Justice Francis Andayi of the High Court set aside a KSh1.25 million compensation award that the Office of the Data Protection Commissioner (ODPC) had ordered a Nairobi healthcare business to pay.
The judge said his interpretation of the Data Protection Act and its regulations shows the Data Commissioner may impose penalties, fines and order rectification, but the law does not give the Commissioner authority to award compensation to aggrieved parties, adding that the issue should be considered further through an appropriate application because of its ramifications.
Andayi also expressed doubt that a hearing, if held, could be conducted by the same Data Commissioner who had investigated, prosecuted and decided the case, calling such a process contrary to the rules of natural justice.
The court indicated that the legal question must be addressed by a judicial review application or a constitutional petition challenging the validity of the regulations that permit the ODPC to issue compensation.
Kenya enacted the Data Protection Act in 2019, which restricts how personally identifiable data may be handled by firms and government entities. Since then, several companies have been ordered to pay damages, including Oppo Kenya (KSh5 million), Standard Investment Bank (KSh50,000 to Andrew Endovo), Tech Limited (KSh2.6 million), Platinum Credit Ltd (KSh900,000 to Philip Bolo), Moja Expressway Company (KSh500,000 to Cyrus Mwaniki Ndung’u) and a Nairobi healthcare provider in the present case.
The regulator’s Section 65 gives data subjects a right to compensation, but the judge observed that the Act does not expressly grant the Data Commissioner power to determine the amount of that compensation.
Lawyers for the ODPC argued that while the Act allows the regulator to investigate complaints, issue enforcement notices and impose administrative penalties, Regulation 14 empowers it to order one party to compensate another. The judge cited a Court of Appeal decision that a statutory body may only exercise powers clearly conferred by law.
The judge criticised the procedure followed, noting that the ODPC had made a monetary award without first holding a hearing where both sides could contest the evidence, raising concerns about fairness and the regulator assuming the roles of investigator, prosecutor and adjudicator.
The patient and the Data Commissioner maintained that Section 65 and Regulation 14 empower the watchdog to order compensation, relying on earlier High Court authority. The judge said those earlier decisions had not addressed whether the compensation provision in the regulations exceeds the authority of the Data Protection Act.
While the judge stopped short of striking down Regulation 14(3)(e), he said its validity should be fully tested through a constitutional petition or judicial review, with the Attorney-General allowed to be heard, and that an appeal was not the appropriate vehicle.
A previous High Court judgment upheld the ODPC’s power to investigate privacy violations without usurping the High Court’s jurisdiction, with Justice Bahati Mwamuye stating the court was not persuaded by arguments that the ODPC unlawfully usurped jurisdiction under Articles 23(1) and 165(3)(b).
In another case, a city lawyer’s challenge to the ODPC’s powers was dismissed on the basis that the regulator’s determinations are administrative remedies subject to judicial review, with Justice Mwamuye noting a clear distinction between the High Court’s adjudicative role and the ODPC’s administrative redress mechanisms.
The judge concluded that the ODPC does not usurp the High Court’s jurisdiction but provides a constitutionally permissible mechanism for realising the right to privacy under Article 31, subject to the supervisory jurisdiction of the High Court under Section 64 of the Data Protection Act.
