Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The court's analysis hinged on whether Eagleage Limited ta Oppo Aed Kenya had exhausted all available remedies before seeking judicial review and whether the Data Protection Commissioner had followed the correct procedures in issuing the penalty notice. The court determined that Eagleage Limited had not exhausted all remedies and had not sought exemption from doing so, thus making the application premature.

Facts

Eagleage Limited t/a Oppo Aed Kenya applied for judicial review of a decision by the Data Protection Commissioner.

Eagleage Limited, trading as Oppo Aed Kenya, sought judicial review of the Data Protection Commissioner's decision to impose a penalty of Kshs 5,000,000. The applicant contended that the penalty was imposed without notice, hearing, or any known form of engagement, making it arbitrary and in violation of legal guidelines.

<aside> ➡️

Link to the original decision | Chantal Marisa Fande & Anor vs. Credit Bank Ltd - ODPC Complaint No. 1050 of 2023

</aside>

Key points of the applicant's case included:

• Procedural Impropriety: The applicant argued that the Commissioner's decision was tainted with procedural impropriety, prejudice, and unfairness. They asserted that appropriate action had been taken to comply with demands dated 7th September 2022, and an enforcement notice dated 3rd November 2022.
• Lack of Investigation: The applicant claimed that no inspection, investigations, or hearings were carried out in accordance with the Data Protection Act. The accusations leading to the decision were not communicated clearly, and the applicant wasn't given an opportunity to be heard or offer mitigation.
• Compliance with Enforcement Notice: After receiving an enforcement notice dated 3rd November 2022, the applicant complied fully and prepared a data protection policy. Despite this compliance, they received a penalty notice dated 21st December 2022, without any prior notice or communication.
• Failure to Provide Clear Compliance Methods: The applicant argued they were not given a chance to be heard or informed how the Respondent expected compliance with the notice. The Respondent failed to provide clear methods to demonstrate compliance.
• Complaint Mutation: The applicant stated that the Respondent mutated the initial complaint into matters not covered by the original complaint filed by Andrew Obwangi regarding the use of his image on Instagram. The applicant had responded to the complaint, stating they did not share the complainant's image on their public social media.
• Violation of Statutory Provisions: The applicant contended that the Respondent ignored the statutory provisions of Section 62 of the Data Protection Act when determining whether to issue a penalty notice and its amount. They argued that imposing the maximum penalty was arbitrary and punitive, without following due process as required by Section 63 of the Act.