Tom Joseph Ogao v Safaricom Limited

5. I would also be inclined to agree with the defendant that allegations of fraud require to be proved to a standard higher that balance of probability although not quite to the standard of beyond any reasonable doubt as is the case with criminal matters. 6. In the circumstances, I would make a finding that the plaintiff has failed to prove his case to the required standard and accordingly dismiss the suit with costs to the defendant. 7. Being aggrieved by the determination of the trial Magistrate the Appellant filed the appeal herein vide Ammended Memorandum of Appeal dated 21st November 2023. The appeal was canvassed by way of written submissions. The Appellant in his submissions dated 11th April 2025 framed the following issues for determination:Whether a relationship existed between the parties from which a duty of care and/or a legitimate expectation could arise;Whether there was a breach of such duty of care;What orders, if any, ought to issue; andWhether he was entitled to an award of general damages. 8. The Appellant in his submissions stated that the Respondent was the custodian of all data provided by its consumers and it is a mode of operation that before the registration of any sim card, one must provide original identification documents which are then verified before a picture of the person seeking line registration is then taken. It was submitted that the purpose of the procedure is to help curb fraud and identity theft. That following this procedure a relationship is then developed between the Respondent and the customer and a trust ensues and that it is the duty of the Respondent to protect the data provided to it by its subscribers as provided under the Safaricom Data Privacy Statement which spells out the role of the Respondent in collection of private date, how the data is to be used and to whom it may be released. That at clause 4.4 it particularly states, "We shall not release any information to any individual or entity that is acting beyond its legal mandate." 9. The Appellant submitted that the relationship created between the Respondent and a subscriber develops a legitimate expectation particularly in dealing with subscriber's data. 10. The Appellant drew the court’s attention to W. R. Wade & C. F. Forsyth on the subject of legitimate expectation, at pages 449 to 450, where he wrote : “ It is not enough that an expectation should exist; it must in addition be legitimate....First of all, for an expectation to be legitimate it must be founded upon a promise or practice by the public authority that is said to be bound to fulfil the expectation..... Second, clear statutory words, of course, override an expectation howsoever founded..... Third, the notification of a relevant change of policy destroys any expectation founded upon the earlier policy.... " "An expectation whose fulfillment requires that a decision-maker should make an unlawful decision, cannot be a legitimate expectation. It is inherent in many of the decisions, and express in several, that the expectation must be within the powers of the decision-maker before any question of protection arises. There are good reasons why this should be so: an official cannot be allowed in effect to rewrite Acts of Parliament by making promises of unlawful conduct or adopting an unlawful practice. " (Emphasis added) 11. The Appellant also relied on the case of Republic v Principal Secretary, Ministry of Transport, Housing and Urban Development Ex parte Soweto Residents Forum CBO 120191 eKLR, the court elaborated the legal scope of legitimate expectation as follows; “ A procedural legitimate expectation rests on the presumption that a public authority will follow a certain procedure in advance of a decision being taken. In adjudicating legitimate expectation claims the court follows a two-step approach. Firstly, it asks whether the https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 2

page 2 of 9

administrator's actions created a reasonable expectation in the mind of the aggrieved party. If the answer to this question is affirmative, the second question is whether that expectation is legitimate. If the answer to the second question is equally affirmative, then the court will hold the administrator to the representation, that is enforce the legitimate expectation. The first step in the analysis has both an objective and a subjective dimension. It is firstly asked whether a reasonable expectation of a certain outcome was created. The representation itself must be precise and specific and importantly, lawful. Once a reasonable expectation exists the administrator is required to act in accordance with that expectation, except if there are public interest considerations which outweighs the individual 's expectation.” 12. 13. It was further submitted and reliance placed on the South African case In National Director of Public Prosecutions v Philips where it was held that the requirements for the existence of legitimate expectation in law include:i. that there must be a representation which is "clear, unambiguous and devoid of relevant qualification ", ii. (ii) that the expectation must be reasonable in the sense that a reasonable person would act upon it, iii. (iii) that the expectation must have been induced by the decision-maker and iv. that it must have been lawful for the decision-maker to make such representation. If such an expectation exists it will be incumbent on the administrator to respect it and afford the individual holding that expectation due procedure before the expectation is disappointed. Failing such procedure, the individual may approach a court to review the administrator's actions on the ground of procedural unfairness. If the court finds that a legitimate expectation did in fact exist, it will ordinarily invalidate the administrative action and refer the matter back to the decision-maker to deal with it in a procedurally fair manner. The Appellant also cited the case of Pastoli v Kabale District Local Government Council & Others in which it was held that “ Procedural impropriety is when there is failure to act fairly on the part of the decisionmaking authority in the process of taking the decision. The unfairness may be in nonobservance of the Rules of Natural Justice or to act with procedural fairness towards one to be affected by the decision. It may also involve failure to adhere and observe procedural rules expressly laid down in a statute or legislative instrument by which such authority exercises jurisdiction to make a decision. 14. It was further submitted that the relationship between the Appellant and the Respondent was a fiduciary relationship to the extent of keeping of records and financial transactions as defined in Black's Law Dictionary, 11th edition, as: “ a duty of utmost good faith, trust, confidence, and candor owed by a fiduciary (such as an agent or a trustee) to the beneficiary (such as the agent 's principal or the beneficiaries of the trust; ... a duty to act with the highest degree of honesty and loyalty toward another person and in the best interest of the other person ..Also termed as duty of loyalty, duty of fidelity; duty of faithful service; duty to avoid conflict of interest”. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 3

page 3 of 9

15. The Appellant also relied on the American decision in Wolf v. Superior Court (2003) 107 Cal.App.4th 25, 29 [130Cal.Rptr.2d 8601 a fiduciary relationship was defined as . “ Any relation existing between parties to a transaction wherein one of the parties is in duty bound to act with the utmost good faith for the benefit of the other party. Such a relation ordinarily arises where a confidence is reposed by one person in the integrity of another, and in such a relation the party in whom the confidence is reposed, if he voluntarily accepts or assumes to accept the confidence, can take no advantage from his acts relating to the interest of the other party without the latter 's knowledge or consent” 16. It was argued that the Respondent having been entrusted with personal data and financial records of the Appellant was expected to carry out instructions from the Appellant in extreme confidence and in utmost good faith. 17. On Whether there was a breach of such duty of care the Appellant submitted that right to privacy as envisaged under Article 31 of the Constitution can be subject to limitation under Article 24 and that in this case it was limited without due legal process. 18. While relying on Articles 28 and 31 of the constitution and the cases of Okiya Omtata Okoiti vs Communication Authority of Kenya & 8 others 120181 eKLR (ii) Petition No. 361 of 2016 — Rashanara Ebrahim v Ashleys Kenya Ltd & 3 others the Appellant argued that the rights to privacy and dignity, as enshrined in the constitution are sacred and registration of sim cards using data kept by the Respondent without his consent and being blocked to access services as a result of the said actions and/ or inaction by the Respondent was a breach of duty on the part of the Respondent that should be compensated by an award of general damages. 19. The Respondents in opposing the appeal argued that the fundamental principle that guided the trial court in rendering its judgment was the legal proposition set out by the High Court in Alice Wanjiru Ruhiu v Messiac Assembly of Yahweh [2021] eKLR. Where it cited Halsbury’s Laws of England, 4th Edition, Volume 17, at paragraphs 13 and 14, as follows: “ The legal burden is the burden of proof which remains constant throughout a trial; it is the burden of establishing the facts and contentions which will support a party’s case. If at the conclusion of the trial he has failed to establish these to the appropriate standard, he will lose. The legal burden of proof normally rests upon the party desiring the court to take action; thus a claimant must satisfy the court or tribunal that the conditions which entitle him to an award have been satisfied. In respect of a particular allegation, the burden lies upon the party for whom substantiation of that particular allegation is an essential of his case…” 20. 21. The Respondent identified and submitted 3 key issues, which according to them formed the crux of the dispute as framed in the Amended Plaint: a. Registration of the SIM card. b. Whether there was negligence in registering the SIM card. c. Whether there was breach of data privacy following registration. The Respondent submitted that the Appellant had conveniently shifted the focus of the suit filed at the trial court—from an initial claim based on allegations of fraud against the Respondent to one now centred solely on alleged negligence. It was argued that this strategic shift appears to be an attempt https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 4

page 4 of 9

to obscure the fact that the Appellant failed to meet the legal threshold required to establish a claim founded on fraud. 22. It was submitted that n order to succeed in his claim, the Appellant was required to demonstrate that the Respondent knowingly created, received, or acted upon false information without any reasonable basis for believing it to be true. Further, he did not establish that the Respondent relied on such false information to facilitate the registration of the disputed SIM cards, resulting in actual harm to him 23. Reliance was placed in the case of Davy v Garrett (1878) 7 Ch. D 473, where Thesiger LJ established that: “ Fraudulent conduct must be distinctly alleged and distinctly proved, and it [is] not allowable to leave fraud to be inferred from the facts and general allegations, however strong may be the words in which they are stated, are insufficient to amount to an averment of fraud of which any court ought to take notice." 24. The principle above was reiterated in Njuwangu Holdings Ltd v Lang’ata KPA Nairobi & 5 others [2014] eKLR, where the court held: “ The standard of proving fraud in civil cases, the courts have consistently held, is higher than on a balance of probability. An allegation of fraud is a serious indictment against a party to whom it is made, and though the standard of proof is not beyond a reasonable doubt as in criminal cases, it is no doubt near there but is certainly higher than on a balance of probability. Thus, when a party in a civil matter makes an allegation of fraud against another party, they should be prepared to tender and adduce evidence to prove the allegation to the required standard. In the present case, I am afraid the fraud allegations against the plaintiff have been generalized, lack specificity, and are generally unproved." 25. The Respondent maintained that none of the evidence presented before the trial court established any involvement on its part in the alleged fraud or linked it to the actions said to have caused harm to the Appellant. 26. It was also submitted that the claim that the Respondent disbursed a loan of Kshs. 300 to the Appellant without his consent was firmly rebutted by both DW and PW2 who confirmed that the KCB Mpesa platform—through which the loan was allegedly issued—is solely operated and managed by KCB, including all aspects of loan disbursement and therefore the Appellant’s fraud claim against the Respondent lacked merit, and the trial court rightly held that the Appellant had failed to meet the legal threshold for proving fraud. 27. The Respondent also contended that even if the Appellant's claim was construed as one of negligence against the Respondent, he did not establish that the Respondent owed him a duty—either under contract or statute—that was breached, resulting in the claimed losses as negligence requires proof of a duty of care owed by the Respondent to the Appellant, a breach of that duty, and resulting damage. That without these elements, a negligence claim cannot succeed. 28. To support their position the Respondent relied on the Court of Appeal case in M’iruanji Muchai v Broadways Bakery & Another [1996] eKLR quoted the decision in Kiema Mutuku v Kenya Cargo Hauling Services Ltd [1991] 2 KAR 258, where it was stated: “ There is as yet no liability without fault in the legal system in Kenya and a plaintiff must prove some negligence against the defendant where the claim is based on negligence.” https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 5

page 5 of 9

29. It was further submitted that the Appellant did not provide evidence to show that the registration of the SIM cards in his name was improper without proving when, how, and by whom the alleged improper actions were taken, and connect these to the damages claimed. It was also argued that no evidence was presented to demonstrate that the Respondent failed to follow due process in registering the SIM card and that the Respondent’s actions were fraudulent or negligent and the Appellant’s alleged losses could not be attributed to the Respondent. 30. The Respondent also referred to the decision in West Kenya Sugar Co. Limited v Gabriel Okumu [2018] eKLR, which emphasized the importance of pleadings in guiding a case as follows: “ The foundation or base of any cause or suit is its pleadings. The pleadings originate it. They form the base from which the conduct of the case is generally directed. The nature of the evidence to be presented or produced or adduced is guided by what has been pleaded. That then means that the evidence presented must be geared to prove the allegations made in the pleadings, and therefore the evidence must be in tandem or sync with the pleadings. Evidence, however well-presented is irrelevant and useless so long as it does not tend to prove the matters pleaded.” 31. Similarly the Respondent cited the holding, in Treadsetters Tyres Ltd v John Wekesa Wepukhulu [2010] eKLR, where the High Court quoted Charlesworth & Percy on Negligence, 9th edition, stating: “ In an action for negligence, as in every other action, the burden of proof falls upon the plaintiff alleging it to establish each element of the tort. Hence it is for the plaintiff to adduce evidence of the facts on which he bases his claim for damages. The evidence called on his behalf must consist of such, either proved or admitted and after it is concluded, two questions arise, (1) whether on that evidence, negligence may be reasonably inferior and (2) whether, assuming it may be reasonably inferred, negligence is in fact inferred.” 32. It was submitted that the Appellant failed to prove that the Respondent was negligent in performing its contractual obligations as required under Section 107 of the Evidence Act and as clarified in Evans Nyakwana v Cleophas Bwana Ongaro (2015) eKLR “ As a general preposition the legal burden of proof lies upon the party who invokes the aid of the law and substantially asserts the affirmative of the issue. That is the purport of Section 107(i) of the Evidence Act, Chapter 80 Laws of Kenya. Furthermore, the evidential burden … is cast upon any party, the burden of proving any particular fact which he desires the court to believe in its existence. That is captured in Section 109 and 112 of law that proof of that fact shall lie on any particular person…The appellant did not discharge that burden and as Section 108 of the Evidence Act provides the burden lies in that person who would fail if no evidence at all were given as either side.” 33. The Respondent submitted that the Appellant neither established that the registration of the mobile phone numbers was improper nor met the criteria to succeed in a negligence claim as set out in the Trendsetters Tyres Ltd case (supra). No breach of the Plaintiff’s personal data 34. The Respondent asserted that it had implemented robust policies and procedures to protect subscribers' data and that the Appellant admitted responsibility for safeguarding his personal information and it was his responsibility to demonstrate that he did not initiate the registration, and https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 6

page 6 of 9

to provide evidence proving that the Respondent was negligent in handling or releasing his personal information. 35. The Respondent argued that the Appellant did not provide evidence to support claims of unauthorized access or misuse of personal data by the Respondent and therefore it was asserted that the security of customer information, could only be disclosed or breached through the specific customer's own actions or negligence. 36. On whether the Appellant is entitled to claim for damages it was submitted that this claim has not been proven or substantiated as the Respondent categorically asserted that it plays no role in the operation or management of any bank’s mobile money platforms, including KCB Mpesa—the platform allegedly responsible for the negative credit listing. Notably, no evidence of such listing was established. 37. That it was further confirmed by PW2 that KCB Mpesa is solely managed by KCB whereas the Respondent operates independently from KCB and offers telecommunications services that are entirely separate from the banking operations and loan disbursement functions of platforms like KCB Mpesa and could not be linked to the Respondent and as such the Appellant’s claim for damages lacked a legal or factual basis and the trial court properly dismissed the claim. 38. The Respondent relied on the decision in Anastassios Thomos v Occidental Insurance Company Limited [2017] eKLR, where the High Court underscored the principle that a claimant must establish a clear causal link between the alleged negligent act and the harm suffered. In the absence of such proof of causation, a claim in negligence cannot succeed. 39. On whether the Appellant is entitled to general damages it was submitted that the Appellant failed to establish any causal link between the alleged losses and the Respondent’s actions in registering the mobile phone numbers under his identity. 40. That the Appellant also failed to demonstrate any negligence or wrongdoing on the part of the Respondent in the registration of the mobile phone number and the criteria for award of any damages was not satisfied. The Respondent urged the court to dismiss the appeal with costs as Appellant's evidence did not rise to the threshold required to support his serious allegations. Analysis And Determination 41. 42. This court having considered the grounds of appeal, the evidence on record in the trial court and having considered the rival submissions as well as the authorities relied on as mandated by the Constitution and the relevant statutory provisions the issues for determination are: d. Whether the trial court erred in finding that the plaintiff failed to prove fraud or negligence on the part of the defendant. e. Whether the defendant owed and breached a duty of care to the plaintiff in safeguarding his personal information. f. Whether the plaintiff was entitled to general damages for breach of privacy, negligence, and reputational injury. g. Whether the trial court properly evaluated the evidence and submissions before it. There is no dispute that a contractual and fiduciary relationship existed between the plaintiff and the defendant, arising from the mobile services subscription.Section 31 of the Kenya Information and Communications Act (KICA) and Regulation 10 of the KICA (Registration of SIM Cards) Regulations, 2015, the defendant has a statutory and contractual duty to verify subscriber identity https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 7

page 7 of 9

before registration; and ensure that personal information is not misused or disclosed unlawfully. This court therefore finds that it was established that a duty of care existed. Under 43. On whether the duty of care was breached the plaintiff proved that numbers had been registered using his national identity card without his authority and that the defendant later deregistered the disputed numbers. 44. The defendant’s own witness admitted that the fraudulent number was registered in Nakuru using an identity number not belonging to the plaintiff; that the registration process at that time did not include photographs or signatures and that the company did not trace or investigate the registering agent. 45. These admissions point to a lapse in internal control measures and a failure to reasonably verify subscriber identity, especially where fraud was later discovered. 46. Even if the plaintiff lost his ID card in 2013, the defendant had an ongoing duty to prevent third-party misuse of lost or forged identity cards through verification mechanisms. 47. This was the reasoning adopted in the case of Family Bank Ltd v Panda Co-operative SACCO [2022] eKLR, where the bank was held liable for negligence leading to unauthorized account operations. 48. Similarly in the case of Simba Commodities Ltd v Citibank N.A [2013] eKLR, it was held that financial institutions have a higher standard of care over customer information. It therefore follows that the argument that the defendant exercised due diligence is weak given the admitted procedural gaps in 2019. 49. The trial court held that fraud was not proved to the higher standard required. Indeed, the plaintiff did not show who among the defendant’s employees or agents committed the fraud. may not have been proved to the required standard (near beyond reasonable doubt), negligence and breach of statutory duty was established on a balance of probabilities. than active fraud by the defendant. 50. The plaintiff’s claim was more consistent with negligent handling of personal data However, while fraud 51. Under Article 31(c) & (d) of the Constitution, every person has the right not to have information relating to their family or private affairs unnecessarily required or revealed, and not to have personal data unlawfully disclosed.constructive violation of privacy rights. This is consistent with the reasoning in Shalimar Flowers Self Help Group v KCB [2016] eKLR where it was held: 52. The defendant’s failure to investigate or take responsibility for agents’ actions could amount to 53. By allowing fraudulent registration of lines using the plaintiff’s ID, the defendant indirectly breached that constitutional guarantee. “ The basic duty in respect to the cheques paid out by the Defendant herein was the obligation to pay the Plaintiff's cheques as per the customer's mandate. (See Lipkin Gorman Case) However in so doing it had to act in good faith and in the ordinary cause of business while exercising reasonable care and skill……………. ……….In my considered view the circumstances surrounding the nine payments from the group's account required that the Defendant in exercise of reasonable skill and care makes a more extensive inquiry beyond the minimum verification of signatures and placing a call to the self-same number and signatory who, on all accounts misled the bank. In this case, https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 8

page 8 of 9

it mattered not that there was no requirement to confirm payments with the mandatory signatory. It mattered not, in my opinion that the signatures were on the face of it genuine. What the mandatory signatory really implied is a matter of common sense. The excuse by DW1 that his telephone details were not on the specimen card cannot hold water. The bank ought to have satisfied itself that the signatories were not misusing their positions to defeat the intentions and purposes of the group.” 54. On whether the Appellant suffered loss and damages the plaintiff’s claim for Kshs. 1,000,000 was not supported by evidence of quantifiable loss or an adverse CRB listing directly traceable to the defendant. However, courts have awarded modest general damages for breach of privacy and negligent exposure of personal data even where special damages are absent. For example in Family Bank v Panda Co-operative Kshs. 500,000 was awarded. Given that the disputed numbers were deregistered and no monetary loss was shown, this court finds that nominal damages are justified for breach of privacy and negligence. 55. In conclusion the finding of the trial court dismissing the suit is set aside. Judgment is entered for the plaintiff against the defendant for breach of duty of care and violation of privacy.Kshs. 500,000/= with interest at court rates from the date of judgment, and costs of the suit in the lower court. The plaintiff is awarded general damages ofM Bottom of Form DATED, SIGNED, AND DELIVERED AT MIGORI THIS 23RD DAY OF OCTOBER, 2025. ..................... ANNE ONG’INJO JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/15495/eng@2025-10-23 9

page 9 of 9