https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/7257

**REPUBLIC OF KENYA** **IN THE HIGH COURT OF KENYA AT NAIROBI** **CIVIL APPELLATE DIVISION** **HCCA NO. E282 OF 2025** **PLATINUM CREDIT LIMITED….………….…………….….APPELLANT** **VERSUS** **DATA PROTECTION COMMISSIONER..…………..1ST RESPONDENT** **SAMUEL KAMAU WAWERU………………………...2ND RESPONDENT** *(Being an Appeal from the Office of Data Protection Commissioner (ODPC) No. 1957 of 2024 delivered on 24th February, 2025* **JUDGMENT** 1. The 2nd Respondent filed a complaint with the ODPC being ODPC Complaint No. 1957 of 2024 seeking compensation for unsolicited text message and calls by the Appellant promoting its loan products without his knowledge/authorisation. 2. The complaint was received by the ODPC on 27/11/2024 and they notified the Appellant of the complaint vide letter dated 11/12/2024. 3. The Appellant submitted its response via letter dated 19/12/2024. 4. The 2nd Respondent’s case was that on 18/11/2024, he received an unsolicited call from a Sales Representative of the Appellant who told him he had access to his personal identification information including specific details of his vehicle. 5. The Sales Representative told the 2nd Respondent that the Appellant shared the said details to contact the 2nd Respondent and advertise their products. 6. The 2nd Respondent said he had never interacted/engaged with the Appellant in any business or communication. 7. The Appellant denied the allegations and said the said Agent was neither associated with its agents nor registered to its employees. 8. The ODPC did investigations and established that the Appellant’s Agent had called the 2nd Respondent and that the Appellant did not obtain the 2nd Respondent’s consent before processing his personal data. 9. Having found that the Appellant processed the 2nd Respondent’s personal data unlawfully for commercial interest, the ODPC directed the Appellant to pay the 2nd Respondent Ksh. 400,000/= as compensation. 10. The ODPC issued an enforcement notice to the Appellant. 11. Further, a recommendation for prosecution of the appellant’s Directors was made for furnishing ODPC with information which they knew was false and misleading which is an offence under Section 57(3) as read with Section 73 of the Act. 12. The Appellant has appealed against the said Judgment on the following grounds:- 13. ***That the Commissioner erred in law and fact in holding that there was a violation of the complainant’s right to object and right of erasure yet the Appellant was denied the right to fair hearing as the Appellant was never served with the additional evidence submitted by the lady identified as Vivian whose testimony was heavily relied on to form the determination, neither was the Appellant given the opportunity to defend themselves or counter her claims.*** 14. ***That the Commissioner erred in law and fact in holding that there was a violation of the complaint’s right to objet and right of erasure because there was bias and unfair reliance on unverified statements in making the determination as the Commissioner relied on Vivian’s allegations without allowing the Appellant to file a rejoinder or respond and counter her allegations.*** 15. ***That the Commissioner erred in law and fact in holding that there was a violation of the complaint’s right to object and right of erasure by the Appellant because there was bias in the Commissioner’s Approach in making the determination as the Commissioner failed to acknowledge in their determination that their own site investigation did not find Vivian’s name or number in the Appellant’s records and that during their initial visit, they found no concrete evidence linking her to the Appellant.*** 16. ***That the Commissioner erred in law and fact in holding that there was a violation of the complainant’s right to object and right of erasure yet there was lack of contractual proof as the evidence provided by Vivian did not include any Sales Agent Agreement proving she was officially contracted by the Appellant.*** 17. ***That the Commissioner erred in law and fact in holding that there was a violation of the complainant’s right to object and right of erasure yet there was selective use of findings as the Commissioner omitted crucial details from their determination specifically, that their own investigation yielded no connection between the Appellant and the alleged call.*** 18. ***That the Commissioner erred in law and fact in imposing an unfair penalty based on one Personal’s claim as the entire case is built on Vivian’s testimony, yet the Commissioner did not establish or verify her role within the Appellant’s Organization.*** 19. ***That the Commissioner erred in law and fact in imposing an unjust and unbalanced judgment as the determination appears one-sided and fails to consider key facts in the Appellant’s response.*** 20. The parties filed written submissions as follows: The appellant’s submissions challenged the determination by the Data Protection Commissioner dated 24th February 2025, which found the appellant liable for violating the second respondent’s data protection rights by sending unsolicited text messages and calls. 21. The Commissioner ordered the appellant to pay Kshs. 400,000 in compensation and recommended prosecution of the appellant’s directors for providing false or misleading information. 22. The appellant argues that the Commissioner’s decision was procedurally flawed and substantively unfair. 23. Specifically, the appellant contends that it was denied a fair hearing because it was never served with additional evidence from a person named Vivian Achieng, whose testimony was central to the ruling, and was not given an opportunity to respond to her claims. 24. Further, the appellant submitted that the site visit by the Office of the Data Protection Commissioner was conducted without prior notice of the complaint, leaving the appellant unaware of the allegations. 25. The Commissioner also failed to prepare an investigation report as required under the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021, and issued an enforcement notice simultaneously with the determination, effectively prejudging the outcome. 26. The appellant further submitted that the Commissioner did not encourage alternative dispute resolution before proceeding to hear the complaint, contrary to the regulations. 27. On the merits, the appellant denied any contractual or operational link to Vivian Achieng, asserting that she was never an agent, had no formal agreement with the company, and acted on her own accord. 28. The WhatsApp group referenced was unofficial, and the team leader mentioned was not part of management. 29. The appellant also argued that the compensation awarded is excessive and disproportionate, as the second respondent suffered no proven harm, financial loss, or emotional distress. 30. Finally, the appellant seeks to have the determination set aside and costs awarded in its favour. 31. The 1st Respondent, the Office of the Data Protection Commissioner (ODPC), filed written submissions opposing the Appellant’s appeal against a determination made on 24th February 2025. 32. The 1st Respondent submitted that the dispute arose from a complaint lodged by the 2nd Respondent, Samuel Kamau Waweru, alleging that the Appellant, Platinum Credit Limited, processed his personal data for marketing purposes without his express consent. 33. After notifying the Appellant and conducting investigations under the Data Protection Act and relevant regulations, the Data Commissioner found the Appellant liable, ordered compensation of KES 400,000, and issued an Enforcement Notice. 34. The 1st Respondent argues that the Appellant was not denied a fair hearing, as the Appellant was duly notified of the complaint, invited to respond, and did respond on 19th December 2024. 35. The 1st Respondent contends that the right to a fair hearing in administrative proceedings does not amount to an endless right to reply to every document, and that the Appellant has failed to demonstrate any specific procedural omission or prejudice. 36. On the allegation of bias, the 1st Respondent submitted that the Appellant has not met the high threshold of proving actual bias or a reasonable apprehension of bias, citing case law that requires a fair-minded and informed observer to find a real possibility of bias. 37. The 1st Respondent maintains that the Commissioner’s investigation was objective, evidence-driven, and based on documentary evidence, inspection findings, and the parties’ submissions. 38. Regarding the absence of a formal contractual relationship between the Appellant and an individual named Vivian, the 1st Respondent argues that the Data Protection Act imposes a non-delegable duty on data controllers to ensure lawful processing of personal data, regardless of whether the processor is an employee, agent, or third-party representative. 39. Liability flows from statutory accountability, not contractual privity. 40. The 1st Respondent further asserts that the Commissioner did not rely solely on Vivian’s statement but on corroborated material, including records obtained during an on-site inspection. 41. The compensation award of KES 400,000 is described as lawful, proportionate, and within the Commissioner’s discretion under Section 65 of the Data Protection Act, intended to correct and deter breaches rather than to punish. 42. The 1st Respondent concluded that the Appellant’s grounds of appeal are without merit, that the determination was reasoned and fair, and that the appeal should be dismissed with costs. 43. Samuel Kamau Waweru, the Second Respondent, filed submissions opposing the appeal by Platinum Credit Limited against a ruling by the Data Protection Commissioner. 44. Samuel argued that the Commissioner’s decision was correct and based on strong evidence, particularly showing that Platinum Credit unlawfully used his personal data for commercial gain without his consent. 45. He points to evidence that a sales agent named Vivian Achieng, who was engaged by Platinum Credit, called him using personal data provided by her team leader, and that internal records like M-Pesa statements and WhatsApp messages confirmed the company’s involvement. 46. The agent even admitted that her management supplied the vehicle details in question. 47. Samuel maintains that Platinum Credit violated the Data Protection Act by failing to obtain his express consent for direct marketing. 48. He rejects the company’s claim that it was denied a fair hearing, arguing that the company initially filed a false denial about the agent’s employment, which forced the Data Protection Commissioner to investigate further. 49. According to Samuel, this conduct was a deliberate attempt to mislead the regulator. 50. He also defends the KES 400,000 compensation award, stating it reflects the distress and anxiety he suffered, including fear that his vehicle logbook could be used fraudulently to obtain a loan. 51. He argues the award serves a necessary deterrent purpose against large institutions that systematically breach data privacy laws. 52. He concludes that the appeal is an effort to avoid lawful consequences and asks the court to dismiss the appeal and uphold the Commissioner’s determination in full. 53. The issues for determination in this appeal are as follows; 54. ***Whether the Appellant’s right to a fair hearing and administrative justice was violated during the proceedings before the Data Protection Commissioner;*** 55. ***Whether the Data Protection Commissioner erred in finding the Appellant liable for the unauthorized processing of the 2nd Respondent’s personal data despite the disputed status of the sales agent; and*** 56. ***Whether the award of Ksh. 400,000 as compensation was justified, proportionate, and based on actual distress or loss.*** 57. In addressing the procedural concerns, the Court finds that the Right to a Fair Hearing under Article 50 of the Constitution and the right to Fair Administrative Action under Article 47 are not mere technicalities but the bedrock of Kenyan jurisprudence. 58. The Appellant contends that it was blindsided by the evidence of Vivian Achieng and denied the opportunity to rebut her claims. 59. While the Office of the Data Protection Commissioner (ODPC) argued that the Appellant had responded to the initial notification, the principles of natural justice require that where a regulator relies on new, prejudicial evidence discovered during an investigation, such as a specific witness testimony or site visit findings, the affected party must be given an opportunity to meet that specific case. 60. Administrative bodies must act fairly and afford parties an opportunity to be heard on all evidence that forms the basis of a prejudicial decision. 61. The failure to serve the Appellant with the additional evidence from Vivian Achieng or to allow a rejoinder on the site visit findings constitutes a procedural lapse that undermines the administrative process. 62. Regarding the substantive merits of data processing, the Data Protection Act, 2019, is clear that the burden of proof regarding consent lies with the data controller. 63. Section 32 of the Act mandates that a data controller must demonstrate that a data subject has consented to the processing of their personal data for a specified purpose. 64. The Appellant’s defence rested on the lack of a formal contract with the agent, Vivian. 65. However, Kenyan law is shifting toward the principle of "statutory accountability" for data controllers. 66. A data controller cannot escape liability for data breaches by simply pointing at third-party agents or employees when the breach occurs within the scope of the controller’s commercial interests. 67. If the ODPC established through corroborated evidence, including M-Pesa statements and internal WhatsApp records, that the agent was acting for the benefit of the Appellant, the lack of a formal employment contract does not absolve the Appellant of its duty to protect personal data under Section 25 of the Act. 68. On the issue of compensation, the Court observes that the ODPC awarded Ksh. 400,000. 69. Under Section 65(1) of the Data Protection Act, a person who suffers damage by reason of a contravention of the Act is entitled to compensation. 70. However, such awards must be compensatory rather than purely punitive. 71. The quantum of damages must be commensurate with the evidence of distress, loss, or injury presented. 72. In this case, while the 2nd Respondent expressed anxiety regarding the potential fraudulent use of his logbook details, the award of Ksh. 400,000 appears significantly high in the absence of evidence showing actual financial loss. 73. Ultimately, while the Court finds that the Appellant likely breached its data protection obligations through the actions of its agents, the procedural irregularities regarding the fair hearing and the lack of a proper investigation report as required by the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, cannot be ignored. 74. The Commissioner’s failure to allow the Appellant to cross-examine or rebut the key testimony of Vivian Achieng is a fatal blow to the determination. 75. Consequently, the Court finds that the appeal succeeds on the grounds of procedural unfairness. 76. The determination of the Data Protection Commissioner dated 24th February 2025 is hereby set aside. 77. Each party shall bear their own costs of this appeal. **Dated, Signed and Delivered online via Microsoft Teams at Nairobi this 25th day of May, 2026.** **………….…………….** 1. **N. ONGERI** **JUDGE** **In the presence of:** No appearance the Appellant Miss Kyumu holding brief for Mr Muchemi for the 1stRespondent Miss Nyabuto holding brief for Mr Kamau for the 2nd Respondent Ubah – Court Assistant