1. Background
- 1. On 15th December 2023, the Office of the Data Protection Commissioner (ODPC) issued a determination in ODPC Complaint No. 1775 of 2023, where it found that Kenya Airways PLC (the Appellant) had infringed the right of the Complainant, Mr Jeremy Obano (the Respondent), to access his personal data. The Data Commissioner ordered the Appellant to facilitate access to the data and to pay the Respondent KShs 250,000 as compensation.
- 2. The Respondent contacted the Appellant by telephone on 10th June 2023, and the Appellant recorded the call. The Respondent later requested the voice recording, and the Appellant declined to give it to him. In its response to the complaint, the Appellant stated, among other things, that granting access to the recording was contrary to the health, safety and disability Act.
- 3. The ODPC found that a person’s voice recording constitutes personal data and that the Respondent’s right of access to his personal data had been violated. Consequently, the ODPC ordered the Appellant to facilitate access to the data and to pay the Respondent KShs 250,000 as compensation.
- 4. According to the Respondent, the dispute began when he asked Kenya Airways to arrange a wheelchair for his elderly mother at the airport. The airline did not provide the wheelchair, which prompted his call of 10 June 2023. He repeatedly asked for the recording of that call and was denied, prompting him to lodge a complaint with the ODPC.
- 5. The Appellant appealed against the ODPC’s orders on the following grounds:
- The Data Commissioner erred in law and in fact in finding that the Appellant had infringed the Respondent’s right of access to personal data.
- The Data Commissioner erred in law and in fact in rendering the impugned determination before the Appellant had exhausted its internal mechanisms for addressing the Respondent’s grievance, in completely disregard of Article 159 of the Constitution of Kenya and the doctrine of exhaustion of remedies.
- The Data Commissioner erred in law in awarding the Respondent compensation of KShs 250,000/- without any legal basis or justification.
2. Court of Appeal’s Determination
- 6. The High Court identified the following issues for determination:
- 6.1. whether the ODPC violated the principles of fair administrative action and the doctrine of exhaustion of remedies by determining the complaint while internal dispute resolution mechanisms were ongoing; and
- 6.2. whether the Respondent proved actual damage or distress under section 65 of the Data Protection Act to justify the award of compensation of KShs 250,000.
- 7. On the first issue, the Court held as follows:
- 7.1. Under Article 47 of the Constitution of Kenya and the Fair Administrative Action Act, the ODPC is bound by the principles of administrative justice to afford parties a fair hearing and engagement.
- 7.2. By rushing to a final determination upon receiving notice that internal resolution procedures were active and completely bypassing the statutory expectation to encourage alternative dispute resolution, the Data Commissioner acted prematurely and in breach of the doctrine of exhaustion of remedies.
- 7.3. Where a specific internal or statutory mechanism for dispute resolution is provided, that mechanism must be exhausted before external tribunals or courts step in to issue final determinations.
- 8. On the second issue the Court held as follows:
- 8.1. Section 65 of the Data Protection Act provides that an individual is entitled to compensation only when they have suffered actual damage or distress as a direct result of the statutory contravention.
- 8.2. In this instance, the respondent’s grievances focused heavily on unrelated operational service shortcomings, specifically the airline’s failure to provide a wheelchair.
- 8.3. A mere violation of a legal right does not automatically translate into financial compensation without strict evidentiary proof of loss or quantifiable distress directly tied to that breach.
- 8.3. The arbitrary award of Kes. 250,000/- lacked proper legal and evidentiary foundation.
- 9. The Court further recognised that recorded voice conversations containing personal identifiers constitute personal data under section 2 of the Data Protection Act. However, it held that statutory bodies must act within the constitutional boundaries of procedural fairness.
- 10. The Court also found that the ODPC had exceeded its mandate by essentially punishing the airline for bad customer service (the wheelchair issue), disguised as a data protection penalty.
- 11. Consequently, the Court set aside the determination of the ODPC delivered on 15 December 2023 in its entirety.
