[2025] KEHC 9254 (KLR)

Premier Credit Limited v Kimaru (Civil Appeal E045 of 2024) [2025] KEHC 9254 (KLR) (Civ) (30 June 2025) (Judgment)

Neutral citation: [2025] KEHC 9254 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Civil

Civil Appeal E045 of 2024

AN Ongeri, J

June 30, 2025

Between

Premier Credit Limited

Appellant

and

Maina Kimaru

Respondent

(Being an appeal from the Judgment of Immaculate Kasait (MBS/Data Commissioner) in ODPC Complaint No. 1764 of 2023 delivered on 15th December 2023)

Judgment

1. The ODPC made a determination on 15th December 2023 issuing an enforcement notice to the Appellant and an order for the Appellant to pay the complainant Kshs. 700,000/= for sending the complainant incessant promotional messages aiming at promoting the Appellant’s loan products.

2. The complainant’s evidence in brief was that he had been receiving incessant calls and messages from the Respondent trying to induce him to take up their products.

3. The complainant responded to the messages and stated that he is not interested in taking the said products.

4. The Appellant stated that the numbers used to contact the complainant belong to independent sales agents whose contacts had been subsequently terminated.

5. The ODPC found that the Appellant was liable for violation of the Respondent’s right to privacy and issued an Enforcement Notice to cease processing the Respondent’s personal data and also made an award of Kshs. 700,000/= in compensation to the complainant for distress caused by the incessant promotional messages.

6. The Appellant has appealed against the said decision on the following grounds:-i.The Learned Data Commissioner erred by failing to frame any charges or issue a Notice to Show Cause against, or grant the Appellant an opportunity to be heard before her Determination to issue an Enforcement Notice, and the Award and Quantum of Compensation to the Respondent in disregard of the Appellant’s right to be heard, Section 4 of the Fair Administrative Action Act 2015, and that no man should be a judge in his own cause.ii.The Learned Data Commissioner erred in law and fact by issuing the Determination contemporaneously with an Enforcement Notice dated 15th December 2023 in breach of Section 4 of the Fair Administrative Action Act 2015 thereby infringing on the Appellant’s right to challenge the decision in the Determination to issue the Enforcement Notice.iii.The Learned Data Commissioner erred in law and fact by making the Determination and Enforcement Notice without conducting a comprehensive investigation of or inquiry into the complaint and without involvement or fair hearing of either the Appellant or the Respondent, contrary to the rules of natural justice, the Data Protection Act 2019, and the Fair Administrative Action Act, 2015. iv.The Learned Data Commissioner erred in law and fact by failing to appreciate and properly exercise her dual investigative and enforcement mandate under the Data Protection Act, 2019 leading to bias against and depriving the Appellant of its constitutional and statutory rights to a fair hearing and fair administrative action.v.The Learned Data Commissioner erred in law and fact by failing to find that the Appellant did not process or control any data belonging to or identifying the Respondent.vi.The Learned Data Commissioner erred in law and fact in failing to find that the complainant did not sufficiently prove that he was the data subject or owner of the personal data (0704 393043) that was processed.vii.The Learned Data Commissioner erred in law and fact by failing to find that the promotional messages and replies thereto were between the Respondent and Peter Mwaniki (0769 966907), Kelvin Kinyua (0790 963790) and Eunice Wanjiru (0798 485713) who were independent contractors.viii.The Learned Data Commissioner erred in law and fact by misapprehending the independent sales agents contracts between the Appellant and its independent contractors and failing to find that the independent contractors had acted on their own, in breach of their contracts and outside the control of the Appellant.ix.The Learned Data Commissioner erred in law and fact by finding that the Appellant sent any promotional messages to the Respondent or received any reply thereof from the Respondent and that the Appellant ought to have provided an opt-out mechanism, when the Appellant had never processed or controlled any data belonging to or identifying the Respondent.x.The Learned Data Commissioner erred in law and fact by finding that the Appellant collected or processed any data related and owed any obligations to the Respondent under the Data Protection Act, 2019. xi.The Learned Data Commissioner erred in law and fact in finding that the Appellant was a repeat offender when she had cleared the Appellant upon compliance with an Enforcement Notice issued in ODPC Complaint No. 830 of 2023 Tom Ruto & Another =Versus= Premier Credit Limited.xii.The Learned Data Commissioner erred in law and fact by failing to join or give an opportunity to the Appellant to join Peter Mwaniki (0769 966907), Kelvin Kinyua (0790 963790) and Eunice Wanjiru (0798 485713) to the complaint before making the Determination and Enforcement notice contrary to the Data Protection Act, 2019 and the Fair Administrative Action Act, 2015. xiii.The Learned Data Commissioner erred in law and fact in awarding the Respondent a sum of Kenya Shillings Seven Hundred Thousand (Kshs. 700,000=) as compensation to the Claimant without any claim, justification, proof of damage by the complainant, reasoned assessment and in wrongful exercise of her discretion all of which were contrary to Section 65 of the Data Protection Act 2019 and Section 12 of the Fair Administrative Action Act, 2015. xiv.The Learned Data Commissioner erred in law and fact in disregarding rules governing computation of damages while assessing and awarding the impugned damages leading to unjust enrichment by the Respondent.xv.The Learned Data Commissioner erred in law and fact by ignoring the evidence by the Appellant and unquestioningly accepting the evidence and allegations of the Respondent in finding that he had proved his case against the Appellant.xvi.The Learned Data Commissioner erred in law and fact by wrongly evaluating the evidence on record failing to consider and/or disregarding the evidence and response by the Appellant and thereby arriving at the wrong conclusion on the Respondent’s complaint.

7. The parties filed written submissions as follows:-

8. The Appellant in his submissions challenged the Determination and Enforcement Notice issued by the Office of the Data Protection Commissioner (ODPC) on 15th December 2023, arguing that the process was procedurally and substantively flawed.

9. The Appellant contended that the Data Commissioner violated its constitutional and statutory rights by failing to adhere to fair administrative procedures and natural justice principles.

10. Procedurally, the Appellant argued that the ODPC acted illegally by shortening the response period from the statutory 21 days to 14 days, denying it a fair opportunity to respond.

11. That this irregularity, as highlighted in the case of Migguel Ventures Limited v ODPC, rendered the subsequent Determination and Enforcement Notice legally invalid.

12. Additionally, the Appellant asserted that the Data Commissioner prejudged its liability by demanding mitigation measures before any finding of wrongdoing, breaching the principles of audi alteram partem and fairness under Articles 47 and 50 of the Constitution.

13. That the failure to frame charges, issue a Notice to Show Cause, or allow the Appellant to defend itself further compounded the procedural unfairness.

14. The Data Commissioner also neglected to prepare an investigation report as required by law before issuing the Determination, making the process fundamentally flawed.

15. Substantively, the Appellant disputed the finding of liability, arguing that it neither controlled nor processed the Respondent’s data.

16. Further, that the messages in question were sent by third-party Independent Sales Agents (ISAs), whose actions were beyond the Appellant’s control.

17. The Appellant provided evidence that it had terminated the contracts of the implicated agents and had no record of the Respondent’s phone number in its database.

18. The Data Commissioner’s failure to investigate or join these third parties as respondents further undermined the fairness of the proceedings.

19. The Appellant also challenges the award of KShs. 700,000 in damages as arbitrary and unjustified.

20. The Appellant submitted that the Respondent provided no proof of distress or ownership of the phone number, and the compensation lacked any discernible basis in law or fact.

21. Citing cases such as Rose Mbula Ojuwang v Baraka Apparel EPZ and Caltex Oil v Rono Limited, the Appellant argued that damages cannot be awarded without proper pleading, proof, or assessment.

22. Further, that the Data Commissioner’s reference to the Appellant as a "repeat offender"—despite prior compliance with an earlier enforcement notice—further demonstrated bias and reliance on irrelevant considerations.

23. In conclusion, the Appellant urged the court to set aside the Determination and Enforcement Notice, emphasizing that the ODPC’s actions were procedurally irregular, substantively unjust, and in violation of constitutional safeguards.

24. The Appellant submitted that the complaint should be dismissed with costs, arguing that the entire process was tainted by illegality and unfairness.

25. The Respondent in their submissions opposed the appeal and urged this court to dismiss the Appellant's appeal, arguing that the Data Commissioner's determination and enforcement notice were lawful, procedurally sound, and aligned with the Data Protection Act.

26. The Respondent contended that the Appellant's 16 grounds of appeal are repetitive and lack focus, violating procedural rules as highlighted in precedent cases.

27. They emphasized that parties are bound by their pleadings and cannot introduce new evidence in submissions, citing judicial authorities to support this principle.

28. The Respondent defended the Data Commissioner's actions, asserting that the enforcement notice complied with Section 58 of the Data Protection Act, which permits such notices when a party fails to adhere to the law.

29. They rejected the Appellant's claim of a fair hearing violation, noting that the Appellant was given ample opportunity to respond during the investigation, including submitting evidence and rebuttals.

30. The Respondent underscored the Commissioner's expertise and independence, urging the Court not to interfere with her discretionary powers absent compelling justification.

31. On the merits, the Respondent argued that the Commissioner's determination was based on substantial evidence, including the Appellant's admission that its agents had contacted the Respondent and subsequent termination letters for those agents.

32. They maintained that the compensation award of Ksh. 700,000 was reasonable and reflective of the violation's gravity.

33. Ultimately, the Respondent asserted that the Appellant has failed to demonstrate any legal or factual basis to overturn the Commissioner's decision and prayed for the appeal's dismissal with costs.

34. This being an appeal from the ODPC, the parties have a right to appeal to the High Court against the determination.

35. The issues for determination in this appeal are as follows;i.Whether the Appellant was in breach of Article 31 (c) and (d) of the Constitution of Kenya and Section 25 of the Data Protection Act.ii.Whether the amount of Kshs. 700,000/= awarded is excessive.iii.Who bears the costs of this appeal.

36. This appeal arises from the Enforcement Notice and Determination issued by the Office of the Data Protection Commissioner (ODPC) on 15th December 2023, wherein the Appellant was found to have violated the Data Protection Act, 2019, ordered to cease processing the 2nd Respondent's personal data, and directed to pay compensation of Kshs. 700,000/- for alleged infringement of the 2nd Respondent's right to privacy.

37. I have carefully considered the proceedings before the ODPC, the grounds of appeal, the submissions and applicable law and I find that the ODPC's decision was fundamentally flawed due to fatal procedural irregularities that rendered the entire process unfair and unlawful.

38. Firstly, the Appellant was denied a fair hearing as it was never served with formal charges or a Notice to Show Cause prior to the adverse determination.

39. The statutory 21-day response period under the Data Protection Act was unilaterally shortened to 14 days without justification, contrary to the holding in Migguel Ventures Limited v ODPC [2023] eKLR, where the Court emphasized that statutory timelines cannot be arbitrarily altered.

40. This violated Article 47 of the Constitution and Section 4 of the Fair Administrative Action Act, which guarantee the right to fair administrative action.

41. Secondly, the ODPC predetermined the outcome by issuing the Enforcement Notice simultaneously with the Determination, thereby denying the Appellant any opportunity to challenge the findings before sanctions were imposed.

42. This amounted to the ODPC acting as a judge in its own cause, a principle condemned in the case of Republic v Public Procurement Administrative Review Board & Another Ex Parte Selex Sistemi Integrati [2018] eKLR, where the High Court held that procedural irregularities vitiate administrative decisions where they prejudice a party's right to be heard.

43. Thirdly, the ODPC failed to conduct a proper investigation as required under Section 50 of the Data Protection Act.

44. No investigation report was prepared and the Appellant's sales agents—who allegedly sent the messages—were neither summoned nor heard, and the ownership of the phone number claimed by the 2nd Respondent was never verified.

45. These omissions rendered the process fundamentally unfair and contrary to the rules of natural justice.

46. I find that the decision was made in breach of natural justice and the same is a nullity, as held in Pastoli v Kabale District Local Government Council [2008] 2 EA 300.

47. The ODPC's actions were ultra vires for failing to follow mandatory statutory procedures, as reiterated in Speaker of the National Assembly v Karume [2008] 1 KLR 425, where the Court of Appeal held that where the law prescribes the manner in which something is to be done, it must be done in that way or not at all.

48. The ODPC's failure to afford the Appellant a fair opportunity to defend itself also violated the principles laid down in R v Kenya Revenue Authority Ex Parte Aberdare Freight Services Ltd [2004] eKLR, where the Court quashed a decision for denying a party participation rights.

49. While the Appellant raised 16 substantive grounds of appeal, this matter can be disposed of purely on the basis of procedural unfairness, which is sufficient to invalidate the ODPC's decision.

50. For these reasons, the appeal is allowed.

51. The ODPC’s Enforcement Notice and Determination dated 15th December 2023 are hereby quashed, and the award of Kshs. 700,000/- is set aside.

52. Each party shall bear its own costs of this appeal.

DATED, SIGNED AND DELIVERED THIS 30TH DAY OF JUNE 2025 VIRTUALLY VIA MT AT VOI HIGH COURT.ASENATH ONGERIJUDGEIn the presence of:-Court Assistants: Maina/Millicent…………………………………………….for the Appellant…………………………………………….for the Respondent