Background:
In Jaggys (Kienyeji Chicken v Gichunge [2026] KEHC 6856 (KLR) the Respondent lodged a complaint with the Office of the Data Protection Commissioner, alleging that after purchasing chicken from the Appellant and paying via M-Pesa, the Appellant extracted his phone number from the payment details and used it to send unsolicited promotional and feedback messages without his consent.
The complaint specifically related to a marketing message allegedly sent to the Respondent promoting the Appellant’s chicken business and listing various branches and contact numbers.
In response, the Appellant contended that the communication was sent in good faith and formed part of after sale customer engagement and marketing. He further averred that the Respondent did not request to cease communication before lodging the complaint before the Data Commissioner.
The Data Commissioner found that the Appellant unlawfully processed the Respondent’s personal data contrary to the Constitution of Kenya, the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Consequently, the Commissioner awarded the Respondent damages of Kshs. 250,000 for unlawful use of his personal data for direct marketing purposes.
Aggrieved by the decision, the Appellant filed an appeal challenging both liability and award of damages. In the court of Appeal, the Appellant submitted that:
- The messages sent to the Respondent were customer engagement and after-sale service communications rather than unlawful marketing.
- Section 36 of the Data Protection Act together with Regulations 8(7), 15(1)(d) and 15(1)(e) of the Data Protection (General) Regulations, 2021 permitted direct marketing, where the data subject had not opted out yet a simplified opt-out mechanism existed.
- The Respondent never objected to the communications or requested cessation before approaching the ODPC and acted prematurely by not engaging the Appellant internally before lodging the complaint.
- Regulation 15(4) of the Regulations only contemplates a maximum penalty of Kshs. 20,000/= for breaches relating to marketing communications, making the award of Kshs. 250,000 excessive and unlawful.
- Sections 56 and 72 of the Act do not provide for compensatory remedies. Instead, section 56 establishes complaint procedures before the Commissioner while section 72 creates offences and criminal sanctions rather than civil compensation. Therefore, the Commissioner exceeded her statutory mandate by granting excessive compensation without proof of actual loss or damage. In addition, the Appellant argued that he is a small business entity and the award imposed a disproportionate burden upon him.
On its part, the Respondent opposed the appeal, arguing that:
- The Appellant extracted and repurposed his personal data without prior notice, lawful basis, or express consent contrary to the Data Protection Act.
- Sections 25, 28, 29, 30, 32, and 37 of the Data Protection Act require personal data to be processed lawfully, fairly, transparently, and strictly for the purpose for which it was collected.
- Consent under Section 2 of the Act must be express, unequivocal, informed, and freely given. Under Section 32(1), the burden of proving consent rests upon the data controller or processor and that the Appellant failed to discharge that burden.
- Regulation 15(1) sets out cumulative conditions for lawful direct marketing, namely; collection of data directly from the data subject, notification of the marketing purpose, consent, a simplified opt-out mechanism, and the absence of an opt-out request; the Appellant failed to satisfy these requirements.
- There is no legal requirement for a data subject to first object to a data controller before lodging a complaint with the ODPC.
- Section 56 of the Data Protection Act grants any aggrieved data subject the right to directly lodge a complaint with the Commissioner. On damages, the Respondent submitted that section 65 of the Act expressly allows compensation for both financial and non-financial loss, including emotional distress.
- The Respondent submitted that the award of Kshs. 250,000/= was modest, proportionate, and justified.
The High Court’s Determination
The High Court held as follows:
- Article 31 of the Constitution guarantees every person the right to privacy, including the right not to have information relating to their private affairs unnecessarily required or revealed.
- Section 25 of the Data Protection Act (the Act) obligates data controllers and processors to ensure that personal data is processed lawfully, fairly, and transparently
- Section 30(1) of the Act prohibits processing of personal data unless the data subject consents to the processing for one or more specified purposes or unless another lawful basis exists. Section 37 further prohibits use of personal data for commercial purposes unless express consent has been obtained.
- The evidence before the Commissioner demonstrated that the Respondent’s phone number was obtained from an M-Pesa transaction and subsequently used to send unsolicited promotional and feedback messages.
- The Appellant admitted using the Respondent’s phone number but did not demonstrate that express consent had been sought or obtained for direct marketing.
- The Respondent’s phone number had been obtained solely for the purposes of facilitating payment and not for commercial advertising or solicitation. Repurposing the data for marketing without consent amounted to further processing which was inconsistent with the original purpose of collection.
- the Appellant failed to demonstrate compliance with sections 28 and 29 regarding notice and disclosure of the intended purpose of processing. Accordingly, the court was satisfied that the Data Commissioner properly found that the Appellant unlawfully processed the Respondent’s personal data.
- Regulation 15(1) establishes cumulative conditions that must be satisfied before direct marketing may lawfully occur. Under the Regulation, once must prove that the data was collected directly from the data subject, the data subject was informed that direct marketing was an intended purpose, the data subject consented to such use, a simplified optout mechanism was provided, and the data subject had not opted out. No evidence was produced to show that the Respondent was informed that his data would be used for marketing, nor that consent was obtained, nor that an optout mechanism existed.
- The Appellant’s reliance on the Respondent’s failure to opt out cannot cure the initial absence of consent.
- Section 56(1) of the Data Protection Act expressly grants a data subject the right to lodge a complaint with the Data Commissioner upon infringement or potential infringement of rights. The Act imposes no requirement for prior notice, warning, objection, or internal complaint procedures before approaching the ODPC. Once the Respondent received unsolicited marketing communication without consent, the alleged violation had already crystallized and the Respondent was entitled to seek immediate redress before the Commissioner.
- The Data Commissioner had properly considered the Appellant’s response and had jurisdiction under Section 65 of the Act to award compensation for emotional distress, inconvenience and infringement of privacy rights. On the question of the legality, proportionality and justification of the award for compensation:
- The Appellant challenged the award terming it as excessive, punitive and unsupported by law, contending that Regulation 15(4) of the Data Protection (General) Regulations limits compensation to Kshs. 20,000/=.
- The Respondent, on the other hand, maintained that the award was compensatory and intended to vindicate the infringement of privacy rights, emotional distress, inconvenience and the unlawful use of personal data for direct marketing purposes.
- Section 65(1) of the Act expressly provides that a person who suffers damage arising from contravention of the Act is entitled to compensation. Further, Section 65(4) recognizes nonfinancial harm, including distress. Therefore, the Commissioner had jurisdiction to award compensation for emotional distress, inconvenience, and infringement of privacy rights.
- An appellate court is entitled to interfere with an award of damages where it is shown that the award was excessive, based on wrong principles, or disproportionate to the injury suffered.
- The unlawful conduct complained of involved the extraction and use of the Respondent’s mobile number obtained through an M-Pesa transaction for unsolicited marketing communication without consent.
- It was not established that the Respondent’s data was disseminated to third parties. No financial loss was demonstrated, and neither was it established that there was prolonged harassment or repeated systematic misuse beyond the impugned unsolicited messages. The breach, though unlawful, was limited in scope and nature as the matter involved a small-scale commercial transaction rather than large-scale exploitation of personal data.
- Privacy rights under Article 31 of the Constitution and the Data Protection Act are fundamental and deserving of protection. The misuse of personal data, without consent, undermines public confidence in digital transactions and must attract meaningful sanctions sufficient to deter similar conduct.
- Damages in data protection matters should be fair, moderate, proportionate, and reflective of the actual infringement proved. The transaction that the parties entered into was a purchase of chicken for the sum of Kshs. 2,800/=.
- The award of Kshs. 250,000/=, though lawful, was on the higher side more so considering the limited extent of the violation proved before the Commissioner.
- Consequently, the Court reduced the award of damages from Kshs 250,000 to Kshs. 50,000/= stating that the same would adequately compensate the Respondent for the infringement of his privacy rights, emotional distress, inconvenience, and unlawful processing of his personal data while at the same time serving the deterrent purpose contemplated under the Data Protection Act.
