Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Premier Credit Limited appealed an ODPC determination ordering KShs. 700,000 compensation for Maina Kimaru due to incessant promotional messages sent by the Appellant's independent sales agents. Kimaru argued the determination was lawful. The High Court allowed the appeal , finding the ODPC process fundamentally flawed due to fatal procedural irregularities, including failing to issue charges or grant a fair hearing. The award was subsequently set aside .

Facts

The original ODPC decision, delivered on 15th December 2023, found Premier Credit Limited (the Appellant) liable for violating the privacy rights of Maina Kimaru (the Respondent) and ordered the Appellant to pay Kshs. 700,000/= in compensation. The finding was based on the Appellant sending the complainant incessant promotional messages aimed at promoting its loan products.

In its appeal to the High Court, the Appellant vehemently disputed both the procedural fairness of the ODPC's decision and the substantive finding of liability.

The Appellant argued that it did not process or control any data belonging to or identifying the Respondent. The Appellant contended that the promotional messages were actually sent by third-party Independent Sales Agents (ISAs). It asserted that the numbers used to contact the Respondent belonged to these independent sales agents whose contacts had subsequently been terminated. Furthermore, the Appellant claimed that these independent contractors acted on their own, outside of the Appellant’s control and in breach of their contracts. The Appellant argued that the messages and replies were between the Respondent and specific independent contractors (Peter Mwaniki, Kelvin Kinyua, and Eunice Wanjiru). Additionally, the Appellant submitted that the Respondent failed to sufficiently prove that he was the data subject or the owner of the personal data (0704 393043) that was processed.

The Appellant raised several grounds regarding procedural flaws:

1. The Data Commissioner failed to frame charges, issue a Notice to Show Cause, or grant the Appellant an opportunity to be heard before issuing the Determination and Enforcement Notice.
2. The ODPC unilaterally and illegally shortened the response period from the statutory 21 days to 14 days, denying a fair opportunity to respond.
3. The Data Commissioner issued the Determination and the Enforcement Notice contemporaneously (on 15th December 2023), which breached the Appellant’s right to challenge the underlying decision before sanctions were imposed.
4. The ODPC failed to conduct a comprehensive investigation or inquiry and neglected to prepare an investigation report as required by law.
5. The ODPC erred by failing to join or give the Appellant an opportunity to join the independent contractors (Peter Mwaniki, Kelvin Kinyua, and Eunice Wanjiru) to the complaint.
6. The compensation award of Kshs. 700,000/= was challenged as arbitrary, lacking justification, proof of damage, or reasoned assessment, leading to potential unjust enrichment.