1. Background
In Grace Ellah Indoshi & Felistus Khadi Mukami v Hellen Shikanda, Nation Media Group PLC & Board of Management, Sacred Heart Mukumu Girls’ School (ODPC Complaint No. 2118 of 2026), the Complainants lodged a complaint alleging the unlawful processing of a minor’s personal and sensitive personal data, the commercial use of personal data and the violation of the right to privacy.
In 2020, upon her admission to Form One, the 3rd Respondent collected the 1st Complainant’s photograph for school admission and administration purposes. However, in May 2023, the 3rd Respondent shared the photograph with the 1st Respondent, a health and science reporter, and the 2nd Respondent, Nation Media Group PLC, without the knowledge or consent of the 1st Complainant’s parent and legal guardian.
Upon discovering the error, the 1st and 2nd Respondents published a correction and public apology in the Sunday Nation edition of 28th May 2023. However, the apology disclosed that the 1st Complainant had received medical treatment in connection with the health crisis, thereby revealing information relating to her health status.
The 1st and 2nd Respondents subsequently published the photograph in the Saturday Nation edition of 27th May 2023 under the headline “Lost Souls”, in an article concerning a health crisis at the 3rd Respondent’s school that had resulted in student hospitalisations and deaths. The publication created the impression that the 1st Complainant was among the deceased students, whereas she had been discharged from hospital and was alive.
- 6. The High Court identified the following issues for determination:
- 6.1. whether the ODPC violated the principles of fair administrative action and the doctrine of exhaustion of remedies by determining the complaint while internal dispute resolution mechanisms were ongoing; and
- 6.2. whether the Respondent proved actual damage or distress under section 65 of the Data Protection Act to justify the award of compensation of KShs 250,000.
- 7. On the first issue, the Court held as follows:
- 7.1. Under Article 47 of the Constitution of Kenya and the Fair Administrative Action Act, the ODPC is bound by the principles of administrative justice to afford parties a fair hearing and engagement.
- 7.2. By rushing to a final determination upon receiving notice that internal resolution procedures were active and completely bypassing the statutory expectation to encourage alternative dispute resolution, the Data Commissioner acted prematurely and in breach of the doctrine of exhaustion of remedies.
- 7.3. Where a specific internal or statutory mechanism for dispute resolution is provided, that mechanism must be exhausted before external tribunals or courts step in to issue final determinations.
- 8. On the second issue the Court held as follows:
- 8.1. Section 65 of the Data Protection Act provides that an individual is entitled to compensation only when they have suffered actual damage or distress as a direct result of the statutory contravention.
- 8.2. In this instance, the respondent’s grievances focused heavily on unrelated operational service shortcomings, specifically the airline’s failure to provide a wheelchair.
- 8.3. A mere violation of a legal right does not automatically translate into financial compensation without strict evidentiary proof of loss or quantifiable distress directly tied to that breach.
- 8.3. The arbitrary award of Kes. 250,000/- lacked proper legal and evidentiary foundation.
- 9. The Court further recognised that recorded voice conversations containing personal identifiers constitute personal data under section 2 of the Data Protection Act. However, it held that statutory bodies must act within the constitutional boundaries of procedural fairness.
- 10. The Court also found that the ODPC had exceeded its mandate by essentially punishing the airline for bad customer service (the wheelchair issue), disguised as a data protection penalty.
- 11. Consequently, the Court set aside the determination of the ODPC delivered on 15 December 2023 in its entirety.
