Background
- On 15th January 2025, the Office of the Data Protection Commissioner (ODPC) issued a determination against Ceres Tech Limited (the Appellant), finding that it had violated the personal data protection rights of Mr. Anthony Mwendwa Kinoti (the Complainant). The Data Commissioner ordered the Appellant to pay Kshs. 700,000 in compensation, issued an enforcement notice and recommended the prosecution of its director.
- The complaint arose from allegations that the Appellant, trading as Rocket Pesa, had unlawfully processed his personal data and demanded repayment of a loan which he had not applied for and had not received.
- On 3rd September 2024, the ODPC discontinued the original complaint after its investigations revealed no link between the telephone number allegedly used to contact the Complainant and the Appellant. The ODPC further established that the Appellant’s database contained no records relating to the Complainant or the alleged loan. It concluded that the matter concerned fraud, which fell outside its mandate, and advised the Complainant to pursue it through the Directorate of Criminal Investigations (DCI).
- On 18th October 2024, the Complainant reinstated the complaint under Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations, alleging that additional evidence established violations of his right to privacy.
- According to the ODPC, it notified the Appellant of the reinstated complaint through a letter dated 19th December 2024, in which it granted the Appellant 21 days to respond. Separately, on 18th December 2024, the ODPC had also obtained a search warrant to access and inspect the Appellant’s records and systems.
- The Appellant did not file a response. On 15th January 2025, the ODPC issued a determination finding violations of Sections 25, 26, 28, 29, 30 and 41 of the Data Protection Act, 2019. The determination included the following orders:
- Payment of Kshs 700,000 to the Complainant as compensation.
- Issuance of an enforcement notice against the Appellant.
- Recommendation for prosecution of the Appellant's director for obstruction and provision of false or misleading information to the Data Commissioner.
- Aggrieved by the determination, the Appellant appealed to the High Court, challenging the ODPC's jurisdiction, the fairness of its investigations, the application of the Data Protection Act and the compensation awarded.
Before The High Court:
The Appellant's Submissions
8. The Appellant submitted as follows:
- the ODPC lacked jurisdiction to determine the complaint, having previously discontinued it on the basis that it concerned fraud, which fell outside its statutory mandate.
- the ODPC failed to distinguish fraudulent impersonation by a third party from unlawful processing of personal data attributable to the Appellant.
- no evidence had been presented establishing that the Appellant unlawfully collected, processed or transmitted the Complainant’s personal data.
- the ODPC violated Article 47 of the Constitution by relying on unverified and selective evidence, disregarding material favourable to the Appellant and failing to observe the principles of fair administrative action.
- the award of Kshs. 700,000 was arbitrary and disproportionate, having been imposed without a proper assessment of liability, harm or mitigating circumstances.
9. The ODPC opposed the appeal and submitted as follows:
- Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations expressly permits the reinstatement of a complaint upon the provision of additional material.
- the Appellant had been duly notified of the reinstated complaint and granted sufficient time to respond but failed to do so.
- its investigations established violations of the Data Protection Act, including unlawful collection of personal data, inaccurate processing, failure to notify the Complainant and continued processing despite objection.
- the Appellant's conduct infringed the Complainant's constitutional right to privacy. 9.5. Section 65 of the Data Protection Act permits compensation for financial and non-financial harm, and the award of Kshs. 700,000 was reasonable and justified in the circumstances.
The High Court’s Decision
10. The High Court identified the following issues for determination:
- Whether the ODPC had jurisdiction to determine the complaint.
- Whether the ODPC violated Article 47 of the Constitution and the principles of fair administrative action.
- Whether the ODPC misapplied the Data Protection Act, 2019.
- Whether the penalty imposed was arbitrary and disproportionate.
The High Court’s Decision
11. On the first two issues, the Court held as follows:
- Regulation 7(3) of the Data Protection (Complaints Handling and Enforcement) Regulations permits the reinstatement of a complaint upon provision of additional material. However, reinstatement does not relieve the ODPC of its obligation to conduct meaningful, credible and fair investigations.
- The ODPC failed to establish that the Appellant had been served with the reinstated complaint and the letter requiring it to respond within 21 days. The absence of proof of service was a material defect that went to the root of the proceedings.
- The ODPC proceeded on the assumption that the Appellant had failed to respond to the complaint and relied on that assumption to make farreaching conclusions and impose liability and compensation against the Appellant.
- The Court also noted that the ODPC rendered its determination on 15th January 2025, which was less than one month after the alleged letter notifying the Appellant of the reinstated complaint. The period in question included the December holiday season when many institutions scale down or shut down their operations. In the circumstances, the Court found that the ODPC's process was rushed, opaque and did not meet the constitutional standard of fairness set out in Article 47 of the Constitution.
- The ODPC's findings were based on its investigation report dated 10th January 2025. This report was limited to screenshots of the Complainant’s text messages and a Paybill number that was allegedly registered under the Appellant's name. The Court held that this evidence, without more, could not form a proper basis for the farreaching findings made against the Appellant.
- The ODPC failed to establish a direct link between the Complainant, the alleged loan demands and the Appellant's systems or records. The Mpesa statement relied upon by the Complainant to advance his claim that his personal data was processed unlawfully was in the name of Kelvin Gatobu who was not the Complainant in the matter.
- The ODPC did not demonstrate that it conducted any meaningful investigations pursuant to the court order dated 18th December 2024 and did not demonstrate that it had considered any evidence of unlawful processing attributable to the Appellant as opposed to identity fraud by a third party.
- Although the Complainant alleged that DCI investigations supported his complaint, no DCI investigation report was presented before the ODPC to substantiate those allegations.
- The ODPC failed to address the Appellant's position that the incident arose from fraudulent impersonation by a third party. Respondent’s reliance on unverified evidence, without confronting exculpatory material, violated the principle of audi alteram partem. In Kenya Data Networks Ltd vs. Benson Kinyua [2013] eKLR, it was held that regulators must not only act fairly but must ensure that the facts underlying enforcement action are accurate and comprehensive. In the present case, it is apparent that the Respondent did not carry out any meaningful investigations but merely relied on the fact that the Appellant did not file a response to the 2nd complaint and went ahead to make the impugned determination.
12. On whether the Data Protection Act was misapplied
- The ODPC’s determination cited violations of Sections 25, 26, 28, 29, 30 and 41 of the Data Protection Act. For such findings to stand, there must be credible evidence showing that the Appellant collected, processed, disseminated or retained the Complainant’s personal data in a manner inconsistent with the Act.
- In the absence of verified evidence showing the link between the alleged communications, the alleged loan demand and the Appellant’s actual systems or records, the Court was not persuaded that the ODPC discharged the burden necessary to justify the findings made.
- Failure to respond to a complaint does not, by itself, constitute conclusive proof of wrongdoing. The ODPC remains obligated to investigate and establish alleged contraventions of the Data Protection Act through credible evidence.
- Consequently, the Court found that the ODPC had misapprehended the facts and misapplied the Data Protection Act in finding the Appellant liable.
13. On compensation and enforcement measures, the Court held as follows:
- While Section 65 of the Data Protection Act permits an award of compensation, such compensation must be supported by evidence, be rational and follow a fair process.
- The award of Kshs 700,000 was unsustainable because the ODPC's determination was based on an unfair process, lacked proof of service and relied on unverified evidence.
- The recommendation for prosecution and the enforcement notice were equally unsustainable, having been issued without adequate investigations.
- Consequently, the High Court allowed the appeal and set aside the ODPC's determination dated 15 January 2025 in its entirety, including the award of Kshs 700,000, the recommendation for prosecution and the enforcement notice.
- The Court remitted the matter to the ODPC for reconsideration and fresh determination in accordance with Article 47 of the Constitution, the Fair Administrative Action Act and the rules of natural justice, including proof of service and meaningful investigations.
