Ceres Tech Limited v Office of The Data Protection Commissioner .

Handling and Enforcement) Regulations, alleging violations of his right to privacy. 3. The Respondent notified the Appellant of the reinstated complaint through a letter dated 19th December 2024 in which it granted the Appellant 21 days to respond. 4. The Appellant did not file a response and on 15th January 2025, the Respondent issued a determination finding violations of Sections 25, 26, 28, 29, 30 and 41 of the Act and awarded the Complainant Kshs. 700,000 as compensation. 5. The Appellant was aggrieved by the said decision and filed this appeal challenging both the process and substance of the determination. The Appellant avers that the Respondent acted without jurisdiction, misapplied the law, misapprehended the facts, violated Article 47 of the Constitution, and imposed an arbitrary and disproportionate penalty. 6. The Respondent, on its part, maintains that the decision is lawful, procedurally fair, and properly grounded in statute. 7. The appeal was canvassed by way of written submissions which I have considered. The Appellant’s Submissions 8. The Appellant submits that the Respondent lacked jurisdiction to determine the complaint, having earlier discontinued it on the ground that it concerned fraud which is a matter outside the Respondent’s statutory mandate. It is contended that the subsequent reinstatement and HCCA E166 OF 2025- JUDGMENT 2

page 2 of 17

determination violated the doctrines of legal certainty, legitimate expectation, and ultra vires action. 9. The Appellant further argues that the Respondent misapplied the Data Protection Act, failed to distinguish identity fraud by a third party from unlawful data processing, and improperly imposed liability without proof of intent or negligence. The Appellant maintains that no evidence was adduced to show unlawful collection, processing, or transmission of personal data attributable to it. 10. It is also submitted that the Respondent violated Article 47 of the Constitution by relying on unverified and selective evidence, failing to consider exculpatory material, and denying the Appellant a fair and reasonable administrative process. 11. The Appellant contends that the award of Kshs. 700,000 was arbitrary and disproportionate. It adds that the award was imposed without a structured assessment of culpability, harm, or mitigating factors, and should be set aside with costs. The Respondent’s Submissions 12. The Respondent submits that it acted within jurisdiction, emphasizing that the appeal concerns the reinstated complaint, not the original complaint that had been discontinued. It argues that Regulation 7(3) of the Data Protection (Complaints HCCA E166 OF 2025- JUDGMENT Handling and Enforcement) 3

page 3 of 17

Regulations expressly empowers the Respondent to reinstate a complaint upon provision of additional material. 13. The Respondent maintains that the Appellant was duly notified of the reinstated complaint, granted sufficient time to respond, and failed to do so, thereby entitling the Respondent to proceed to determination based on the available evidence. 14. It is further submitted that investigations established multiple violations of the Data Protection Act, including unlawful collection, inaccurate processing, failure to notify the data subject, and continued processing despite objection. The Respondent contends that these actions infringed the Complainant’s constitutional right to privacy. 15. On compensation, the Respondent submits that Section 65 of the Act grants discretion to award compensation for both financial and non-financial harm, and that the award of Kshs. 700,000 was reasonable, justified, and aimed at vindicating the Complainant’s constitutional rights. The Respondent urges the Court to dismiss the appeal with costs. Issues for Determination 16. Having considered the record and the parties’ submissions, I find that the following issues arise for my determination: a) Whether the Respondent had jurisdiction to determine the complaint; b) Whether the Respondent violated Article 47 and principles of fair administrative action; HCCA E166 OF 2025- JUDGMENT 4

page 4 of 17

c) Whether the Respondent misapplied the Data Protection Act, 2019; d) Whether the penalty imposed was arbitrary and disproportionate. Analysis and Determination Jurisdiction 17. It is trite that jurisdiction is everything without which a court cannot act or move one more step. (See Owners of the Motor Vessel “Lillian S” vs. Caltex Oil (Kenya) Ltd (1989) KLR 1.) 18. In Samuel Kamau Macharia & Another vs. Kenya Commercial Bank Ltd & 2 Others [2012] eKLR, the Supreme Court stated that: “A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the Constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law.” 19. In this case, it was not disputed that the Respondent carried out its own investigations on the complainant’s initial complaint and found that the said complaint, as presented, amounted to fraud and fell outside its mandate. The Respondent stated as follows, in part, in its letter dated 3rd September 2024 discontinuing the complainant’s initial complaint: HCCA E166 OF 2025- JUDGMENT 5

page 5 of 17

“Upon review of the complaint, the evidence adduced and investigations carried out by the Office, the Office found no link between the mobile phone number 0785690785 allegedly used to contact the Complainant, and Ceres Tech Limited T/A as Rocket Pesa. An examination of Ceres Tech Limited’s database did not reveal the aforesaid mobile phone number or any information related to the Complainant including his name, mobile phone number and National Identification Number. No records were found on the Respondent’s database indicating that the Complainant had a loan with the Respondent. Additionally, the mobile phone number 0727200234 that was allegedly used to obtain the loan did not appear on the Respondent’s database. The Office notes that this is a case of fraud which is not within the mandate of the Data Commissioner and therefore advice that it be pursued through the Directorate of Criminal Investigations (DCI) – Cybercrimes Unit. This is therefore to communicate the decision of the Office to discontinue the complaint filed against Ceres Regulation Tech 7(1)(a) Limited of the in line with Regulations. However, you may re-institute this complaint upon providing grounds for the restitution.” HCCA E166 OF 2025- JUDGMENT 6

page 6 of 17

20. Through his letter to the Respondent dated 18th October 2024, the complainant sought the reinstatement of the complaint against the Appellant on the basis that he had secured additional material allegedly disclosing violations of his right to privacy. In the said letter, the complainant informed the Respondent that he had earlier reported the case to the Director of Criminal Investigations (DCI) Cybercrimes Unit, which carried out investigations and produced findings that support reinstating the complaint. 21. The complainant alleged that the Appellant breached the Data Protection Act by giving false and misleading information, particularly by denying any link to the phone numbers involved and claiming that the loan was not obtained through their system yet the DCI investigations led to the arrest of the owner of the number used to obtain the loan, who confessed to receiving and settling the loan. 22. The complainant presented an Mpesa statement confirming an alleged payment of Kshs. 8,000 to RocketPesa through the Appellant’s Paybill number and argued that this evidence proved wrongdoing. He the Respondents’ cited similar involvement determinations by and the Respondent and legal principles to support his claim, and stated that the experience has caused him emotional and financial distress. He urged this court to compel the Appellant to pay him Ksh 3,000,000 in damages and that a fine of Ksh 5,000,000 be issued against them under the Data Protection Act. Mpesa statement not legible HCCA E166 OF 2025- JUDGMENT 7

page 7 of 17

23. Upon receipt of the complainant’s second complaint, the Respondent claims that he wrote to the Appellant on 19 th December 2024 informing it to respond to the said complaint within 21 days from the date of service with the complaint. From the record, it is not clear if the Appellant was served with the said order and second complaint. 24. On 18th December 2024, the Appellant sought and obtained the following orders in Milimani MCCRMISC No. E4657 of 2024: “a) THAT search warrant is hereby issued to Maryanne Serem, an Investigating officer, with the Data Protection Commissioner, or any other officer attached to the and authorized by the applicant, to have access to, inspect/investigate ,obtain information, lift and carry away as exhibits certified copies of the respondent's system(s) digital database and (s) manual pertaining records, to the complaint under investigation of the following personal data:Mobile Number- 0708288561 Mobile Number- 0727200234 Mobile Number- 0785690785 Name- kelvin Gitobu Kirimi Name -Antony Mwenda kinoti HCCA E166 OF 2025- JUDGMENT 8

page 8 of 17

National Identification NO. 31643475 b) THAT the orders of this honorable court be served upon the relevant Director/Manager of the respondent herein.” 25. It is not clear, from the record, if the Respondent conducted the investigations as stated in the said court order or at all. The record contains an investigations report dated 10 th January 2025 which reveals that the evidence the Respondent collected were: i) Screenshot of the Complainant’s text messages as provided; ii) Screenshot of the 4096615 registered Paybill number under the Appellant’s. 26. The Respondent’s investigators concluded that: i) The Appellant committed an offence under Section 57 (3) of the Act by providing false information to the Respondent’s office during the course of the investigations; ii) The Appellant violated the Complainant’s rights; iii) The Appellant has failed to provide a response to the re-instituted complaint (2nd Notification letter) dated 19th December 2024. HCCA E166 OF 2025- JUDGMENT 9

page 9 of 17

27. The said investigators recommended the Appellant’s prosecution for committing an offence under Section 57 of the Act, an order for compensation of the Complainant and the issuance of an Enforcement Notice upon the Appellant. 28. The Respondent acted on its investigators’ recommendations by making a Determination dated 15 th January 2025 in which made the following orders that are the subject of this appeal: i. The Respondent is hereby found liable for violating the Complainant’s right to be informed of the use to which his personal data was to be put, his right to object to the processing of his personal data, and for unlawfully processing the Complainant’s personal data. ii. A recommendation for prosecution is hereby made to the Director of the Respondent’s Company, for obstruction of the Data Commissioner in exercise of their powers and giving the Data Commissioner information which is false and misleading in any material aspect, pursuant to Sections 61(a) & (d) of the Act. iii. An enforcement notice to hereby be issued to the Respondent. HCCA E166 OF 2025- JUDGMENT 10

page 10 of 17

iv. The Respondent is hereby ordered to pay the Complainant Kenya Shillings Seven Hundred thousand (KES 700,000) as compensation. v. Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days. 29. Having regard to the above narration of the sequence of events that culminated in the Respondent’s impugned decision and my observation that is not clear if the Appellant was served with 2nd Complaint and the court order dated 18th December 2024. I therefore find that the entire process undertaken by the Respondent was not transparent and that the Respondent violated Article 47 of the Constitution which guarantees lawful, reasonable, and procedurally fair administrative action. 30. In Judicial Service Commission vs. Mbalu Mutava & Another [2015] eKLR, it was held that fair administrative action includes notice of the charge, adequate time to respond, and a hearing by an impartial tribunal. 31. In the present case, it is not clear, from the record, if whether the Appellant was served with the reinstated complaint and/or the letter dated 19th December 2024 allegedly requiring it to respond within 21 days. The absence of proof of service is a material defect which goes to the root of the process. HCCA E166 OF 2025- JUDGMENT 11

page 11 of 17

32. The Respondent proceeded on the assumption that the Appellant had failed to respond, and relied on that assumption to reach far-reaching conclusions and impose liability and compensation against the Appellant. 33. It is also noteworthy that the Respondent rendered its determination on 15th January 2025, which was less than one month after the alleged letter notifying the Appellant of the reinstated complaint. This period included the December holiday season when many institutions scale down or shut down their operations. 34. In the circumstances of this case, I find that the Respondent’s process was rushed, opaque and did not meet the constitutional standard of fairness required under Article 47. 35. As I have already noted in this judgment, the Respondent’s evidence as contained in its investigations report dated 10 th January 2025 was limited to screenshots of the Complainant’s text messages and Paybill number 4096615 allegedly registered under the Appellant’s name. With tremendous respect to the Respondent, I find that such evidence, without more, could not form a proper basis for the serious findings made against the Appellant, including unlawful processing of personal data, obstruction, and recommendation for prosecution. It is instructive to note that the Respondent arrived at the conclusion that Paybill Number 4096615 was registered under the Appellant without seeking any confirmation from the Service Provider of the said Paybill Number. It was incumbent upon the HCCA E166 OF 2025- JUDGMENT 12

page 12 of 17

Respondent, at the very least, to verify the ownership and linkage of Paybill number 4096615 through independent confirmation from the relevant service provider or through proper investigative steps as sanctioned by the court orders in MCCRMISC No. E4657 of 2024. 36. The Respondent failed to demonstrate that it conducted any meaningful investigation pursuant to the court order dated 18th December 2024, and further failed to demonstrate that it established, on evidence, unlawful processing attributable to the Appellant as opposed to identity fraud by a third party. It is also noteworthy that while the basis of the Complainant’s reinstitution of the 2 nd complaint was that investigations carried out by the DCI had revealed that the Appellant was responsible for the false demand for loan repayments, no such report from the DCI was filed before the Respondent to confirm the allegations. 37. I further note that the Respondent did not address the Appellant’s consistent position that the incident arose from fraudulent impersonation by a third party. My finding is that the Respondent’s reliance on unverified evidence, without confronting exculpatory material, violated the principle of audi alteram partem. In Kenya Data Networks Ltd vs. Benson Kinyua [2013] eKLR, it was held that rregulators must not only act fairly but must ensure that the facts underlying enforcement action are accurate and comprehensive. In the present case, it is apparent that the Respondent did not carry out any meaningful investigations HCCA E166 OF 2025- JUDGMENT 13

page 13 of 17

but merely relied on the fact that the Appellant did not file a response to the 2nd complaint and went ahead to make the impugned determination. 38. My finding is that the Respondent acted ultra vires its statutory jurisdiction. I say so because while it is true that Regulation 7(3) of the Data Handling and Enforcement) Protection (Complaints Regulations allows a complainant to reinstitute a complaint upon providing further material, such reinstatement does not oust the Respondent’s duty to ensure that investigations are meaningful, credible and fair, and that the Respondent acts within the limits of its lawful mandate and in compliance with the Constitution. 39. It is trite that where statutory bodies, such as the Respondent herein, exercise powers beyond those conferred by law, then such actions are null and void for want of jurisdiction. (See Owners of the Motor Vessel “Lillian S” case (supra). In this case, the Respondent previously discontinued the complaint on the express basis that the matter amounted to fraud and fell outside its mandate. I find that even though the complainant later presented alleged additional material, the Respondent was still under a constitutional and statutory duty to ensure that any subsequent handling of the complaint complied with the threshold of fair administrative action and the minimum standards of procedural fairness. 40. The Respondent was further obligated to comply with the rules of natural justice before making adverse findings HCCA E166 OF 2025- JUDGMENT 14

page 14 of 17

against the Appellant, including the right to adequate notice and opportunity to be heard. Whether the Data Protection Act was Misapplied 41. The Respondent’s determination cited violations of Sections 25, 26, 28, 29, 30 and 41 of the Data Protection Act. My view is that for such findings to stand, there must be credible evidence showing that the Appellant collected, processed, disseminated, or retained the Complainant’s personal data in a manner inconsistent with the Act. 42. In the absence of verified evidence showing the link between the alleged communications, the alleged loan demand, and the Appellant’s actual systems or records, I am not persuaded that the Respondent discharged the burden necessary to justify the findings made. 43. While the Respondent argued that the Appellant failed to respond to the reinstated complaint, failure to respond alone cannot operate as conclusive proof of wrongdoing. The Respondent still had a duty to carry out investigations and establish the alleged unlawful conduct on evidence. 44. I therefore find that the Respondent misapprehended the facts and misapplied the Act as against the Appellant. Whether Compensation of Kshs. 700,000 Was Arbitrary 45. The Respondent awarded the complainant Kshs. 700,000 as compensation. 46. I find that while Section 65 of the Data Protection Act allows an award of compensation, such compensation must be HCCA E166 OF 2025- JUDGMENT 15

page 15 of 17

grounded on evidence, must be rational, and must follow a fair process. 47. In view of my findings that the Respondent’s process was not transparent, lacked proof of service, relied on unverified evidence, and violated Article 47 and natural justice, I find that the award of Kshs. 700,000 was not sustainable. 48. I further find that the Respondent’s orders recommending prosecution and issuing enforcement measures were reached without adequate investigations and cannot stand in the circumstances. Disposition 49. In the end, I find that the appeal has merit and I therefore make the following orders: a) The appeal is hereby allowed. b) The determination of the Office of the Data Protection Commissioner dated 15th January 2025 is hereby set aside in its entirety. c) Any consequential orders arising from the said determination, including the award of Kshs. 700,000, the recommendation for prosecution, and enforcement notice are hereby vacated. d) The matter is hereby remitted back to the Office of the Data Protection Commissioner for reconsideration and determination afresh, subject to compliance with Article 47 of the Constitution, the Fair Administrative Action Act, and the rules of HCCA E166 OF 2025- JUDGMENT 16

page 16 of 17

natural justice, including proof of service and meaningful investigations. e) Each party shall bear its own costs. 50. Orders accordingly. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 29TH DAY OF JANUARY, 2026. HON. W. A. OKWANY JUDGE 29/01/2026 FOR APPELLANT ……………. FOR THE RESPONDENT ………… COURT ASSISTANT Uber HCCA E166 OF 2025- JUDGMENT 17

page 17 of 17