in data processing and protection established under the Data Protection Act, 2019 [hereinafter referred to as ‘the Act’]. The Act is intended to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes. The Office is mandated to inter alia conduct investigations on its own initiative, or on the basis of complaints made by a data subject or a third party and may require any person that is subject to the Act to provide explanations, information and assistance in person and in writing.

3. It is on the background that the Office received complaints from Januaries Robert Kiokoand Ferdinand Wanga Makani, the Respondents herein, against the Appellant herein, Metropolis Star Lab Kenya Ltd. The complaints related to violation of the Respondents’ right to privacy as provided for in the Constitution and the Act to the extent that the Appellant unlawfully processed the Respondents’ telephone numbers for marketing and advertisement purposes and that despite the Respondents opting out several times, the marketing messages relentlessly persisted.

4. Upon receipt of the complaints, the Office initiated investigations and informed the Appellant. It also sought for response which the Appellant duly complied and offered explanation to the extent of its inculpability. The Office then carried out a forensic audit on the 2nd Respondent’s phone and also conducted a site visit to the Appellant’s premises for purposes of analysing the Appellant’s databases, operations and systems. The Office then prepared a Report which it used in determining the complaints where the Appellant was found in violation of the Respondents’ right to object to processing of their personal data and compensation made to the tune of Kshs. 250,000/= on each of the Respondents and an Enforcement Notice duly issued accordingly. The determination was rendered on 6th September 2024.

5. Aggrieved by the determination, the Appellant filed a Memorandum of Appeal before this Court dated 3rd October 2024 and preferred the following grounds: -1. The Office of the Data Protection Commissioner erred in law and fact by finding that the Appellant had violated the Respondents’ right to privacy.2. The Office of the Data Protection Commissioner erred in law and fact by finding that the Appellant had failed to fulfil its obligations as per the terms of the Data Protection Act, 2019. 3.The Office of the Data Protection Commissioner erred in law and fact by failing to find that the Appellant lawfully processed the Respondents’ data.4. The Office of the Data Protection Commissioner erred in law and fact by finding that its relationship with its service provider fell outside the provisions of the Data Protection Act, 2019. 5.The Office of the Data Protection Commissioner erred in law by awarding the Respondents compensation of Ksh. 250,000 each as damages for distress when the same was not pleaded nor proven.6. The Office of the Data Protection Commissioner erred in law and fact by failing to provide in its decision the basis, criteria and rational for awarding the Respondents compensation of Ksh. 250,000 each as damages.

6. The Appellant then prayed that the appeal be allowed, the determination and any resultant orders be set aside and it be awarded costs.

7. On the directions of this Court, parties filed and exchanged written submissions and referred to several decisions. The gist of the submissions will be ingrained in the latter part of this decision.

8. Section 64 of the Act provides for the right of appeal in the following manner: -A person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court.

9. As the appeal to the High Court is on the first instance, such an appeal is on both facts and law and this Court is under a duty to revisit the evidence on the record, evaluate it and arrive at its own conclusion. The locus classicus case of Selle and Another vs Associated Motor Boat Co. Ltd (1968) (EA 123) is alive on this issue. Further, this Court appreciates the settled principle in Mwanasokoni vs Kenya Bus Service Ltd (1982-88)1KAR 78 and Kiruga vs Kiruga and Another that an appellate Court will not ordinarily interfere with findings of fact by the trial Court unless they were based on no evidence at all, or on a misapprehension of it or the Court is shown demonstrably to have acted on wrong principles in reaching the findings.

10. Having carefully considered the record, the parties’ submissions and rival arguments, the following issues arise for determination: -i.Whether the proceedings undertaken by the Office were procedurally fair;ii.Whether the complaints were proved.

11. This Court will now deal with the first issue as to whether the proceedings undertaken by the Office were procedurally fair.

12. The Constitution and the law elaborately provide for this constitutional imperative which vouches for the processes through which complaints are received, processed and eventually determined. The Constitution encompasses this principle through inter alia Articles 47 and 50[1] which provides for the right to fair administrative actions and the right to fair hearing respectively.

13. Article 47(1), (2) and (3) of the Constitution states that: -1. Every person has the right to administrative action that is expeditious, efficient, lawful, reasonable and procedurally fair.2. If a right or fundamental freedom of a person has been or is likely to be adversely affected by administrative action, the person has the right to be given written reasons for the action.3. Parliament shall enact legislation to give effect to the rights in clause (1) and that legislation shall—a.provide for the review of administrative action by a Court or, if appropriate, an independent and impartial tribunal; andb.promote efficient administration.

14. The legislation that was contemplated under Article 47(3) is the Fair Administrative Actions Act. Section 4 thereof provides that: -4. Administrative action to be taken expeditiously, efficiently, lawfully etc.(1)Every person has the right to administrative action which is expeditious, efficient, lawful, reasonable and procedurally fair.(2)Every person has the right to be given written reasons for any administrative action that is taken against him.(3)Where an administrative action is likely to adversely affect the rights or fundamental freedoms of any person, the administrator shall give the person affected by the decision–(a)prior and adequate notice of the nature and reasons for the proposed administrative action;(b)an opportunity to be heard and to make representations in that regard;(c)notice of a right to a review or internal appeal against an administrative decision, where applicable;(d)a statement of reasons pursuant to section 6;(e)notice of the right to legal representation, where applicable;(f)notice of the right to cross-examine or where applicable; or(g)information, materials and evidence to be relied upon in making the decision or taking the administrative action.(4)The administrator shall accord the person against whom administrative action is taken an opportunity to–(a)attend proceedings, in person or in the company of an expert of his choice;(b)be heard;(c)cross-examine persons who give adverse evidence against him; and(d)request for an adjournment of the proceedings, where necessary to ensure a fair hearing.(5)Nothing in this section, shall have the effect of limiting the right of any person to appear or be represented by a legal representative in judicial or quasi-judicial proceedings.(6)Where the administrator is empowered by any written law to follow a procedure which conforms to the principles set out in Article 47 of the Constitution, the administrator may act in accordance with that different procedure.

15. Section 2 of the Fair Administrative Actions Act defines an ‘administrative action’, an ‘administrator’ and a ‘decision’ as follows: -‘administrative action’ includes –i.The powers, functions and duties exercised by authorities or quasi-judicial tribunals; orii.Any act, omission or decision of any person, body or authority that affects the legal rights or interests of any person to whom such action relates;‘administrator’ means ‘a person who takes an administrative action or who makes an administrative decision’."decision" means any administrative or quasi-judicial decision made, proposed to be made, or required to be made, as the case may be;

16. The Court of Appeal in Civil Appeal 52 of 2014 Judicial Service Commission vs. Mbalu Mutava & Another (2015) eKLR addressed itself to Article 47 of the Constitution as follows: -…... Article 47(1) marks an important and transformative development of administrative justice for, it not only lays a constitutional foundation for control of the powers of state organs and other administrative bodies, but also entrenches the right to fair administrative action in the Bill of Rights. The right to fair administrative action is a reflection of some of the national values in article 10 such as the rule of law, human dignity, social justice, good governance, transparency and accountability. The administrative actions of public officers, state organs and other administrative bodies are now subjected by article 47(1) to the principle of constitutionality rather than to the doctrine of ultra vires from which administrative law under the common law was developed.

17. In South Africa, the Constitutional Court in President of the Republic of South Africa and Others vs. South African Rugby Football Union and Others CCT16/98) 2000 (1) SA 1 ring-fenced the importance of fair administrative action as a constitutional right. The Court referred to Section 33 of the South African Constitution which is similar to Article 47 of the Kenyan Constitution. The Court expressed itself as under: -Although the right to just administrative action was entrenched in our Constitution in recognition of the importance of the common law governing administrative review, it is not correct to see section 33 as a mere codification of common law principles. The right to just administrative action is now entrenched as a constitutional control over the exercise of power. Principles previously established by the common law will be important though not necessarily decisive, in determining not only the scope of section 33, but also its content. The principal function of section 33 is to regulate conduct of the public administration, and, in particular, to ensure that where action taken by the administration affects or threatens individuals, the procedures followed comply with the constitutional standards of administrative justice. These standards will, of course, be informed by the common law principles developed over decades…

18. Article 47 of the Constitution, therefore, goes beyond being a mere codification of the common law principles on administrative action. Its main purpose is to ‘… regulate conduct of the public administration, and, in particular, to ensure that where action taken by the administration affects or threatens individuals, the procedures followed comply with the constitutional standards of administrative justice…’. The entrenchment of Article 47 in the Constitution was a deliberate move by Kenyans in demanding inter alia fairness, transparency and accountability in public administration. Public officers must, therefore, embrace the paradigm shift and engage the right gear in ensuring that the manner in which they make and execute administrative decisions complies with Article 47 of the Constitution and the Fair Administrative Actions Act.

19. Article 50[1] of the Constitution provides for the right to fair hearing as follows: -Every person has the right to have any dispute that can be resolved by the application of law decided in a fair and public hearing before a court or, if appropriate, another independent and impartial tribunal or body.

20. Apart from the Constitution and the Fair Administrative Actions Act, the Data Protection (Complaints Handling Procedure and Enforcement) Regulations [hereinafter referred to as ‘the Regulations’] made under the Act provides under Regulation 3 as follows: -3. Object and purpose of the RegulationsThe object and purpose of these Regulations is to—(a)facilitate a fair, impartial, just, expeditious, proportionate and affordable determination of complaints lodged with the Data Commissioner in accordance with the Act and these Regulations, without undue regard to technicalities of procedure;(b)provide for issuance of enforcement notices as contemplated under section 58 of the Act;(c)provide for issuance of issuance of penalty notices as contemplated under section 62 of the Act;(d)provide for the procedure for hearing and determining of complaints; and(e)provide for the resolution of complaints lodged with the Data Commissioner by means of alternative dispute resolution mechanisms as specified under section 9(1)(c) of the Act.

21. Further, in the course of undertaking investigations, the Office is called upon vide Regulation 13(3) to ensure that: -(3)In conducting investigations under this regulation, the Data Commissioner shall be guided by the provisions of the Fair Administrative Action Act (Cap. 7J).

22. With the foregoing legal position, this Court will now ascertain whether the Appellant was accorded an expeditious, efficient, lawful, reasonable and procedurally fair process before the impugned determination was made.

23. From the record, upon receipt of the complaints from the Respondents, the Office initiated investigations and carried out a forensic audit on the 2nd Respondent’s phone and conducted a site visit to the Appellant’s premises for purposes of analysing the Appellant’s databases, operations and systems. It subsequently prepared a Report dated 27th August 2024. This Court has carefully considered the report. Relevant to the issue in consideration are two observations. The first one is that there are no details in the manner in which the forensic audit on the 2nd Respondent’s phone was undertaken. As such, this Court can reasonably conclude that the forensic audit did not involve the Appellant or at all.

24. The second observation is on the site visit. There is no doubt that the visit was conducted and the Appellant took part. The Report captures the Appellant’s officers who were involved in the exercise. Apart from the report having been used in deciding the complaints, nothing more turns on it.

25. By placing the above two observations side by side with the foregoing legal dispensation, it is apparent that the manner in which the investigations were carried out fell short of the expected legal threshold. As a bare minimum, the following ought to have taken place: -(i)The Appellant was to be, at least, notified of the intended forensic audit on the 2nd Respondent’s phone.(ii)A report on the forensic audit ought to have been prepared and the Appellant accorded an opportunity to interrogate it, and to challenge it, if it so wished, including adducing evidence.(iii)The Appellant was to be provided with the report that was prepared on the site visit.(iv)Likewise, the Appellant was to be accorded an opportunity to interrogate and challenge the site visit report including adducing evidence.(v)The Data Commissioner then ought to have considered the Appellant’s reaction to the reports in the determination.

26. Apart from the above, on receipt of any complaint, the Data Commissioner is also called upon to, in the first instance, encourage alternative dispute resolution between the parties. Regulation 15 provides for negotiation, mediation and conciliation of disputes lodged with the Commissioner. Due to the centrality of the provision in this discussion, a reproduction thereof follows: -15. Negotiation, mediation or conciliation:(1)Where the complaint is to be determined through negotiations, mediation or conciliation, the provisions of these Regulations shall apply.(2)Where parties to a complaint agree to negotiation, mediation or conciliation, the Data Commissioner may in consultation with the parties facilitate the process.(3)During the negotiations, mediation or conciliation, the Data Commissioner may apply such procedures as may, in the interest of the parties, deem appropriate in the circumstances.(4)At the conclusion of the negotiations, mediation or conciliation process, the parties shall sign a negotiation, mediation or conciliation agreement in the manner specified in Form DPC 5 set out in the Schedule.(5)A negotiation, mediation or conciliation agreement entered into under this regulation shall be deemed to be a determination of the Data Commissioner, and shall be enforceable as such.(6)Despite this regulation, a party to dispute who is subject to a negotiation, mediation or conciliation may withdraw from the proceedings at any stage and shall notify the Data Commissioner and other parties of such withdrawal within seven days from the date of making such a decision.(7)Parties to a dispute shall take all reasonable measures to amicably determine a dispute and act in good faith.(8)Where the complaint is not determined through negotiation, mediation or conciliation, the Data Commissioner shall proceed to determine the complaint as provided for in the Act and these Regulations.

27. Therefore, the architectural design on how the Data Commissioner is to deal with any complaint filed is to initially initiate alternative dispute resolution through negotiation, mediation and conciliation. It is only after such process[es] fail that the Data Commissioner should then proceed to hear and determine the dispute. It then means that the Data Commissioner runs a foul the law when it outrightly proceeds to hear and determine a complaint before engaging the parties on the alternative dispute resolution mechanisms. Evidence of engaging the parties to undertake any of the alternative dispute resolution mechanisms must form part of the record of the Data Commissioner on the complaints received. In this matter, there is no evidence that the Data Commissioner engaged the parties on the alternative dispute resolution mechanisms.

28. Having said as much and on the basis of the above discussion, this Court finds that the Data Commissioner did not abide by the dictates of the Constitution and the law and thereby failed to accord the Appellant a fair hearing and fair administrative procedures. The upshot is that the Appellant’s rights which are constitutionally ring-fenced were variously infringed. The appeal is, therefore, merited. With this finding, there is no need of considering the second issue on whether the complaints were proved since such will be only academic.

29. As this Court comes to the end of this judgment, and given the manner in which the complaints were handled, the Court is under an obligation to re-assert the place of Article 159[2][c] of the Constitution which mandatorily requires alternative forms of dispute resolution including reconciliation, mediation, arbitration and traditional dispute resolution mechanisms to be promoted. It, hence, means that in instances where the law goes further to specifically provide for parties to first consider alternative forms of dispute resolution, then the record of the Court or Tribunal must clearly state how the issue was handled. That is the only way the aspirations of Kenyans in passing the Constitution in 2010 will be realized.

30. Deriving from the foregoing, this Court hereby makes the following final orders: -(a)The appeal be and is hereby allowed.(b)A declaration hereby issue that the determination dated 6th September 2024 by the Data Commissioner in ODPC Complaint No. 0784 as consolidated with Complaint No. 0916 of 2024 did not comply with Articles 47 and 50[1] of the Constitution, the Fair Administrative Actions Act, the Data Protection Act and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations for failing to accord the Appellant a fair hearing and fair administrative procedures. The said determination be and is hereby set aside and quashed.(c)This matter is hereby remitted to the Data Commissioner to be dealt with in accordance with the Constitution and the law and as per the guidance in this judgment.(d)As the appeal has been allowed on the basis of the manner the complaints were handled by the Data Commissioner, then each party shall bear its own costs of the appeal.(e)The Hon. Deputy Registrar of this Division shall transmit copies of this judgment to the Judiciary Committees on Mediation and Alternative Justice Systems [AJS] with a view to foster collaboration between the Data Commissioner and the Committees.Orders accordingly.

DELIVERED, DATED AND SIGNED AT NAIROBI THIS 12TH DAY OF JUNE, 2025. A. C. MRIMAJUDGEJudgment virtually delivered in the presence of:Mr. Dachi, Learned Counsel for the Appellant.Mr. Mukhuyi, Learned Counsel for the 1st Respondent.Mr. Odek, Learned Counsel for the 2nd Respondent.Amina/Abdirazak – Court Assistants.