Kenyan Court Questions Data Watchdog's Power to Award Damages

The High Court of Kenya has set aside a Sh1.25 million compensation order made by the Office of the Data Protection Commissioner (ODPC) against a Nairobi healthcare business. Justice Francis Andayi stated that while the Data Commissioner has the right to impose penalties and fines, and order rectification of breaches, there is no express power to award compensation to the aggrieved under the Data Protection Act.

The judgment comes after several multi-million-shilling awards made by the ODPC to individuals for breaches in handling personal data. The court noted that determining whether a person has suffered damage following a breach has not been expressly assigned to the Data Commissioner by the Act. The judge suggested that the issue needs to be considered further through a judicial review application or a constitutional petition on the validity of the regulations granting the Data Commissioner authority to issue compensation.

The Data Protection Act of 2019 sets out restrictions on handling personally identifiable data obtained by firms and government entities. Companies must comply with certain standards when handling personal data from clients, and some have been forced to compensate individuals for poor handling of personal data. For instance, Oppo Kenya was fined Sh5 million for unauthorized commercial use of a person's photograph, while Standard Investment Bank was ordered to pay Andrew Endovo Sh50,000 for sending an unsolicited promotional email.

The ODPC has made several compensation orders, including Sh2.6 million to Tech Limited, Sh900,000 to Philip Bolo from Platinum Credit Ltd, and Sh500,000 to Cyrus Mwaniki Ndung'u from Moja Expressway Company. However, the court has now raised questions about the regulator's power to make such awards. The judge noted that Section 65 of the Data Protection Act gives a person affected by breaches a right to compensation, but does not expressly give the Data Commissioner the power to determine that compensation.

Lawyers argued that while the Data Protection Act allows the regulator to investigate complaints and issue enforcement notices, it does not authorize the regulator to exercise the judicial function of assessing and awarding damages. The court noted that the Act expressly sets out the regulator's authority to issue enforcement and penalty notices but contains no equivalent express grant of power to award damages.

The judge reinforced his analysis by invoking a Court of Appeal decision on the limits of statutory bodies' jurisdiction, stating that an agency or tribunal may exercise only powers clearly given by law. The judge was also troubled by the procedure followed in this case, where the ODPC investigated the complaint and made a monetary award without first holding a hearing.

The judgment has significant implications for businesses facing compensation orders from the ODPC, and the court has suggested that the validity of the regulation should be fully tested through a constitutional petition or judicial review. The Attorney-General will have the opportunity to be heard on the matter. Until then, the court's doubts remain significant observations, not a declaration of invalidity.

Key points

• The Kenyan High Court has questioned the Office of the Data Protection Commissioner's power to award damages, giving businesses new grounds to challenge compensation orders.
• The court's decision has significant implications for companies handling personal data in Kenya.
• The validity of the regulation granting the Data Commissioner authority to issue compensation will be tested through a constitutional petition or judicial review.