The High Court Has No Power to Interfere with the ODPC’s Discretion in Awarding Damages Unless the Award Was Arrived at Injudiciously.
Background
Two recent High Court cases challenged the quantum of damages and penalties issued/levied by Office of the Data Protection Commissioner (ODPC):
- Muthoni v. Solpia – The appellant disputed an award of KES 500,000 for the unauthorised use of her image, claiming that the amount awarded was too low.
- Roma School Case – Roma School argued that a penalty of KES 4.55 million imposed by the ODPC was manifestly excessive.
Court Determinations
1. The Solpia case:
- The Appellant argued that the Kes. 500,000/- awarded by the Data Commissioner was inordinately low and lacked a clear jurisprudential basis. Conversely, the Respondent argued that the award was excessively high and maintained that the appellant’s appropriate remedy lay in the right of erasure, rather than monetary compensation. Both parties relied on earlier court decisions to support their arguments.
- The Court considered a comparable decision, Wanjiru v. Machakos University [2022] KEHC 10599 (KLR), where the petitioner discovered her photograph being used by the university in advertising and marketing its computer packages courses—both online and on its website—without her consent. In that case, the Court awarded Kes. 700,000/- in general damages for the unauthorized commercial use of her image.
- Guided by this precedent and the surrounding circumstances, the Court held that the Kes. 500,000/- awarded by the ODPC was adequate and appropriate compensation. The Court stated that assessment of damages is a discretionary exercise and may only be interfered with if it shown to have been arrived at injudiciously.
- The Court further recommended that the Data Protection Commissioner should provide clear reasons for any compensation amounts awarded. Doing so would help address potential grievances from litigants and assist courts when called upon to review such awards on appeal.
2. The Roma School Case
- In this case, the ODPC imposed a penalty of Kes. 4,550,000/- through a Penalty Notice dated 25th September 2023 for breaches of the Data Protection Act. The applicant challenged the notice and sought review of the penalty on the ground that it was manifestly excessive.
- The Court held that the quantum of the penalty set out in the Enforcement Notice was within the discretion of the Data Commissioner, and that the Court did not have jurisdiction to interfere with that determination
- The Court further cited Kenya National Examination Council v. Republic ex parte Geoffrey Gathenji Njoroge & 9 Others [1997] eKLR, where the grounds upon which an order of prohibition may issue were delineated:
“What does an order of prohibition do and when will it issue? It is an order from the High Court directed to an inferior tribunal or body, forbidding that tribunal or body from continuing proceedings in excess of its jurisdiction or in contravention of the laws of the land. It lies not only for excess of jurisdiction or absence of it but also for a departure from the rules of natural justice. It does not, however, lie to correct the course, practice, or procedure of an inferior tribunal, or to correct a wrong decision on the merits of the proceedings.” — Halsbury’s Laws of England, 4th Edition, Vol. 1, para. 128
