Platinum Credit Ltd v Ngolo & another (Civil Appeal E1295 of 2024) [2026] KEHC 12912 (KLR) (Civ) (18 August 2026) (Judgment)

**REPUBLIC OF KENYA** **IN THE HIGH COURT OF KENYA AT NAIROBI** **CIVIL APPELLATE DIVISION** **CIVIL APPEAL NO. E1295 OF 2024** **PLATINUM CREDIT LIMITED**………………………………**APPELLANT** **-VERSUS-** **DONALD MKALA NGOLO**……………………………………………………**1ST RESPONDENT** **THE OFFICE OF THE** **DATA PROTECTION COMMISSIONER**………..…**2ND RESPONDENT** *(Being an appeal from the Determination of the Office of the Data Protection Commissioner (Immaculate Kassait, MBS, Data Commissioner) delivered on 16th October 2024 and the Enforcement Notice issued pursuant thereto in ODPC Complaint No. 1090 of 2024)* **JUDGMENT** **A. Introduction** 1. This appeal arises from the determination of the Office of the Data Protection Commissioner (“the Data Commissioner”) delivered on 16th October 2024 in Complaint No. 1090 of 2024 between Donald Mkala Ngolo, the complainant before the Commissioner and the present 1st Respondent, and Platinum Credit Limited, the respondent before the Commissioner and the present Appellant. The Data Commissioner found that the Appellant had contravened various provisions of the Data Protection Act, No. 24 of 2019, by unlawfully processing the 1st Respondent’s personal data for commercial purposes without his consent, awarded the 1st Respondent compensation in the sum of Kshs. 1,000,000/=, and subsequently issued an Enforcement Notice directing the Appellant to implement corrective measures within the timelines stipulated therein. 2. Aggrieved by both the determination and the subsequent Enforcement Notice, the Appellant lodged the present appeal. Initially, the appeal challenged only the determination dated 16th October 2024. Following the issuance of the Enforcement Notice on 24th February 2025, the Appellant obtained leave to amend its Memorandum of Appeal and joined the Office of the Data Protection Commissioner as the 2nd Respondent so as to challenge both the substantive determination and the legality of the Enforcement Notice. 3. The appeal presents the Court with an opportunity to consider the extent of the statutory powers donated to the Data Commissioner under the Data Protection Act, the procedural safeguards applicable to investigations conducted by the Office of the Data Protection Commissioner, the obligations imposed upon data controllers regarding commercial processing of personal data, and the scope of appellate intervention where the exercise of statutory discretion by an independent administrative body is challenged. 4. Before delving into the merits, it is imperative to restate the duty of this Court sitting as a first appellate court. Although this appeal arises from a statutory administrative determination rather than a conventional civil trial, the Court is nonetheless required to subject the entire record to a fresh, independent and exhaustive evaluation before arriving at its own conclusions, while bearing in mind that it neither heard nor observed the parties during the proceedings before the Data Commissioner (*Selle v Associated Motor Boat Co. Ltd* [1968] EA 123). **B. Background** 1. The material facts are largely uncontested. On 19th July 2024, the 1st Respondent lodged a complaint before the Office of the Data Protection Commissioner, complaining that he had persistently received unsolicited telephone calls and promotional messages advertising the Appellant’s loan products despite never having been its customer and despite objecting to such communications. According to the complaint, the Appellant had unlawfully processed and used his personal data for commercial purposes without his knowledge or consent, contrary to the Data Protection Act. 2. Prior to lodging the complaint, the 1st Respondent had submitted to the Appellant a request for erasure of his personal data, contending that the Appellant had no lawful basis for retaining or utilising his information. It is common ground that the Appellant acknowledged receipt of that request. The 1st Respondent nevertheless maintained that, notwithstanding the erasure request, he continued receiving unsolicited promotional calls and messages from persons marketing the Appellant’s financial products. 3. Pursuant to its statutory mandate, the Data Commissioner notified the Appellant of the complaint and invited it to respond together with any relevant documentation. In response, the Appellant denied liability and maintained that the 1st Respondent had never been its customer, that his telephone number did not exist within its database, and that internal investigations revealed that one of the telephone numbers complained of belonged to an independent sales agent previously contracted by the Appellant whose contract had since been terminated, while the second number was not associated with any of its authorised agents and had been reported to the police. The Appellant further asserted that it had instituted contractual and training measures requiring its agents to comply with data protection obligations. 4. After considering the complaint, the Appellant’s responses and the material placed before it, the Data Commissioner rendered a determination on 16th October 2024 finding that the Appellant had processed the 1st Respondent’s personal data for commercial purposes without lawful consent, contrary to the Data Protection Act. The Commissioner directed the Appellant to compensate the 1st Respondent in the sum of Kshs. 1,000,000/= and to implement corrective measures aimed at ensuring future compliance with the Act. 5. On 24th February 2025, the Office of the Data Protection Commissioner issued an Enforcement Notice requiring the Appellant to implement the corrective measures identified in the determination within forty-five days. The Appellant protested that the Enforcement Notice had been issued notwithstanding subsisting stay orders granted by this Court pending the hearing and determination of the appeal, prompting the amendment of the Memorandum of Appeal to challenge not only the original determination but also the legality of the Enforcement Notice. **C. The Appeal** 1. The Appellant lodged the present appeal challenging both the determination delivered on 16th October 2024 and the subsequent Enforcement Notice. 2. Although the Amended Memorandum of Appeal sets out sixteen separate grounds, a careful and holistic reading reveals that the issues substantially converge into four central questions: (i) whether the proceedings before the Data Commissioner complied with the requirements of procedural fairness and natural justice; (ii) whether the Commissioner correctly found that the Appellant contravened the Data Protection Act; (iii) whether the award of Kshs. 1,000,000/= as compensation was properly made out on the evidence; and (iv) whether the Enforcement Notice issued on 24th February 2025 was lawful, given the subsisting stay orders. 3. Both Respondents oppose the appeal. The 1st Respondent contends that the proceedings before the Data Commissioner fully complied with the Constitution, the Fair Administrative Action Act, the Data Protection Act and the applicable Regulations; that the Appellant failed to demonstrate that it had obtained his consent before processing his personal data for marketing purposes; that the Commissioner properly exercised her statutory mandate; and that the award of compensation and issuance of the Enforcement Notice were lawful and proportionate. 4. The 2nd Respondent similarly supports the impugned determination and maintains that it acted strictly within the powers conferred upon it by the Data Protection Act in investigating the complaint, determining liability, awarding compensation and issuing the Enforcement Notice. 5. Directions were issued for disposal of the appeal by way of written submissions. The Court has carefully considered the Record of Appeal, the Supplementary Record of Appeal, the impugned determination, the Enforcement Notice, the rival submissions, and the authorities cited by the parties. **D. Parties’ Submissions** ***The Appellant’s submissions*** 1. The Appellant filed written submissions dated 29th October 2025 in support of the appeal, condensing the sixteen grounds into four broad issues: whether the proceedings before the Data Commissioner were procedurally fair; whether the Appellant was properly found liable for breach of the Data Protection Act; whether the compensation award was excessive; and whether the Enforcement Notice was unlawful. 2. On procedural fairness, counsel submitted that the decision-making process was fundamentally flawed and offended Articles 47 and 50 of the Constitution, the Fair Administrative Action Act, the Data Protection Act, and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations. It was argued that the process was tainted by bias, procedural impropriety and breach of natural justice. 3. The Appellant particularly faulted the Notification of Complaint dated 1st August 2024 for requiring it to disclose “mitigation measures adopted or being adopted”, arguing that this presupposed culpability before any investigation had been undertaken, demonstrating a predetermined mind. Reliance was placed on *Republic v Firearms Licensing Board & Another; Ex parte Jimi Wanjigi* [2019] KEHC 10916 (KLR), *Republic v Juma Ali Abdalla, Senior Principal Kadhi, Mombasa & Another; Shafi & 2 Others (Interested Parties); Mohamed & Another (Ex parte)* [2022] KEHC, and *Joseph Kaberia Kahinga & 11 Others v Attorney General* [2016] KEHC 3275 (KLR). 4. Counsel further submitted that the Commissioner failed to evaluate the Appellant’s documentary evidence, and that the determination was delivered merely two days after receipt of its final response, suggesting the decision had effectively been reached beforehand. 5. The Appellant also submitted that it was condemned unheard: no formal charges or Notice to Show Cause were issued, no witnesses were summoned, no oral representations permitted, and no hearing conducted, contrary to section 4 of the Fair Administrative Action Act and Regulations 11, 13 and 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations. 6. It was further argued that the statutory framework contemplates a formal investigation report preceding a determination, relying on *Premier Credit Limited v Kimaru* [2025] KEHC 9254 (KLR), and that the absence of such a report rendered the process fundamentally unfair. 7. The Appellant additionally contended that the Commissioner improperly consolidated the original complaint with subsequent communications dated 28th August 2024 and 24th September 2024 without inviting separate responses. 8. On the merits, the Appellant submitted that the 1st Respondent was never its customer and that his telephone number did not appear in its database; that investigations established the offending numbers belonged, respectively, to a terminated independent sales agent and an unauthorised third party reported to the police; and that section 42 of the Data Protection Act distinguishes the responsibilities of a data controller from those of a processor acting outside its lawful instructions — a distinction the Commissioner allegedly failed to apply. 9. On compensation, the Appellant submitted that Kshs. 1,000,000/= was excessive and unsupported by evidence, that the 1st Respondent neither pleaded nor proved actual loss, financial damage or emotional distress, and that the Commissioner provided no principled basis for the figure, effectively assessing damages arbitrarily. 10. On the Enforcement Notice, the Appellant submitted that it was issued after this Court had already granted stay orders pending appeal, and that its issuance during the subsistence of those orders rendered it unlawful, null and void. *The 1st Respondent’s submissions* 1. The 1st Respondent opposed the appeal through written submissions dated 13th November 2025, first drawing attention to what was described as repeated procedural delays occasioned by the Appellant, including delays in filing submissions, belated joinder of the 2nd Respondent, and amendment of the Memorandum of Appeal. 2. On the merits, counsel submitted that Regulation 11 merely required the Commissioner to notify the adverse party of the complaint and invite written representations, and that this was fully complied with through the Notification of Complaint dated 1st August 2024, to which the Appellant responded on two separate occasions. The request for mitigation measures was said to constitute a proper exercise of the Commissioner’s investigative powers under section 57 of the Act, relying on *Muthoni v Solpia Kenya Limited t/a Sista Kenya* [2025] KEHC 34 (KLR). 3. The 1st Respondent rejected the contention that a formal investigation report was mandatory, submitting that the determination itself contained a detailed consideration of the complaint, evidence and reasons, substantially fulfilling that purpose. The subsequent correspondence of 28th August and 24th September 2024 was said not to constitute separate complaints but part of the continuing infringement. 4. On liability, counsel submitted that the Commissioner correctly found the Appellant had processed the 1st Respondent’s data without consent contrary to section 37 of the Act, and that once the Appellant admitted the offending numbers belonged to its sales agents, it could not escape liability by characterising them as independent contractors, relying on *Mwambu v Twiga Foods Ltd* [2024] KEHC 10889 (KLR) and *Aventus Technology Limited v Ndambuki* [2025] KEHC 9218 (KLR). 5. On compensation, counsel submitted that section 65 of the Act empowers the Commissioner to award compensation for both pecuniary and non-pecuniary harm, and that repeated unsolicited communications combined with the Appellant’s failure to honour the erasure request occasioned distress, inconvenience and invasion of privacy warranting the award, relying on *Grain Industries Limited v Mbuvu & Another* [2024] KEHC 14003 (KLR), *Butt v Khan* [1978] KECA 24 (KLR), and *Kemfro Africa Ltd t/a Meru Express Services (1976) & Another v Lubia & Another (No. 2)* [1985] KECA 137 (KLR). 6. On the Enforcement Notice, counsel submitted that it was lawfully issued under sections 58, 63 and 65 of the Act, and that the 2nd Respondent had not been joined to the appeal nor notified of the stay orders before its issuance, such that the allegation of contempt was unsustainable. **E. Duty of the First Appellate Court** 1. This being a first appeal, this Court is obligated to reconsider and re-evaluate the entire record before the Office of the Data Protection Commissioner and arrive at its own independent conclusions, while bearing in mind that it neither saw nor heard the parties during those proceedings. Although the appeal emanates from an administrative determination rather than a conventional civil trial, the appellate obligation remains substantially the same: the Court must subject both the evidence and the legal conclusions reached by the Commissioner to fresh scrutiny. 2. The duty of a first appellate court has long been settled. In *Selle v Associated Motor Boat Co. Ltd* (supra), the former Court of Appeal for East Africa held that a first appellate court must reconsider the evidence, evaluate it afresh and draw its own conclusions, while making due allowance for the fact that it neither saw nor heard the witnesses testify. The Court of Appeal reiterated the same principle in *Peters v Sunday Post Ltd* [1958] EA 424, cautioning that this jurisdiction should nonetheless be exercised with caution, recognising that the primary decision-maker enjoyed the advantage of observing the parties directly. 3. This appeal is, however, distinguishable from the ordinary civil appeal in one important respect: the Court is called upon to review the exercise of statutory powers by an independent office established under the Data Protection Act. While the Court must undertake a fresh evaluation of the record, it must equally recognise that Parliament entrusted the Commissioner with specialised regulatory functions relating to the protection of personal data. 4. It follows that the Court does not intervene merely because it might have reached a different conclusion. Intervention is warranted where it is demonstrated that the Commissioner acted outside the law, misunderstood applicable legal principles, failed to comply with constitutional or statutory requirements, reached findings unsupported by the evidence, or exercised discretion upon wrong principles. Where the Commissioner acted within the bounds of the law and the findings are reasonably supported by the evidence, restraint is the appropriate posture — including, as elaborated further below, in relation to the quantum of any award made, which this Court reviews on its merits rather than merely for the presence or absence of an articulated formula. 5. Article 31 of the Constitution guarantees every person the right to privacy, including the right not to have information relating to their private affairs unnecessarily required or revealed. The Data Protection Act gives effect to that guarantee. At the same time, Article 47 guarantees every person the right to administrative action that is expeditious, efficient, lawful, reasonable and procedurally fair, and administrative bodies exercising statutory authority, including the Office of the Data Protection Commissioner, are constitutionally obligated to conduct their proceedings in accordance with natural justice and the Fair Administrative Action Act (*Judicial Service Commission v Mbalu Mutava & another* [2015] KECA 741 (KLR); *Suchan Investment Limited v Ministry of National Heritage and Culture & 3 others* [2021] KECA 160 (KLR)). 6. Accordingly, in determining this appeal, the Court must strike an appropriate balance between the constitutional obligation to safeguard privacy under Article 31 through effective enforcement of the Data Protection Act, and the equally important obligation to ensure that the exercise of statutory regulatory power conforms to Article 47, the Fair Administrative Action Act and the principles of natural justice. **F. Issues for Determination** 1. The issues substantially converge as follows: 2. ***Whether the proceedings before the Data Commissioner complied with the Constitution, the Fair Administrative Action Act and the Data Protection Act;*** 3. ***Whether the Commissioner predetermined the complaint;*** 4. ***Whether the Appellant was denied a fair hearing;*** 5. ***Whether the failure to prepare a separate investigation report invalidated the proceedings;*** 6. ***Whether the Commissioner improperly determined the subsequent complaints;*** 7. ***Whether the Commissioner correctly found that the Appellant violated the Data Protection Act;*** 8. ***Whether the independent sales agents’ conduct was attributable to the Appellant;*** 9. ***Whether the Commissioner acted within her statutory mandate;*** 10. ***Whether the compensation award was properly assessed and adequately reasoned; and*** 11. ***Whether the Enforcement Notice issued on 24th February 2025 was lawful, having regard to the subsisting stay orders***. ***Whether the Proceedings Before the Data Commissioner Complied with the Constitution, the Fair Administrative Action Act and the Data Protection Act*** ***The applicable legal framework*** 1. Article 47(1) guarantees every person the right to administrative action that is expeditious, efficient, lawful, reasonable and procedurally fair, while Article 47(2) requires written reasons where rights are likely to be adversely affected. Section 4(3) of the Fair Administrative Action Act obligates an administrator whose decision is likely adversely to affect a person’s rights to accord that person prior and adequate notice of the nature and reasons for the proposed action, an opportunity to be heard and to make representations, notice of the right to legal representation where applicable, notice of the right to cross-examine adverse witnesses where necessary, and information, materials and evidence to be relied upon. 2. These safeguards embody the common law principles of natural justice — *audi alteram partem* and the rule against bias — now of constitutional status through Article 47 (*Judicial Service Commission v Mbalu Mutava & Another*, supra). These principles equally inform the exercise of powers by the Office of the Data Protection Commissioner, whose functions, though specialised, remain administrative in nature. ***Whether the Commissioner predetermined the complaint*** 1. The Appellant submits that the request for “mitigation measures adopted or being adopted” in the Notification of Complaint demonstrates predetermination. I am not persuaded. Regulatory bodies routinely seek information on remedial measures during ongoing investigations, and section 57 of the Act empowers the Commissioner to require production of relevant information. Such a request is not, without more, inconsistent with the investigative mandate. 2. The applicable test for apparent bias is objective: whether a fair-minded and informed observer, having considered the facts, would conclude there was a real possibility of bias (*Porter v Magill* [2001] UKHL 67). Having reviewed the record, the Commissioner nevertheless invited a substantive response, the Appellant furnished detailed representations on two occasions, and those responses formed part of the record considered before determination. I am not persuaded that the wording of the notification letter, standing alone, establishes actual or apparent bias. ***Whether the Appellant was denied a fair hearing*** 1. The Appellant contends that no formal charges, Notice to Show Cause, oral hearing, witness examination, cross-examination, or investigation report preceded the determination. Neither the Constitution nor the Fair Administrative Action Act invariably requires every administrative process to culminate in an oral hearing; the content of procedural fairness is context-specific, depending on the statutory framework, the nature of the power exercised, and the consequences of the decision (*Communications Commission of Kenya & 5 others v Royal Media Services Ltd & 5 others* [2014] KESC 53 (KLR)). 2. The record demonstrates that the Appellant was notified of the complaint, informed of the allegations, invited to file written responses, and indeed filed detailed responses supported by documentary evidence on more than one occasion. I am unable to agree that the absence of an oral hearing or formal charges, without more, automatically rendered the proceedings unconstitutional. 3. That said, procedural fairness requires that responses receive genuine, impartial and meaningful consideration before an adverse determination is reached — a question addressed further below in assessing the substantive merits. ***Whether the failure to prepare a separate investigation report invalidated the proceedings*** 1. Regulation 13 envisages investigations preceding a determination, and Regulation 14 requires a determination upon their conclusion. Neither provision expressly requires a freestanding investigation report distinct from the determination itself. The evident statutory purpose — that the Commissioner gather sufficient information, evaluate the parties’ competing positions and reach an informed decision — is not necessarily defeated where investigative findings are incorporated into the determination rather than a separate document. I am not persuaded that the absence of a standalone report, without more, invalidates the proceedings. ***Whether the Commissioner improperly determined the subsequent complaints*** 1. The communications of 28th August and 24th September 2024 did not introduce a new or unrelated dispute but complained of continued unsolicited marketing allegedly occurring after the original complaint and erasure request. Administrative proceedings are not governed by the same procedural rigidity as civil litigation, and where subsequent communications merely supplement an existing complaint or demonstrate continuation of the same alleged infringement, the Commissioner cannot be faulted for considering them together, provided the affected party is afforded an opportunity to respond. The record shows the Appellant was notified and responded by letter dated 14th October 2024. I find no procedural impropriety on this ground. ***Conclusion on procedural fairness*** 1. I am satisfied that the Commissioner substantially complied with the procedural requirements of Article 47, the Fair Administrative Action Act and the Regulations. I am equally unpersuaded that formal charges, an oral hearing, cross-examination or a separate investigation report were invariably required in this matter. Procedural compliance does not, however, resolve whether the Commissioner reached the correct conclusion on the evidence — a distinct question to which I now turn. **H. Whether the Commissioner Correctly Found that the Appellant Violated the Data Protection Act** 1. Article 31(c) and (d) of the Constitution guarantees the right to privacy, including the right not to have information relating to private affairs unnecessarily required or revealed. The Data Protection Act operationalises that guarantee, and, consistently with Article 259(1), must be construed purposively so as to afford practical and effective protection to that right (*Communications Commission of Kenya & 5 Others v Royal Media Services Ltd & 5 Others*, supra). 2. Section 2 of the Act defines a data controller as a person who determines the purpose and means of processing personal data; “processing” is defined broadly to include obtaining, collecting, recording, using and disclosing personal data. Sections 25 and 26 impose mandatory obligations requiring every data controller to ensure personal data is processed lawfully, fairly and transparently, including in relation to direct marketing. 3. The Appellant’s principal submission — that it could not have violated the Act because the 1st Respondent was never its customer and his number did not exist in its database — proceeds from an erroneous premise. The Act protects all data subjects, not merely existing customers; personal data may be processed for solicitation or customer acquisition even absent an existing relationship. The absence of the 1st Respondent’s number from the Appellant’s customer records did not, without more, demonstrate that his data had not been processed. 4. The evidence before the Commissioner established that the 1st Respondent repeatedly received unsolicited promotional communications advertising the Appellant’s products, and the Appellant itself acknowledged that one of the offending numbers belonged to a person engaged as its independent sales agent — a relationship it subsequently terminated on account of the conduct complained of. Those admissions materially corroborated the complaint and entitled the Commissioner to find a nexus between the impugned communications and the Appellant’s commercial operations. 5. On attribution, the Appellant argues that liability rested exclusively with the independent sales agents, who acted contrary to their agency agreements. I do not accept this. The obligations under sections 25 and 26 are imposed directly on the data controller, who determines the purposes of processing and bears the corresponding responsibility of ensuring that processing undertaken in furtherance of its commercial enterprise complies with the law. That the Appellant’s agency agreements required agents to obtain express consent demonstrates the Appellant appreciated its statutory obligations; it does not absolve it where, notwithstanding those contractual safeguards, unlawful direct marketing occurs in furtherance of its business. Were the position otherwise, any data controller could outsource marketing to commission agents and disclaim responsibility whenever unlawful processing occurred — an interpretation that would undermine both the object of the legislation and the constitutional protection of privacy under Article 31. 6. The Commissioner received the complaint, notified the Appellant, considered its written responses on more than one occasion, analysed the documentary evidence, and rendered a reasoned determination. I am satisfied she acted squarely within the jurisdiction conferred by the Act, and that no error of law, misapprehension of evidence, or failure to consider relevant matters has been demonstrated on the question of liability. ***Whether the Compensation Award Was Properly Assessed and Adequately Reasoned*** 1. This ground requires more careful attention than it was given in the determination under appeal. Section 65 of the Data Protection Act empowers the Commissioner to award compensation for both pecuniary and non-pecuniary harm arising from unlawful processing. It is well established that this Court, exercising appellate jurisdiction over a discretionary award, will not interfere merely because it might have arrived at a different figure; interference is warranted only where the decision-maker applied a wrong principle of law, took into account irrelevant matters, omitted relevant matters, or arrived at a figure so inordinately high or low as to constitute an entirely erroneous estimate (*Butt v Khan* [1978] KECA 24 (KLR); *Kemfro Africa Ltd t/a Meru Express Services (1976) & Another v Lubia & Another (No. 2)* [1985] KECA 137 (KLR)). 2. That threshold, however, cannot be assessed in a vacuum. The Appellant’s complaint is not simply that the figure is high, but that no discernible basis for it appears in the determination — no distinction between pecuniary and non-pecuniary harm, no reference to the frequency or duration of the unwanted communications, no engagement with comparable awards, and no indication of how the figure was derived rather than merely asserted. Having examined the record, that complaint has substance. The determination records the finding of unlawful processing and proceeds directly to the figure of Kshs. 1,000,000/= without setting out the analytical steps connecting the nature and extent of the proven harm to the quantum awarded. 3. I do not consider this a case for wholesale interference with the finding that compensation was warranted; the record amply supports that the 1st Respondent suffered a proven, non-trivial infringement of his privacy rights — repeated unsolicited commercial communications persisting after an express request for erasure, over a period spanning several months and multiple documented complaints. That is precisely the kind of non-pecuniary harm — intrusion upon a data subject’s autonomy and peace, and disregard of a properly communicated erasure request — that section 65 is designed to vindicate, and no pecuniary loss need be separately pleaded or proved for such harm to sound in compensation. 4. What is required, and what the determination under appeal did not adequately supply, is a reasoned link between that established harm and the figure awarded. On my own independent assessment of the record — having regard to the duration and persistence of the infringement, the Appellant’s continued processing notwithstanding an acknowledged erasure request, the absence of any evidence of exceptional aggravating conduct such as harassment or threats, and awards made in comparable matters under the Act — I am satisfied that the sum of Kshs. 1,000,000/= falls within a range a reasonable decision-maker properly directing itself could have reached, and I decline to disturb it. I reach that conclusion, however, on the basis of this Court’s own re-evaluation of the record rather than by deference to a figure that was not itself adequately reasoned below. Regulators exercising compensatory powers under section 65 would be well served, in future determinations, by articulating the basis for quantum with the same rigour applied to the underlying liability finding, both to facilitate meaningful appellate review and to guard against the perception of arbitrariness the Appellant has, not without some justification, raised here. ***Whether the Enforcement Notice Issued on 24th February 2025 Was Lawful*** 1. This ground, too, warrants fuller treatment than a bare assertion that the question of contempt is not properly before this Court. 2. It is common ground that this Court had granted orders staying execution of the Commissioner’s determination pending the hearing and determination of the appeal, and that the Enforcement Notice was issued by the 2nd Respondent on 24th February 2025, after those orders were made. The 2nd Respondent’s answer is that it had not, at that time, been joined to the appeal or notified of the stay orders, such that no order of this Court bound it when the Notice issued. 3. Two distinct questions arise from this state of affairs, and they must not be conflated. The first is whether the 2nd Respondent’s conduct amounted to contempt of the stay orders — a question properly determined, if at all, in contempt proceedings brought for that purpose, with the procedural safeguards that attend such proceedings, including proof to the requisite standard that the 2nd Respondent had knowledge of the order said to have been disobeyed. I agree with the Respondents that such a finding cannot properly be made in the course of this appeal, and I decline to make one. 4. The second, and distinct, question is whether the Enforcement Notice is, independently of any question of contempt, a valid and subsisting administrative instrument capable of being given effect. On this question, the absence of proven knowledge on the part of the 2nd Respondent may excuse it from a finding of contempt, but it does not, without more, answer whether a notice issued to enforce a determination that was, at the time of issuance, the subject of a stay validly granted by a court of competent jurisdiction, can stand once that stay is drawn to the issuing authority’s attention. A stay order operates upon the determination itself, suspending its legal effect pending appeal; it is not obviously answered by the enforcing authority’s lack of prior notice, once that authority is subsequently made aware of it. 5. Having said that, this appeal itself now finally disposes of the underlying determination on its merits. In those circumstances, the more principled and proportionate course is not to strike down the Enforcement Notice as a nullity on account of a procedural irregularity in its timing relative to the stay — a course that would achieve nothing beyond requiring the 2nd Respondent to re-issue an identical notice now that the substantive determination has been upheld — but to record that the Notice’s effect was, and remains, contingent upon and coextensive with the outcome of this appeal. Having upheld the underlying determination, I find that the Enforcement Notice is validly given effect from the date of this judgment, without need to resolve, in these proceedings, whether its earlier issuance during the pendency of the stay was itself irregular. That question, if the Appellant wishes to pursue it independently of its effect on the substantive outcome, remains open to it by way of separate proceedings properly constituted for that purpose. **K. Disposition** 1. This Court has, as a first appellate court, reconsidered and re-evaluated the entire record of the proceedings before the Office of the Data Protection Commissioner, the impugned determination, the documentary evidence, the parties’ written submissions and the applicable law, bearing in mind the duty set out in *Selle v Associated Motor Boat Co. Ltd* (supra). 2. I am not persuaded that the Appellant has demonstrated any basis upon which this Court ought to interfere with the finding that it contravened sections 25 and 26 of the Data Protection Act. The Commissioner identified the issues for determination, considered the complaint, the Appellant’s responses, and the documentary evidence, before arriving at conclusions reasonably supported by the record. 3. On compensation, I have, for the reasons given in Part I above, independently satisfied myself that the sum awarded falls within a range properly open to the Commissioner, notwithstanding the inadequacy of the reasoning supplied in the determination itself for arriving at that figure. 4. On the Enforcement Notice, I have, for the reasons given in Part J above, declined to make any finding of contempt in these proceedings, and have found that the Notice is validly given effect from the date of this judgment, upholding the substantive determination it seeks to enforce. 5. Consequently, the Court makes the following orders: 6. ***The Appeal is dismissed in its entirety.*** 7. ***The Determination of the Office of the Data Protection Commissioner dated 16th October 2024 in ODPC Complaint No. 1090 of 2024 is upheld.*** 8. ***The Enforcement Notice issued pursuant to the said determination is upheld and shall take effect from the date of this judgment.*** 9. ***The Appellant shall bear the costs of this Appeal.*** 10. It is so ordered. **DATED, SIGNED AND DELIVERED AT NAIROBI THIS 18TH DAY OF AUGUST 2026.** **HON. L. P. KASSAN** **JUDGE**