https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/12706

**REPUBLIC OF KENYA** **IN THE HIGH COURT OF KENYA AT NAIROBI** **MILIMANI LAW COURTS** **CIVIL APPELLATE DIVISION** **HIGH COURT CIVIL APPEAL NO. E909 OF 2025** **OUTLOOK INDEX LIMITED...............................................APPELLANT** **VERSUS** **CAROLINE WANGARI GITHURE....................................RESPONDENT** ***(Being an appeal against the Determination of the Data Protection Commissioner (Immaculate Kassait) delivered on 7th August 2025 in ODPC Complaint No. 0662 of 2025: Caroline Wangari Githure vs. Outlook Index Limited)*** **JUDGMENT** 1. This appeal challenges the determination of the Office of the Data Protection Commissioner (ODPC) delivered on 7th August 2025 wherein the Commissioner found that the Appellant had violated the Respondent's right of access to her personal data and awarded the Respondent Kshs.250,000 as compensation. 2. Aggrieved by the award on quantum, the Appellant lodged the present appeal. 3. Pursuant to the directions issued by this Court on 13th April 2026, the appeal was canvassed by way of written submissions. 4. The Appellant duly filed its written submissions. The Respondent was on 13th April 2026 granted twenty-one (21) days within which to file and serve her submissions. However, by the time of writing this judgment, no submissions had been filed on behalf of the Respondent. The Court has nonetheless considered the Memorandum of Appeal, the Record of Appeal, the impugned determination and the Appellant's submissions in determining the appeal. 5. The Memorandum of Appeal raises five grounds which, in summary, fault the Commissioner for awarding Kshs.250,000 without giving reasons or identifying the criteria adopted in arriving at the award. The Appellant faults the Commissioner for failing to appreciate that the Respondent suffered no demonstrable pecuniary loss or quantifiable damage arising from the delayed access to her P9 form; for ignoring mitigating circumstances including the eventual provision of the P9 form and the corrective measures instituted by the Appellant; for failing to apply the principles stated in ***Muthoni vs. Solpia Kenya Ltd t/a Sista Kenya* (Civil Appeal E164 of 2024) [2025] KEHC 34 (KLR)** regarding the need to give reasons for an award of compensation; and for arriving at an award that was against the weight of the evidence and therefore unreasonable. The Appellant consequently seeks orders for the setting aside of the award of Kshs.250,000 or, in the alternative, a reduction of the said award to a nominal sum. 6. In its written submissions, the Appellant clarifies that it does not challenge the Commissioner's finding that there was delay in availing the Respondent's P9 form. The appeal is confined to the award of compensation. 7. Counsel for the Appellant submits that the Commissioner exercised her discretion arbitrarily by awarding Kshs.250,000 without identifying the legal principles, criteria or methodology employed in arriving at the said figure. 8. It is argued that the determination does not disclose whether the award was based on financial loss, emotional distress, inconvenience or any other recognised head of damage, thereby rendering appellate review difficult. Reliance was placed on ***Muthoni vs. Solpia Kenya Ltd t/a Sista Kenya* (Civil Appeal E164 & 178 of 2024) [2025] KEHC 34 (KLR)** where the High Court recommended that the Commissioner should always give reasons for the quantum of compensation awarded. 9. The Appellant further submits that no evidence was tendered before the Commissioner to demonstrate that the Respondent suffered actual financial loss, tax penalties, emotional distress or any measurable prejudice arising from the delayed access to the P9 form. 10. Reference was made to the decision of the UK Supreme Court in ***Lloyd vs. Google LLC*****[2021] UKSC 50; [2022] AC 1217 where it was held, inter alia, that m**ere loss of control of personal data, without proof of material damage or distress, is **not sufficient** to justify an award of damages under section 13 of the **Data Protection Act 1998** and that **i**ndividual assessment of damage would have been required, making the representative action inappropriate. 11. It was also submitted that the requested P9 form had already been supplied before the Commissioner rendered the impugned determination and that the Commissioner failed to take into account this mitigating factor together with the Appellant's prompt response upon receipt of the complaint and the corrective measures implemented thereafter. 12. On the question of whether this Court should interfere with the award, the Appellant relied on ***Gathogo & another vs. Maina [2024] KEHC 16609 (KLR)****,* ***Muinde vs. Muthama* [2025] KEHC 6579 (KLR)** and ***Butt vs. Khan* [1982] 1 KAR**, for the argument that an appellate court is entitled to interfere with the award of damages where the trial court or tribunal acted on wrong principles, failed to consider relevant factors or arrived at an award that is plainly erroneous. **Analysis and Determination** 1. I have considered the Record of Appeal, the Memorandum of Appeal, the Appellant's submissions and the impugned determination. 2. As a first appellate court, my duty is to re-evaluate the material that was before the Commissioner and arrive at my own independent conclusions, bearing in mind that I neither saw nor heard the parties’ testimonies. (See ***Abok James Odera t/a A.J. Odera & Associates vs. John Patrick Machira t/a Machira & Co. Advocates* [2013] eKLR)**. 3. The only issue falling for determination is whether the Commissioner properly exercised her discretion in awarding the Respondent Kshs.250,000 as compensation. 4. Section **65(1)** of the **Data Protection Act, 2019** empowers the Commissioner to award compensation where a data subject suffers damage by reason of a contravention of the Act. Section **65(2)** provides that damage includes both financial loss and non-financial loss, including distress. It follows that while the power to award compensation is discretionary, that discretion must be exercised judicially and on the basis of the facts and evidence presented in each case. 5. I have carefully perused the impugned determination. The Commissioner found that the Appellant had violated the Respondent's right of access to personal data and proceeded to award compensation of Kshs.250,000 after stating that she had taken into account "the nature and extent of the violation" and the conduct of the Respondent. Beyond that brief statement, the determination does not disclose the basis upon which the figure of Kshs.250,000 was reached. It does not identify the nature of the damage suffered, the degree of distress proved, the aggravating or mitigating factors considered or the principles that informed the quantum awarded. 6. I agree with the observation made by the court in ***Muthoni vs. Solpia Kenya Ltd t/a Sista Kenya* (supra)** that the Commissioner ought to provide reasons for the compensation awarded so as to assure the parties of the fairness of the award and to facilitate meaningful appellate review. 7. My finding is that while the absence of reasons does not necessarily invalidate every award, it becomes problematic where, as in the present case, the award appears to have been made without reference to any identifiable criteria. 8. The record further shows that the Appellant supplied the Respondent's P9 form shortly after receiving the complaint from the Commissioner and explained that the delay resulted from migration of its payroll system. I find that although the breach had already occurred, these were relevant mitigating circumstances that ought to have featured in the assessment of quantum. 9. Still on the assessment of damages, there is no evidence on record to show that the Respondent suffered any financial loss, tax penalties or other measurable prejudice attributable to the delayed access to the document. The Commissioner did not analyse whether the compensation was intended to redress distress, inconvenience or any other form of non-pecuniary loss recognised under Section 65 of the Act. 10. In the circumstances of this case, I am satisfied that the Commissioner did not sufficiently explain the basis upon which the award of Kshs.250,000 was arrived at. My view is that this Court is therefore entitled to interfere with the award on the principles stated in***Butt vs. Khan*** (supra) namely; that an appellate court may interfere where the tribunal acted on wrong principles or failed to take into account relevant considerations. 11. Accordingly, I find merit in the appeal and I hereby allow it to the extent that the award of **Kshs.250,000** made by the Office of the Data Protection Commissioner is **set aside.** Taking into account the admitted breach, the eventual compliance by the Appellant, the absence of evidence of actual pecuniary loss and the need to vindicate the Respondent's statutory rights under the Data Protection Act, I substitute the said award with **nominal damages of Kshs.50,000.** 12. Each party shall bear its own costs of the appeal. **DATED, SIGNED AND DELIVERED VIRTUALLY THIS 30TH DAY OF JULY 2026** **HON W A OKWANY** **JUDGE**