High Court 11002 of 2025

mandated by a service agreement, constituted a continuation of the legitimate purpose for data processing, thereby legally precluding the data subject’s right to erasure until such time as the equipment is recovered or the proprietary interest is otherwise satisfied - whether the continued use of a data subject's contact information for account related or promotional communication, despite the data subject’s request to delete or anonymize the data, constituted an infringement of the Data Protection Act - whether the right to erasure and the withdrawal of consent under the Data Protection Act were absolute or conditional upon the formal termination of the underlying commercial contract - whether processing data during a period of contractual non-compliance by the data subject constituted an infringement of the Data Protection Act – Constitution of Kenya article 31; Data Protection Act (Cap 411C) sections 5, 25, 30, 32, 37, 39, 41, and 64. Law of Contract – termination – termination clause – where part of the clause had been fulfilled - whether the Data Commissioner had the jurisdiction to deem a contract terminated where only part of the requirements of the termination clause of the contract had been fulfilled. Civil Practice and Procedure – pleadings – presentation of facts – presentation of evidence – submissions - whether courts could consider new factual allegations and documents introduced by the parties in written submissions. Brief facts The dispute originated from a contractual relationship between the appellant (a service provider) and the 1st respondent (a customer), under which the appellant provided internet services and proprietary equipment, specifically a Zuku router, to the 1st respondent. The contract stipulated that the router remained the appellant's property and required its return upon account closure. On 3 October 2022, the 1st respondent sought to terminate the service; however, he failed to return the router or provide an address for its collection, despite the appellant’s requests. Consequently, the appellant maintained the 1st respondent’s data on its system to manage the unrecovered asset and sent promotional communications. On 10 October 2023, the 1st respondent filed a complaint with the Office of the Data Protection Commissioner (ODPC). The Commissioner found the appellant in breach of sections 25, 30, 32, 39, and 41 of the Data Protection Act, concluding that the contractual purpose for holding data had lapsed upon the notice of termination. The ODPC issued an enforcement notice and ordered the Appellant to pay Kes. 250,000 in damages. Aggrieved, the appellant moved to the High Court, arguing that the Data Commissioner erred by "e-writing the contract. They contended that the relationship had not legally terminated because the 1st respondent had not fulfilled the mandatory exit procedures (returning equipment). The appellant maintained that as long as their property remained at large, they held a legitimate interest in retaining the data to vindicate their proprietary rights, and that erasing it would lead to a legal absurdity. Issues i. Whether courts could consider new factual allegations and documents introduced by the parties in written submissions. ii. Whether the Data Commissioner had the jurisdiction to deem a contract terminated where only part of the requirements of the termination clause of the contract had been fulfilled. iii. Whether the failure of a data subject to return a data controller’s proprietary equipment, as mandated by a service agreement, constituted a continuation of the legitimate purpose for data processing under section 25(g) and 39 of the Data Protection Act, thereby legally precluding the data subject’s right to erasure until such time as the equipment is recovered or the proprietary interest is otherwise satisfied. iv. Whether the continued use of a data subject's contact information for account related or promotional communication, despite the data subject’s request to delete or anonymize the data, constituted an infringement of the Data Protection Act. v. Whether the right to erasure and the withdrawal of consent under the Data Protection Act were absolute or conditional upon the formal termination of the underlying commercial contract. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 2

page 2 of 12

vi. Whether processing data during a period of contractual non-compliance by the data subject constituted an infringement of the Data Protection Act. Held 1. Under section 64 of the Data Protection Act (DPA), a person against whom any administrative action was taken by the Data Commissioner, including in enforcement and penalty notices, could appeal to the High Court. As the first appellate court, the High Court was under a duty to re-evaluate and assess the evidence and make its own conclusions. 2. The Office of the Data Commissioner (2nd respondent) was a quasi-judicial decisionmaker. The 2nd respondent’s decision making was limited to powers within its remit. Matters concerning Kenya Information Communications Act were not matters for the Data Commissioner’s powers. 3. All proceedings that related to matters that were never brought to the attention of the Commissioner were irrelevant. The matters raised or introduced for the first time in submissions, including explanations that were not germane to the decision of the commissioner could not be relied on. Documents introduced via submissions were also irrelevant and inadmissible. The primary documents were in the record of appeal. Submissions could not take the place of evidence. Submissions were not, strictly speaking, part of the case, the absence of which may do no prejudice to a party. Submissions could not take the place of evidence. Courts ignored all facts introduced via submissions. 4. There was a contract between the parties. It could only be terminated via the agreement. Though, the 1st respondent initiated a process to end the relationship between the parties, they did not do so. They required to give notice to terminate within 30 days, and return the equipment. Neither had been done. 5. Courts or tribunals had no business re-writing contracts between parties. The court or the Data Commissioner could not terminate the contract between the parties. The Data Commissioner could not deem that the contract terminated. The Commissioner was thus wrong in finding that the contract was terminated by dint of the agreement. 6. The appellant entered into a contract for supply of services. The 1st respondent attempted to terminate the same. The appellant did not have issues with termination. They required of the respondent a simple act, to deliver the router and surrender equipment which remained the property of the Appellant, to enable them delete the data in their possession. The appellant gave even a sweetener, they were willing to collect the same provided the 1strespondent provided the address where the collection was to happen. The surrender of the gadgets did not happen. The appellant maintained that it could not delete data unless its equipment was returned. It was their case that terms and conditions of the contract were set out between them provided that the router remained the property of the appellant. 7. Even if, hypothetically, the data was deleted before the equipment was returned, in such a case, the appellant would not recover the gadgets, or protect their proprietary information. That possibility exposed the inherent unfairness and practical absurdity of the 2nd respondent’s position. The law, as a system of justice, must avoid interpretations that lead to absurdity or encourage impunity. It must instead promote outcomes that were just, reasonable, and proportionate. Statutes and contractual obligations must be construed purposively to give effect to their spirit and not to defeat their intention through technicality. if the contract was deemed to be terminated within 3 months, it would constitute the client as thieves upon expiry of three months. That was absurd and could not be the intention of the contract. 8. The purpose for which the data was required had not lapsed. So long as the appellant’s equipment remained out there, the appellant was entitled to keep data. Saying otherwise would lead to an absurdity, where the appellant’s property remained at large while the appellant had no way of contacting its customer or the other party to a contract. 9. Possession of the data during the term of the contract did not amount to infringement. Any suggestion to the contrary disregarded the commercial and legal framework within which the parties operated. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 3

page 3 of 12

The Commissioner’s conclusion was not only unsupported by evidence but bordered on legal misapprehension. 10. The Data Commissioner's failure to evaluate both the legal significance of the documents and the practical implications of the continued need for data undermined the integrity of her determination. Her conclusion could not be allowed to stand and was set aside. 11. There was no evidence tendered of misuse of the data. The fact that the appellant was not aware that she could be called over the account, did not discount the fact that the parties had given contacts for the business of that account only. Only matters of the account was discussed. There was no evidence tendered that the same was used to harass him. Appeal allowed. Orders i. Costs of Kes. 65,000/= payable within 30 days by the 1st respondent, in default execution to issue. ii. The decision of the Data Commissioner given on 7 January 2024 was set aside in its entirety. In lieu thereof, the complaint by the 1st respondent was dismissed. Citations Cases Kenya 1. Kipkoti & 2 others (Suing on their Own Behalf and as Officials and Representatives of Dik Dik Gardens Residents Association) v Deputy and Acting Governor of Nairobi City County Government & 3 others Constitutional Petition E202 of 2021; [2023] KEHC 22325 (KLR) - (Explained) 2. Moi v Muriithi & another Civil Appeal 240 of 2011; [2014] KECA 642 (KLR) - (Explained) 3. Molline Traders Ltd & another v Tourism Regulatory Authority & 3 others Constitutional Petition 120 of 2019; [2020] KEHC 10433 (KLR) - (Explained) 4. National Bank of Kenya Ltd v Pipeplastic Samkolit (K) Ltd & another Civil Appeal 95 of 1999; [2001] KECA 362 (KLR) - (Explained) 5. Ngang’a & another v Owiti & another Admiralty Claim 41 of 1993, [1994] KEHC 133 (KLR) (Explained) 6. Onditi v Kenya Commercial Finance Company Ltd Civil Appeal 329 of 2009; [2010] KECA 58 (KLR) - (Mentioned) 7. Rai & 3 others v Rai & 4 others Petition 4 of 2012; [2014] KESC 31 (KLR) - (Explained) India Renusagar Power Co Ltd v General Electric Company AIR 860, 1994 SCC SUPL (1) 644 - (Mentioned) Regional Court 1. Jiwanji v Jiwanji [1986] EA 547 - (Mentioned) 2. Mbogo and another v Shah [1968] EA 93 - (Explained) 3. Peters v Sunday Post Limited [1958] EA 424 - (Explained) 4. Selle and another v Associated Motor Board Company and others [1968] EA 123 - (Explained) Statutes Kenya 1. Constitution of Kenya article 31(c)(d) - (Interpreted) 2. Data Protection Act (Cap 411C) sections 5, 25(a); 30; 32; 37; 39; 41; 64 - (Interpreted) 3. Kenya Information and Communications Act (Cap 411A) In general - (Cited) Advocates Mr. Otieno for the appellant. Ms. Owino for the 1st respondent. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 4

page 4 of 12

JUDGMENT 1. This is an appeal from the decision of the Office of the Data Commissioner in ODPC No 1992 of 2023. The 1st respondent was a data owner while the appellant was a user. The 1st respondent complained to the 2nd respondent regarding his data at the appellant company. The data commissioner found the appellant in contravention of sections 25(a), 30, 32, 39 and 41 of the Data Protection Act. 2. The Data Commissioner proceeded to issue measures to remedy or eliminate the situation as follows: a. 3. The respondent ought to cease and desist calling and sending promotional messages and emails to the complainant and any other data subject that has stopped using its services failure to which administrative fines shall be issued against it. The data user was aggrieved by the decision of the data commissioner and filed a humongous memorandum of appeal dated on February 7, 2024. They set forth the following grounds. a. That the Data Commissioner erred in law and in fact in failing to appreciate the proper effect and purport of the evidence before it and in arriving at a determination, which is not supported by and/or is manifestly against the weight of evidence. b. That the Data Commissioner erred in law and in fact by disregarding the totality of the appellant’s response, submissions, and as a result, arrived a materially unsupported findings of fact and law. c. That the Data Commissioner erred in law and in fact by disregarding the fact that the appellant and the respondent are bound by a set of terms and conditions that spell out the rights and obligations of parties. d. That the Data Commissioner erred in law and in fact and misdirected herself by overlooking the respondent’s blatant refusal and unwillingness to either inform the appellant of the location for the collection of the Zuku router by the respondent or personally delivering the Zuku router thereby maintaining the contractual relationship between the appellant and the respondent. e. That the Data Commissioner erred in law and in fact and misdirected itself by relying on section 39 of the Data Protection Act No 24 of 2019 on retention of personal data by finding that the respondent ought to delate, erase, anonymise or pseudonymize the appellant’s personal data not necessary to be retained even though the contractual relationship between the appellant and the respondent was still in existence. f. That the Data Commissioner erred in law and in fact by failing to appreciate that the appellant was ready and willing to deal with the respondent’s data in the manner set out in section 41 of the Data Protection Act No 24 of 2019 upon compliance with the respondent’s terms and conditions by the appellant. g. That the Data Commissioner erred in law and in fact by failing to appreciate the law and did not address herself wholly on the issues raised in the appellant’s response. h. That the Data Commissioner erred in law and in fact by issuing an Enforcement Order dated January 17, 2024 compelling the appellant to pay the decretal sum which is baseless and unfounded. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 5

page 5 of 12

4. The Data Commissioner found the appellant liable and granted damages as follows: a. The respondent is hereby found liable for infringement of complainant’s rights and violation of its obligations under the Act; b. The respondent is hereby ordered to compensate the complainant Kshs 250,000 (Two hundred and fifty thousand only). c. An enforcement notice shall be issued against the respondent; and d. Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days. Submissions 5. The appellant filed submissions dated February 11, 2025. They submitted that the appellant’s strategy was to issue routers free of charge to customers for the duration of the contract as the routers are beyond reach of most people in the Kenyan market. It was not uncommon for people to go for extended periods without renewing subscriptions. The contract between the 1st respondent and appellant was in the same terms. 6. They submitted further that the 1st respondent sought to close the account on October 3, 2022, upon which the appellant requested for the return of the equipment to one of the offices or share where it can be recovered for complete closure of the account. The respondent had not returned the same or at least responded to the email. Instead they sought deletion of the information prior to return of the equipment. 7. They submitted that the complaint was registered with the second respondent on October 10, 2023 seeking several orders. The commissioner decided on January 7, 2023. They then stated that the twelve grounds are now 3 of them. They submitted that the contract was entirely based on an erroneous assumption that the contract had been terminated, and the 1st respondent was thus entitled to delete the data held. This was erroneously based on the right to terminate in clause 2.5 of the contract. They submitted that that right is only available at the option of the appellant and had not been exercised. Further, the other notice to terminate is at the instance of the customer at clause 2.4 by: 8. a. Issuing a 30 days termination notice b. By retuning the equipment Accordingly, they submitted that the 2nd respondent re-wrote the agreement between the parties by so holding that the contract was terminated. Reliance was placed on the case of National Bank of Kenya Ltd v Pipeplastic Samkolit (K) Ltd & another [2001] eKLR and Jiwanji v Jiwanji (1986) EA 547 (wrong citation). They also relied on the case of Richard Akwesera Onditi v Kenya Commercial Finance Company Limited [2010] eKLR where the court of appeal stated as follows: There were terms agreed between the parties in respect of the loan and, ordinarily, it is not in the province of the courts to re-write those terms for the parties, however onerous they may be to one of them. 9. They stated that the contract between the parties was not contested. Consequently, the appellant had a right to maintain data as long as the contract is subsisting. They submitted that it is against public policy for data subjects to demand erasure of data under a subsisting contract in a bid to evade compliance of https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 6

page 6 of 12

terms. Reliance was placed in the case by the supreme court of India in the case of Renusagar Power Co Ltd v General Electric Company (1994) AIR 860, 1994 SCC SUPL (1) 644. 10. The respondent filed submissions dated May 8, 2024. They are 144 paragraphs long. The first submissions are irrelevant as they are related to the Kenya Information Communications Act 1998, which is not subject to the data commissioner’s remit. Further submissions introduce evidence not before the commissioner. 11. The respondent submitted that he was not informed that the router was to be returned and they assumed it was paid for. The router was destroyed in January 2022. The court will not deal with new facts introduced via submissions. 12. They submitted that section 37 of the Data Protection Act prohibits use of personal data unless the person has an express consent from the data subject. They submitted that the appellant did not seek permission to send promotional messages. The respondent has no right to receive promotional data and the respondent has no right to send promotional data. 13. They posited that under section 5 of the Data Protection Act, he was entitled to protection. They submitted that no good reason was given for overturning the decision. They introduced documents via submissions which are not part of the record before the Commissioner. Analysis 14. The right of appeal is provided under section 64 of the Data Protection Act. The said section provides as follows:A person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court. 15. This being a first appeal, this court is under a duty to re-evaluate and assess the evidence and make its own conclusions. It must, however, keep at the back of its mind that a trial court, unlike the appellate court, had the advantage of observing the demeanour of the witnesses and hearing their evidence first hand. In the case of Mbogo and another v Shah [1968] EA 93 the court stated: “ …that this court will not interfere with the exercise of judicial discretion by an inferior court unless it is satisfied that its decision is clearly wrong, because it has misdirected itself or because it has acted on matters on which is should not have acted or because it failed to take into consideration matters which it should have taken into consideration and in doing so arrived at a wrong conclusion.” 16. The duty of the first appellate court was settled long ago by Clement De Lestang, VP, Duffus and Law JJA, in the locus classicus case of Selle and another v Associated Motor Board Company and Others [1968] EA 123, where the Judges in their usual gusto, held as follows: “ .. this court is not bound necessarily to accept the findings of fact by the court below. An appeal to this court ... is by way of re-trial and the Court of Appeal is not bound to follow the trial court’s finding of fact if it appears either that he failed to take account of particular circumstances or probabilities or if the impression of demeanour of a witness is inconsistent with the evidence generally.” 17. It must be remembered that the second respondent is a quasi-judicial decisionmaker. In that connection, their decision making is limited to powers within their remit. Therefore https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 7

page 7 of 12

matters concerning Kenya Information Communications Act 1998 are not matters for the Data Commissioner’s powers. 18. 19. The only issue in this matter is whether the commissioner erred in finding the appellant liable for breach of the various provisions of the Data Protection Act. This will be premised on two very specific aspects of the principles governing data processing under section 25 of the Data Protection Act, that is: a. Whether the appellant was entitled to have the data b. Whether the 1st respondent is entitled to have data deleted. Before dealing with the two questions, it is important to deal with what constitutes the appeal. All proceedings that relate to matters that were never brought to the attention of the Commissioner are irrelevant. The matters raised or introduced for the first time in submissions, including explanations that were not germane to the decision of the commissioner cannot be relied on. Documents introduced via submissions are also irrelevant and inadmissible. The primary documents are in the record of appeal. Submissions cannot take the place of evidence. Submissions are not, strictly speaking, part of the case, the absence of which may do no prejudice to a party. Their presence or absence does not in any way prejudice a case as held in Ngang’a & another v Owiti & Another [2008] 1KLR (EP) 749, where the court held that: “ As the practice has it and especially where counsel appears, a court may hear final submissions from them. This, strictly speaking, is not part of the case, the absence of which may do prejudice to a party. A final submission is a way by which counsel or sometimes (enlightened) parties themselves, crystallise the substance of the case, the evidence and the law relating to that case. It is, as it were, a way by which the court’s focus is sought to be concentrated on the main aspects of the case which affect its outcome. Final submissions are not evidence. Final submissions may be heard or even dispensed with. But the main basis of a decision in a case, we can say are: the claim properly laid, evidence fully presented and the law applicable.” 20. The Court of Appeal was more succinct in that submissions cannot take the place of evidence when they addressed the question in the case of Daniel Toroitich Arap Moi v Mwangi Stephen Muriithi & another [2014] eKLR: “ Submissions cannot take the place of evidence. The 1st respondent had failed to prove his claim by evidence. What appeared in submissions could not come to his aid. Such a course only militates against the law and we are unable to countenance it. Submissions are generally parties’ “marketing language”, each side endeavouring to convince the court that its case is the better one. Submissions, we reiterate, do not constitute evidence at all. Indeed there are many cases decided without hearing submissions but based only on evidence presented.” 21. The court shall therefore ignore facts introduced via submissions. In making the decision, the Data Commissioner’s duty is limited to establishing whether there was breach of data protection. In the case of Kipkoti & 2 others (suing on their own Behalf and as Officials and Representatives of Dik Dik Gardens Residents Association) v Deputy and Acting Governor of Nairobi City County Government & 3 others (Constitutional Petition E202 of 2021) [2023] KEHC 22325 (KLR) (Constitutional and Human Rights) (21 September 2023) (Judgment), A C Mrima posited as follows: Unlike the High Court, tribunals and other quasi-judicial bodies, including the Data Commissioner, had no power to make the law. They could, however, apply themselves https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 8

page 8 of 12

to a given set of facts and determine denial, violation, infringement or threat to a right or fundamental freedom in the Bill of Rights. Therefore, there was a defined distinction between determining the denial, violation, infringement or threat to the privacy rights in the Bill of Rights and interpreting the Constitution. Whereas the former was not exclusively a judicial function, the latter was. The jurisdiction, therefore, to interpret the Constitution was the exclusive duty reserved to the High Court vide article 165(3)(d) of the Constitution. The Data Commissioner had the jurisdiction to determine whether the petitioners’ privacy rights in the Bill of Rights were denied, violated, infringed or threatened. The Data Commissioner had further powers to order appropriate remedies in the event of proof of the infringement. The Data Protection Act, therefore, wholly provided for the dispute at hand as well as the remedies in the event the dispute was successful. 22. There was a contract between the parties. It could only be terminated vide clauses 2.5 and clause 2.4 of the agreement. Though, the 1st respondent initiated a process to end the relationship between the parties, they did not do so. They required to give notice to terminate within 30 days, and return the equipment. Neither has been done. It must be remembered that courts or tribunals have no business re-writing contracts between parties. The court or the Data Commissioner cannot terminate the contract between the parties. The Data Commissioner cannot deem that the contract terminated. The commissioner was thus wrong in finding that the contract was terminated by dint of clause 2.5 of the agreement. In the case of National Bank of Kenya Ltd v Pipeplastic Samkolit (K) Ltd & another [2001] eKLR the court held as follows: A court of law cannot re-write a contract between the parties. The parties are bound by the terms of their contract, unless coercion, fraud or undue influence are pleaded and proved. There was not the remotest suggestion of coercion, fraud or undue influence in regard to the terms of the charge. As was stated by Shah JA in the case of Fina Bank Limited v Spares & Industries Limited (Civil Appeal No 51 of 2000) (unreported): “It is clear beyond peradventure that save for those special cases where equity might be prepared to relieve a party from a bad bargain, it is ordinarily no part of equity’s function to allow a party to escape from a bad bargain. 23. The case for the parties were that the appellant entered into a contract for supply of services. The 1st respondent attempted to terminate the same. The appellant did not have issues with termination. They required of the respondent a simple act, to deliver the router and surrender equipment which remained the property of the appellant, to enable them delete the data in their possession. 24. The appellant gave even a sweetener, they were willing to collect the same provided the 1st respondent provided the address where the collection was to happen. The surrender of the gadgets did not happen. The appellant maintained that it cannot delete data unless its equipment is returned. It was their case that terms and conditions of the contract were set out between them provided that the router remained the property of the appellant. 25. Let us, for a moment, entertain the hypothetical scenario that the data was deleted before the equipment was returned. In such a case, how would the appellant recover the gadgets, or protect their proprietary information? This possibility exposes the inherent unfairness and practical absurdity of the 2nd respondent’s position. The law, as a system of justice, must avoid interpretations that lead to absurdity or encourage impunity. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 9

page 9 of 12

26. It must instead promote outcomes that are just, reasonable, and proportionate. As the courts have held time and again, statutes and contractual obligations must be construed purposively to give effect to their spirit and not to defeat their intention through technicality. Assume for all intents and purpose, that the contract is deemed to be terminated within 3 months, does it not constitute the client as thieves upon expiry of three months? This is absurd and cannot be the intention of the contract. 27. In this case, the purpose for which the data was required had not lapsed. So long as the appellant’s equipment remains out there, the appellant is entitled to keep data. Saying otherwise will lead to an absurdity, where the appellant’s property will remain at large while the appellant has no way of contacting its customer or the other party to a contract. In the case of Molline Traders Limited & another v Tourism Regulatory Authority & 4 others [2020] eKLR, JA Makau posited as follows in interpreting statutes. If the words of a statute are clear and unambiguous, the court need not look any further; constructions of statute is guarded by a number of principles including: a. Presumption against “absurdity” - meaning that a court should avoid a construction that produces an absurd result; b. The presumption against unworkable or impracticable result – meaning that a court should find against a construction which produces “unworkable or impracticable” result; c. Presumption against anomalous or illogical result, - meaning that a court should find against a construction that creates an “anomaly” or otherwise process an “irrational” or “illogical” result and; d. The presumption against artificial result – meaning that a court should find against a construction that produces “artificial” result and, lastly, e. The principle that the law should serve public interest – meaning that the court should strive to avoid adopting a construction which is in any way adverse to “public interest,” “economic”, “social” and “political” or “otherwise.” 28. The Data Protection Act No 24 of 2019 is an Act of Parliament to give effect to article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes. 29. Section 25 of the Act provides for principles of data protection as follows: Principles of data protection Every data controller or data processor shall ensure that personal data is a. Processed in accordance with the right to privacy of the data subject; b. Processed lawfully, fairly and in a transparent manner in relation to any data subject; c. Collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; d. Adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 10

page 10 of 12

e. Collected only where a valid explanation is provided whenever information relating to family or private affairs is required. f. Accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; g. Kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and h. Not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject 30. The Commissioner’s mandate was straightforward, that is to determine whether the appellant’s need for the data had lapsed. On the available record, she failed in that task. The evidence before her indicated unequivocally that the need had not lapsed. So long as the contract subsisted, the appellant retained both a legal duty to preserve the data and a legitimate interest in its continued possession. In fact, if the contract was terminated while the router remained unreturned, the Appellant would be entitled to use the information therein to vindicate its legal rights. It is unclear how the 1st respondent could be served or held accountable in proceedings without data in the appellant’s possession. 31. In that regard, I am satisfied that possession of the data during the term of the contract did not amount to infringement. Any suggestion to the contrary disregards the commercial and legal framework within which the parties operated. The Commissioner’s conclusion in this regard was not only unsupported by evidence but bordered on legal misapprehension. This court is mindful that it must exercise caution in disturbing the findings of the lower tribunal, particularly where they relate to demeanor and credibility of witnesses, who were seen and heard by the trial court. However, documentary evidence stands on a different footing. It speaks for itself. An appellate court is equally placed to interpret documents, and it is impermissible for parties to import extrinsic meanings or suppositions that are not borne out on the face of the record. Therefore the data Commissioner's failure to evaluate both the legal significance of the documents and the practical implications of the continued need for data undermined the integrity of her determination. Her conclusion cannot be allowed to stand and is therefore set aside. In the case of Peters v Sunday Post Limited [1958] EA 424, the court therein rendered itself as follows:“ It is a strong thing for an appellate court to differ from the findings on a question of fact, of the judge who had the advantage of seeing and hearing the witnesses…But the jurisdiction to review the evidence should be exercised with caution: it is not enough that the appellate court might have come to a different conclusion…” 32. The second question was whether, despite having the right to have the data, the appellant misused the same. There was no evidence tendered of misuse of the data. The fact that the appellant was not aware that she could be called over the account, did not discount the fact that the parties had given contacts for the business of that account only. The 1st respondent was clear that only matters of the account was discussed. There was no evidence tendered that the same was used to harass him. In fact he attempted to introduce evidence at submission level. Such evidence is otiose and has no bearing on the outcome of the appeal. 33. Thirdly, quantum of damages was not in issue. What was raised is that the claim was unfounded, which is already answered in affirmative. It is thus necessary to deal with the question of damages. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 11

page 11 of 12

34. In the circumstances, the appeal herein is allowed. The next question is costs. The Supreme Court set forth guiding principles applicable in the exercise of that discretion in the case of Jasbir Singh Rai & 3 others v Tarlochan Singh Rai & 4 others, SC Petition No 4 of 2012; [2014] eKLR, as follows: “ (18) It emerges that the award of costs would normally be guided by the principle that “costs follow the event”: the effect being that the party who calls forth the event by instituting suit, will bear the costs if the suit fails; but if this party shows legitimate occasion, by successful suit, then the defendant or respondent will bear the costs. However, the vital factor in setting the preference is the judiciously-exercised discretion of the court, accommodating the special circumstances of the case, while being guided by ends of justice. The claims of the public interest will be a relevant factor, in the exercise of such discretion, as will also be the motivations and conduct of the parties, before, during, and subsequent to the actual process of litigation…. Although there is eminent good sense in the basic rule of costs– that costs follow the event – it is not an invariable rule and, indeed, the ultimate factor on award or non-award of costs is the judicial discretion. It follows, therefore, that costs do not, in law, constitute an unchanging consequence of legal proceedings – a position well illustrated by the considered opinions of this court in other cases. 35. The appellant is a successful party. They are entitled to costs. The 2nd respondent was a decision maker and not a party. In the circumstances only the 1st respondent ought to pay costs. A sum of 65,000/ = will suffice. Determination 36. In the upshot, I make the following orders: a. The appeal is hereby allowed with costs of Ksh 65,000/= payable within 30 days by the 1st respondent, in default execution to issue. b. The decision of the Data Commissioner given on January 7, 2024 is set aside in its entirety. In lieu thereof, the complaint by the 1st respondent is dismissed. c. The file is closed. DELIVERED, DATED AND SIGNED AT NYERI ON THIS 24TH DAY OF JULY, 2025. JUDGMENT DELIVERED THROUGH MICROSOFT TEAMS ONLINE PLATFORM. KIZITO MAGARE JUDGE In the presence of: Mr. Otieno for the Appellant Ms. Owino for the 1st Respondent No appearance for the 2nd Respondent Court Assistant – Michael https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11002/eng@2025-07-24 12

page 12 of 12