Vihiga College of Business & Technical Training v Data Commissioner (Civil Miscellaneous Application E017 of 2026) [2026] KEHC 8304 (KLR) (15 June 2026) (Ruling)

Vihiga College of Business & Technical Training v Data Commissioner (Civil Miscellaneous Application E017 of 2026) [2026] KEHC 8304 (KLR) (15 June 2026) (Ruling) Neutral citation: [2026] KEHC 8304 (KLR) Republic of Kenya In the High Court at Vihiga Civil Miscellaneous Application E017 of 2026 RN Nyakundi, J June 15, 2026 IN THE MATTER OF SECTION 64 OF THE DATA PROTECTION ACT NO.24 OF 2019 AND IN THE MATTER OF AN APPEAL AGAINST THE PENALTY NOTICE DATED 2ND MARCH 2026 Between Vihiga College of Business & Technical Training Appellant and The Data Commissioner Respondent Ruling 1.In its Notice of Motion application dated 14th April 2026 and filed on 15th April 2026, the Applicant herein sought for an order of stay of enforcement and/or execution of the Penalty Notice dated 2nd March 2026 issued by the Respondent pending the hearing and determination of this Appeal. 2.Alex Asiema, being the Principal of the Applicant swore an affidavit in support of the said application. 3.He averred that the Respondent issued a Penalty Notice imposing an administrative fine of Kshs 100,000/= against the Applicant for the alleged failure to comply with an Enforcement Notice dated 12th November 2025. He asserted that the institution had filed an Appeal challenging the legality, propriety and proportionality of the said Penalty Notice. 4.He explained that the Applicant was a small private educational institution operating within Vihiga County and relied primarily on student tuition fees as its sole source of income. He asserted that the institution had seventeen (17) students currently enrolled whose fee payments were structured in instalments across academic terms. 5.He pointed out that the institution had ongoing financial obligations including, staff salaries, rent and utilities, statutory deductions and academic materials and operational expense. He added that the institution operated on limited financial reserves and did not maintain surplus funds beyond operational requirements. 6.He contended that immediate payment of Kshs 100,000 would severely strain the institution’s finances and would disrupt salary payments to staff, interfere with ongoing academic programmes and negatively affect students who depended on the institution. 7.It was his contention that unless stay is granted, the Respondent may commence enforcement or recovery proceedings which would cause substantial and irreparable financial prejudice to the institution. He further added that the Applicant had since initiated steps towards compliance with the Data Protection Act, including beginning the process of registration as a Data Controller and/or Data Processor. 8.He was emphatic that the appeal lodged by the Applicant had raised arguable issues and this application had been brought without unreasonable delay. He added that the Applicant was willing to comply with any condition set by this court. 9.Oscar Onyango Otieno, the Respondent’s Senior Deputy Data Commissioner (Complaints, Investigations & Enforcement) swore a Replying Affidavit on 19th May 2026 in opposition of the said Applicant’s application. 10.He averred that the Office of the Data Protection Commissioner, was established in 2019 under Section 5 of the Data Protection Act, 2019 as the institutional framework for giving effect to the Right to Privacy as envisaged in Articles 31(c) and 31(d) of the Constitution of Kenya, 2010. In particular, the Office regulates the processing of personal data, the rights of data subjects and the obligations of data controllers and processors. 11.He was categorical that the Office was also empowered to oversee the implementation of the Act and to be responsible for its enforcement, including, amongst other things, establishing and maintaining a register of Data Controllers and Data Processors and issuing Enforcement Notices for explicit violations of the Act, under Sections 8 and 58 of the Act respectively. 12.It was his further contention that the above provisions are further elaborated by the attendant Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 which set out the complaint-handling process and other administrative measures the Office may take to ensure compliance with the Act. 13.He asserted that against the backdrop, the Office issued the 14.Enforcement Notice dated 12th November 2025 on 14th November 2025 requiring the Applicant, an educational institution, to apply to the Respondent for registration as a Data Controller and/or Data Processor in accordance with Sections 18 and 19 of the Act and Regulations 4, 5 and 13 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, within 30 days of service of the Enforcement Notice. 15.He argued that the Applicant neither complied with the said Enforcement Notice nor demonstrated the implementation of the measures required to remedy the situation envisaged in that Notice, resulting in the issuance of the Penalty Notice dated 2nd March 2026. 16.He asserted that an appeal against the Penalty Notice must be made to the High Court within thirty (30) days of the date of service and that the statutory window to challenge the Penalty Notice dated 2nd March 2026 had lapsed on 1st April 2026. He added that contrary to the grounds advanced by the Applicant, the Penalty Notice was issued under Sections 62 and 63 of the Act and Regulations 20 and 21 of the Enforcement Regulations. 17.He was emphatic that the application herein and the appeal were lodged outside the prescribed statutory time limits and that the Applicant neither sought and/or obtained leave from this court to file this application and appeal out of time. He asserted that the application as drafted and filed was misconceived, legally flawed and fatally defective. It urged this court to struck out the same with costs. Decision 18.Notably Section 5 of the Data Protection Act, Cap 411C (Laws o Kenya) establishes the Office of the Data Protection Commissioner. Section 18 of the Act provides for the registration of data controllers and data processors. The Respondent pointed out that the Penalty Notice was issued under Sections 62 and 63 of the Act. 19.Section 58(1) of the Act provides for Enforcement Notices asa.follows:-b.“Where the Data Commissioner is satisfied that a person has failed, or is failing, to comply with any provision of this Act, the Data Commissioner may serve an enforcement notice on that person requiring that person to take such steps and within such period as may be specified in the notice.” 20.Section 62(1) of the Act provides as follows:-a.“If the Data Commissioner is satisfied that a person has failed or is failing as described in Section 58 the Data Commissioner may issue a penalty notice requiring the person to pay to the Office of the Data Commissioner an amount specified in the notice.” 21.Section 64 further provides for the Right of Appeal. It stipulates as follows:-a.“A person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court.” 22.Further, Regulation 21 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 provides as follows:-a.“Subject to sections 58 (2) (d) and 64 of the Act, a person may before the lapse of thirty days from the date of service of the enforcement notice, appeal to the High Court against a decision arising out of the enforcement of the notice.” (Emphasis). 23.The moot question before this Court is whether in the facts and circumstances of the case one is justified to condone the delay in filing the proposed appeal as canvassed by the Applicant. The law of limitation if founded on public policy as expressly stated in the operative Act outlined above. It is enshrined in the legal maxim “interest reipublicae ut sit finis litium” i.e. it is for the general welfare that a period of limitation be put to litigation. The object is to put an end to have every legal remedy and to have a fixed period of life to every litigation as it is futile to keep any litigation or dispute pending indefinitely. Even public policy requires that there should be an end to the litigation otherwise it would be a dichotomy if the litigation is made immortal vis-à-vis the litigating parties i.e. human beings, who are mortals. 24.This is in so far as the ambit of the jurisprudential dicta in the realm of civil law is concerned but why do I refer to the metaphor of Siamese twins in both criminal and civil procedural law in so far as the factors of significance to persuade the court to extend time? Let us have a look at the guiding principles in the landmark decisions notoriously referred to in every litigation landscape on enlargement of time. This is to draw the differentia minimum and maximum as to the interlocking principles in the two branches of law. In the case of Nicholas Salat Vs IEBC & 7 Others the Supreme court made the following observations on the principles to be considered in determining an application on extension of time as follows:a.Extension of time is not a right of a party. It is an equitable remedy that is only available to a deserving party at the discretion of the Court;b.A party who seeks for extension of time has the burden of laying a basis to the satisfaction of the court;c.Whether the court should exercise the discretion to extend time, is a consideration to be made on a case to case basis;d.Whether there is a reasonable reason for the delay. The delay should be explained to the satisfaction of the Court;e.Whether there will be any prejudice suffered by the respondents if the extension is granted;f.Whether the application has been brought without undue delay; andg.Whether in certain cases, like election petitions, public interest should be a consideration for extending time.” 25.From the comparative jurisdiction in the case of LONG-JOHN & ORS V.BLAKK & ORS (1998) SC the apex Court held that; "There can be no doubt that for an application for an extension of time within which an appellant may file his brief of argument out of time or, indeed, for an extension of the time prescribed by the rules of Court for taking certain procedural steps, to succeed, the Applicant must establish good, substantial or exceptional reasons or circumstances to explain satisfactorily the delay in filing his brief or taking the steps in issue and thus justify the grant of the extension of time applied for, whatever decision a Court arrives at in such applications must entirely depend on the exercise of its discretionary jurisdiction, having regard to the general principles of law governing the exercise of discretionary powers by the Courts and guided by the consideration of doing justice to all the parties to the dispute". See also the case of Chief T.O.S. Benson V. Nigeria Agip Oil Co. Ltd. (1982) 5 SC 1. 26.In addition, the Court in Collector, Land Acquisition, Anatnag and Ors vs Katiji and Ors {1987) 2 SCC 107 approached this issue as follows:That the liberal approach in condoning the delay for “sufficient cause” held that ordinarily a litigant does not stand to benefit by lodging an appeal late; it is not necessary to explain every day’s delay in filing the appeal; and since sometimes refusal to condone delay may result in throwing out a meritorious matter, it is necessary in the interest of justice that cause of substantial justice should be allowed to prevail upon technical considerations and if the delay is not deliberate, it ought to be condoned. Notwithstanding the above, howsoever, liberal approach is adopted in condoning the delay but the applicant must show existence of sufficient cause for not filing the appeal in time for it is a condition precedent for exercising discretionary power to condone the delay. The phrases ‘liberal approach’, ‘justice-oriented approach’ and cause for advancement of the substantial justice cannot be employed to defeat the law of limitation so as to allow stale matters or as a matter of fact dead matters to be revived and re-opened by taking aid of Article 159(2)(d) of the Constitution 2010. (Underlined emphasis mine). 27.Having said so as the Penalty Notice was issued on 2nd March 2026, the time within which the Applicant would have appealed lapsed on 1st of April 2026. This court noted that the Applicant had filed his application as a miscellaneous cause without having filed an appeal. On perusal of the record of this file, it appeared that the Applicant filed his Memorandum of Appeal on 28th April 2026. 28.Indeed, the Applicant had filed the application and the appeal herein without the leave to file appeal out of time as required by law. In the premises, this court could not hear and determine his application as it was not proper before the court. The Court cannot grant an exemption from limitation on equitable consideration or on ground of hardship. There is no application for leave to extend time properly so filed by the Applicant and satisfactorily the memorandum of appeal is a nonstarter and this Court cannot condone the delay on sympathetic grounds alone. I have always been of the considered view that the discretion to extend time for one to file an appeal have to be exercised judiciously based upon the facts and circumstances of each case. The expression ‘sufficient cause’ usually borrowed from the Civil Procedure Act cannot be liberally interpreted if negligence, in action or lack of bonafide is writ large. It must also be observed that even though limitation of time may harshly affect the rights of the parties or specifically the intended Appellant it has to be applied with all its rigor as prescribed by Parliament under the Statute as the Courts have no discretion or choice but to apply the law as it stands and they have no power to condone the delay on equitable grounds. 29.In the premises, the Applicant’s Notice of Motion application dated 14th April 2026 and filed on 15th April 2026 be and is hereby struck out with costs to the Respondent. 30.Orders accordingly. DATED AND DELIVERED AT VIHIGA VIA CTS AND EMAIL THIS 15THDAY OF JUNE 2026 …………………………………….R. NYAKUNDIJUDGE