Premier Credit Ltd v Office of the Data Protection Commissioner & another (Civil Appeal E016 of 2025) [2026] KEHC 9467 (KLR) (23 June 2026) (Judgment)

**REPUBLIC OF KENYA** **IN THE HIGH COURT OF KENYA AT NAIROBI** **[MILIMANI LAW COURTS]** **THE CIVIL APPELLATE DIVISION** ***(Coram: A.C Mrima, J.)*** **CIVIL TRIBUNAL APPEAL.NO.E016 OF 2025** ***-between-*** **PREMIER CREDIT LIMITED ……………………………………….……APPELLANT** ***-versus-*** **1. OFFICE OF THE DATA PROTECTION COMMISSIONER** **2. SHARONE ACHIENG OTIENO…………………………........RESPONDENTS** ***(Being an appeal from the Determination of the Data Commissioner delivered on 2nd May,2025, in ODPC Complaint No.0243 of 2025)*** **JUDGMENT** **Introduction and Background:** 1. Many a times, people receive unsolicited marketing messages and despite opting out, such messages keep on intruding into their spaces. Such was the scenario that led to a complaint filed before the Data Protection Commissioner. 2. By a Complaint Submission Form dated 24th February 2025, *Sharone Achieng Otieno,* the 2nd Respondent herein**,** filed a complaint at the *Office of the Data Protection Commissioner,* ‘the 1st Respondent herein also referred to as ‘*the Commissioner’*, against *Premier Credit Limited,* the Appellant herein,for violation of the *Data Protection Act* (hereinafter referred to as **‘the Act’**) on grounds that the Appellant continuously sent her loan marketing texts despite formally requesting it to stop. 3. In its Response to the Complaint dated 14th April,2025, the Appellant denied ever having processed the 2nd Respondent’s data as alleged and noted that it did not even have any of her details in its data base. The Appellant, however, posited that they had separate and independent agreements with sales agents and that the Appellant is not responsible for any breach the agents may commit. The Appellant further confirmed that upon investigating the matter, it came to the fore that one of the independent sales agents had contacted the 2nd Respondent against the terms of the agreement and the company policy. The sales agent had since undergone internal disciplinary process. The Appellant posited that it was the independent agent who should be held solely liable for the complaint. 4. The Appellant reiterated its extensive compliance with the Act and the Regulations thereunder and affirmed that it always acted within the law. It prayed that the complaint be dismissed. 5. Through a determination dated 2nd May 2025, the Data Commissioner found merit in the complaint and held Appellant liable for failing to fulfil stop sending its marketing messages even after the Appellant formally protested. The Appellant was ordered to pay the 2nd Respondent Kshs. 650,000/= as compensation. 6. It was that determination that prompted the instant appeal. **The Appeal:** 1. Aggrieved by the said determination, the Appellant, through the Memorandum of Appeal dated 26th May 2025, preferred the following grounds: - 2. ***THAT*** *the Commissioner erred in law and fact in holding that the Appellant violated the 2 nd Respondent’s right to object under 26 (c) of the Data Protection Act and disregarded the Appellant’s response to the Complaint which categorically stated that the 2nd Respondent’s phone number and name did not exist in their data base and as such they had never processed her data.* 3. ***THAT*** *the Commissioner erred in law and fact in holding the Appellant liable yet the Office of the Data Protection Commissioner failed to properly investigate the complaint, particularly they failed to come and conduct a search at the Appellant’s office and data base to ascertain that the 2nd Respondent’s phone number and name did not exist in their data base and as such they had never processed her data.* 4. ***THAT*** *the Commissioner erred in law and fact in holding the Appellant liable for the violation done by the independent agents who breached the terms and conditions of their Independent Sales Agent agreements issued to them by the Appellant. The said agents processed the 2nd Respondent’s data without the Appellant’s express instructions to process data. By that action, they became data controllers on their own and they are to be held responsible for their actions and not the Appellant.* 5. ***THAT*** *the Commissioner erred in law and fact in failing to hold the Independent Sales Agent solely liable even after they confessed in writing to the 1st Respondent that they were responsible for the violated the 2nd Respondent’s data privacy. The Agents admitted to having been guided on how to market but instead acted on their own in reaching out to the Complaint.* 6. ***THAT*** *the Commissioner erred in law and fact in holding the Appellant liable and failing to consider the Appellant’s action of taking disciplinary measures against the Independent Sales Agents for breaching the Independent Sales Agent agreements and the Code of Conduct that they had with the Appellant which expressly directed them to only process data on behalf of the Appellant after receiving express instructions to process the same. In this case, there was no such instructions and hence the data was processed without the Appellant’s instructions in clear breach of the parties’ agreement.* 7. ***THAT*** *the Commissioner erred in law and fact in in holding the Appellant liable and failed to consider the mitigating factors that the Appellant put in place to ensure compliance. The Appellant conducts regular training for all their contacted Independent Sales Agents on data protection, the Appellant has implemented technical and organizational measures in line with the Data Protection Act and the Appellant documented their standard operation procedures on the conduct of contracted Independent Sales Agents.* 8. ***THAT*** *the Commissioner erred in law and fact in imposing a fine that is excessive and disproportionate with the alleged breach. The complainant did not suffer any harm as a result of her data being processed. The 2 nd Respondent did not produce any evidence demonstrating financial loss, reputational damage or emotional distress attributable to the alleged processing data to warrant the excessive fine.* 9. ***THAT*** *the Commissioner erred in law and fact in imposing an excessive fine that did not take into consideration the Appellant’s level of extensive compliance with data protection laws.* 10. It was upon these grounds that the Appellant urged this Court to set aside the determination by the Data Commissioner or, in the alternative, to review the compensation to Kshs. 20,000/=. 11. On the directions of this Court, the appeal was canvassed by way of written submissions. The parties duly filed their submissions whose contents will be ingrained in the next part of this judgment. **Analysis and Determination:** 1. The jurisdiction of the High Court to deal with appeals from the determinations of the Commissioner is pursuant to *Section 64* of the Act which accords any person against whom any administrative action is taken by the Commissioner to appeal to this Court. Therefore, the appellate jurisdiction of this Court is properly invoked. 2. As a first appeal on both points of law and facts, this Court’s role is well settled. The Court of Appeal in ***Susan Munyi -vs- Keshar Shiani*** [2013] KECA 472 (KLR) discussed its role as a first appellate Court as hereunder: - *…. As a first appellate Court our duty of course is to approach the whole of the evidence on record from a fresh perspective and with an open mind. We are to analyze, evaluate, assess, weigh, interrogate and scrutinize all of the evidence and arrive at our own independent conclusions.* 1. Similarly, in ***Abok James Odera t/a AJ Odera & Associates -vs- John Patrick Machira t/a Machira & Co Advocates [***2013] eKLR the Court set out the role of the first appellate Court in the following terms: - *…. This being a first appeal, we are reminded of our primary role as a first appellate court, namely, to re-evaluate, re-assess and re-analyse the extracts on the record and then determine whether the conclusions reached by the learned trial judge are to stand or not and give reasons either way. See the case of Kenya Ports Authority vs Kustron (Kenya) Limited 2000 2EA 212.* 1. On the basis of the foregoing legal guidance, this Court has carefully considered the record alongside the parties’ submissions and the respective decisions referred to therein, and cites the following two issues for determination: - 2. *Whether the Data Commissioner erred in holding the Appellant liable; and* 3. *Whether the award was excessive.* 4. This Court will now consider the above issues in *seriatim*. **[a] Whether the Appellant was liable:** 1. The Appellant submitted that the 1st Respondent failed to conduct an investigation at their offices to ascertain that the 2nd Respondent’s phone number was not in their data base. They relied on the case of ***Gichuhi and 2 others vs Data Protection Commissioner; Mathenge & Another (interested Parties)*** (Judicial Review E028 OF 2023) [2023] KEHC 17321 (KLR) to buttress that the 1st Respondent failed to properly investigate the complaint as contemplated under Section 56(5) of the Act. Further, it submitted that the 1st Respondent disregarded its response to the complaint despite evidence that the actions complained of were undertaken by independent agents who were solely liable for those actions and who were for that reason, subjected to disciplinary measures. Additionally, the Appellant faulted the 1st Respondent for failing to consider that it had put in place mitigating factors to ensure compliance with the Act. 2. The 1st Respondent did not agree with the Appellant’s submissions on this point. Through its written submissions dated 14th October 2025, the 1st Respondent asserted that its investigation was guided by the law upon receipt of the 2nd Respondent’s complaint. That, it conducted thorough investigations by according the Appellant an opportunity to respond to the complaint, which it did, prior to making its determination. The Commissioner further alluded to comprehensively going through the documentation tendered by the Appellant in determining the complaint pursuant *to Section 57* of the Act. 3. Relying on ***Muthoni V Solpia Kenya Limited t/a Sista Kenya*** [2025] KEHC 34 (KLR), the Commissioner reiterated that there was no one cut fit size or procedure of how investigations should be undertaken and that it has the discretion over such as long as it complies with the law. Additionally, it emphasized that the invitation to respond to the compliant, the response and the documents adduced thereof amounted to an investigation that guided it in making the determination. 4. The Commissioner affirmed that it considered the Appellant’s response to the complaint together with the measures put in place by the Appellant to ensure compliance with the Act in arriving at its decision. Further, the Commissioner reiterated that the Appellant’s assertion that its agents processed the 2nd Respondent’s data without express instructions was misleading as the principle of vicarious liability imputed the Appellant as their engagement was for the Appellant’s commercial benefit. The Commissioner argued that since the Appellant was a data controller and had delegated the processing functions to its sales agents, then it remained under the legal duty to ensure that any data processor they engaged provided sufficient guarantees of compliance. The 1st Respondent argued that the presence of a data processing agreement did not in itself absolve the Appellant as a data controller from any liability in the event their data processors engaged in unlawful data processing. 5. The 2nd Respondent on the other hand largely agreed with the 1st Respondent’s submissions. She relied on ***Solpia Case (supra)*** to underscore that a data controller cannot disclaim liability where a processor’s unlawful act arises within the scope of their assignment and further emphasized that a principal remains vicariously liable for the acts of its agents undertaken in furtherance of its business and as such, the Appellant cannot escape accountability by shifting blame to its agents while they continued to benefit commercially from their actions. 6. Going forward, two sub-issues emerge in this issue. They are *whether adequate investigations were undertaken* and the *liability, if any, of the Appellant’s sales agents*. For ease of discussion, this Court will discuss each of the sub-issues separately. *The adequacy of the investigations:* 1. ***Section 57*** of the Act provides for investigation of complaints as follows: - ***57. Investigation of complaints*** 1. *The Data Commissioner may, for the purpose of the investigation of a complaint, order any person to—* 2. *attend at a specified time and place for the purpose of being examined orally in relation to the complaint;* 3. *produce such book, document, record or article as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other enactment from disclosing; or* 4. *furnish a statement in writing made under oath or on affirmation setting out all information which may be required under the notice.* 5. *Where material to which an investigation relates consists of information stored in any mechanical or electronic device, the Data Commissioner may require the person named to produce or give access to it in a form in which it can be taken away and in which it is visible and legible.* 6. *A person who, without reasonable excuse, fails or refuses to comply with a notice, or who furnishes to the Data Commissioner any information which the person knows to be false or misleading, commits an offence.* 7. Additionally, ***Regulation 13*** *of The Data Protection (Complaints Handling Procedure and Enforcement) Regulations*[hereinafter referred to as ***‘the Regulations’***] provides thus: - **13. Investigations of a complaint:** 1. *In investigating a complaint, the Data Commissioner may, subject to section 57 of the Act—* 2. *issue summons in Form DPC 4 set out in the Schedule requiring the attendance of any person at a specified date, time and place for examination;* 3. *examine any person in relation to a complaint;* 4. *administer an oath or affirmation on any person during the proceedings;* 5. *require any person to produce any document or information from a person or institution; and* 6. *on obtaining warrants from the court, enter into any establishment or premises and conduct a search and may seize any material relevant to the investigation.* 7. *Upon completion of the investigation, the Data Commissioner shall prepare an investigation report.* 8. *In conducting investigations under this regulation, the Data Commissioner shall be guided by the provisions of the Fair Administrative Action Act (Cap. 7J).* 9. From the above provisions, it is apparent that there are several ways in which the Commissioner may conduct its investigations before making a determination. Therefore, the Commissioner has discretionary powers to decide on how to carry out investigations more so, depending on the nature of the matter at hand. There is, hence, no straight-jacket way in which investigations under the Act are to be carried out. To this Court, as long as the Commissioner abides by the Constituion and the law while discharging its investigative role, the Commissioner is good to go. 10. Since attending the Appellant’s premises to conduct a physical search on the infrastructure was among the various options on the Commissioner’s table while carrying out the investigations, this Court does not find any fault in the Commissioner not opting to take that step. The need to conduct a search may not arise if the required information is already otherwise availed. The complaint in this case was straight-forward. The 2nd Respondent protested the continued sending of marketing messages by the Appellant and its agents despite her objection. On its part, the Appellant filed a Response to the complaint and forwarded standard sales agreements with its agents alongside a detailed narration of its compliance with the Act including copies of the Appellant’s standard operating procedures. To the Commissioner, that information was sufficient to determine the complaint. Therefore, whether the Appellant had the 2nd Respondent’s data in its data base or whether the Appellant had earlier on processed a loan for the 2nd Respondent were not central issues in the investigations. This Court believes that it was on that score that the Commissioner opted not to conduct a search on the Appellant’s infrastructure. 11. While still on this sub-issue, suffice to note that when the Commissioner received the complaint, it notified the Appellant in writing *vide* its letter dated 24th March 2025 and, and as required under the Act, pointed out to the Appellant the various available options going forward, including alternative dispute resolution mechanisms. It was the Appellant who opted for a formal determination by the Commissioner. 12. Having said as much, this Court does not find any infraction of the Constitution, the Fair Administrative Actions Act or any other law in the manner in which the complaint was investigated. The Appellant was accorded sufficient opportunity to present its defence, and it did as much. 13. Lastly, from the record, there is undisputed evidence that the 2nd Respondent received the Appellant’s unsolicited marketing messages against her consent and even after formally protesting. Hence, the infraction on the 2nd Respondent’s right to object and privacy were proved. *The Sales Agents:* 1. As pointed out earlier, the Appellant took issue with the conduct of its agents whom it described as independent data processors. It produced its standard agreements it ordinarily entered into with such agents. In the midst of such a serious contention, the Appellant did not produce the specific agreements it entered with the subject agents. 2. This Court cannot, therefore, presume that the sample agreements on record were the actual ones executed between the Appellant and the agents. As the Appellant was well aware of the gravity of the position it took on the matter and decided to withhold such crucial evidence, this Court remains unable to ascertain the veracity of the Appellant’s contention, and the extent of liability on the agents, if any. As such, the only inference this Court can make is that the agreements may have been averse to the Appellant. 3. In sum, the Court finds that the sales agents were acting within their scope of delegated authority in marketing the Appellant’s products. In law, the Appellant remained vicariously liable for the actions of its agents. The Commissioner, therefore, and rightly so, found the Appellant liable for contravening the 2nd Respondent’s rights. **[b] Whether the award was excessive:** 1. The Appellant submitted that the award of Kshs. 650,000/= imposed by the 1st Respondent was excessive on grounds that it did not consider the Appellant’s level of extensive compliance with the Act and further that it was disproportionate with the alleged breach. 2. ***Section 65*** of the ***Act*** speaks to the aspect of compensation as follows: - ***65. Compensation to a data subject:*** *(1) A person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor.* *(2) Subject to subsection (1)—* 1. *a data controller involved in processing of personal data is liable for any damage caused by the processing; and* 2. *a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor—* 3. *has not complied with an obligation under the Act specifically directed at data processors; or,* 4. *has acted outside, or contrary to, the data controller's lawful instructions.* *(3) A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage.* 1. *In this section, "damage" includes financial loss and damage not involving financial loss, including distress.* 2. In determining the award of Kshs. 650,000/= as compensation, the 1st Respondent stated at paragraph 45 of the determination as follows: - *[45] In considering whether to issue compensation, this office takes into consideration the fact that the Complainant’s right to object processing under Section 26(c) of the Act was infringed upon by the Respondent and the use of the complainant’s data for commercial purposes.* 1. The award of compensatory damages is discretionary on the Commissioner. To that end, any interference with the award must fit within the strictures discussed in ***Kemfro Africa Ltd v A. M. Lubia & Another*** (1988)1 KAR 727 on appeals against assessment of damages. The Court expressed itself clearly thus: - ***The principles to be observed by an appellate court in deciding whether it is justified in disturbing the quantum of damages awarded by a trial Judge were held by the former Court of Appeal of Eastern Africa to be that it must be satisfied that either the Judge, in assessing the damages took into account an irrelevant factor, or left out of account a relevant one, or that; short of this, the amount is so inordinately low or so inordinately high that it must be a wholly erroneous estimate of the damage.*** 1. This position was later restated by the Court of Appeal in ***Arrow Car Limited -vs- Bimomo & 2 others*** (2004) 2 KLR 101 and also in ***Denshire Muteti Wambua -vs- Kenya Power & Lighting Co. Ltd*** (2013) eKLR. 2. There is no doubt that the impugned messages were meant for commercial purposes. They were invitations to the 2nd Respondent to take advantage of the Appellant’s products. The solicitation proceeded even after the 2nd Respondent formally protested and even wrote to the Appellant to cease sending them. Indeed, the 2nd Respondent must have been distressed by the Appellant’s conduct. 3. Bearing that in mind, and considering the prevailing economic trends and business performances in our country, slapping a start-up business like the Appellant with such an award, and in such circumstances, may be tantamount to forcing closure of the venture. Being a source of livelihood to its *inter alia* employees and agents, and remaining alive to instant business realties, this Court, with profound respect, finds the award of Kshs. 650,000/= to be excessive. A downward review of the award will still no doubt adequately compensate the 2nd Respondent as the Appellant must by now have learnt valuable lessons. To that end, the appeal partly succeeds. **Disposition:** 1. As I come to the end of this judgment, I wish to apologize to the parties for the late delivery of this decision. The delay was occasioned by my engagement at the Judicial Service Commission where I serve as a Commissioner given that the Commission has been running interviews since December 2025 to date. Once again, galore apologies. 2. In the end, the following final orders hereby issue: - **[a] The appeal partly succeeds only to the extent that the award of Kshs. 650,000/= is hereby reviewed to Kshs. 200,000/= [Read: Kenya Shillings Two Hundred Thousand Only].** **[b] For clarity, the rest of the determination by the Data Commissioner dated 2nd May 2025 is hereby affirmed.** **[c] Parties shall bear their respective costs of the appeal.** Orders accordingly. **DELIVERED, DATED** and **SIGNED** at **NAIROBI** this **23rd** day of **June** **2026.** **A.C. MRIMA** **JUDGE** **Judgment virtually delivered in the presence of:** **Miss Kogai,** LearnedCounsel for the Appellant. **Mr. Odhiambo,** Learned Counsel for the 1st Respondent. **Miss Nyambati,** Learned Counsel for the 2nd Respondent. **Michael/Amina** – Court Assistants.