Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Aventus Technology appealed the Data Commissioner's ruling, denying a privacy breach and challenging Kshs. 250,000 damages awarded to Ndambuki for loan-related harassment, claiming consent via pop-up. The High Court found Aventus liable for failing to prove explicit consent as a data controller and upheld the damages as justified and not excessive. The appeal was dismissed with costs.

Facts

The Appellant, Aventus Technology Limited, appealed against a decision by the Office of the Data Protection Commissioner (ODPC). The ODPC had found Aventus Technology Limited in violation of the Respondent's data privacy rights and ordered them to pay Kshs. 250,000 in damages.

The Appellant's grounds for appeal included:

• The ODPC erred in finding that the Appellant had violated the Respondent’s right to privacy.
• The ODPC erred in denying that the Appellant had fulfilled its obligations as a data controller under the Data Protection Act, 2019.
• The ODPC erred by failing to find that the Appellant did not breach the Respondent’s right to privacy, arguing that the data was under the control of the data processor (the loan borrower).
• The ODPC erred in awarding Kshs. 250,000 as damages for distress, claiming it was neither pleaded nor proven.
• The ODPC failed to provide the basis, criteria, and rationale for the damages award.

<aside> ➡️

An appeal from the judgment of Office of the Data Protection Commission (ODPC) in ODPC Complaint No. 2506 of 2023 delivered on 4th March 2024 | Daniel Ndambuki vs. Aventus Technology Ltd - ODPC Complaints No. 2506 of 2023

</aside>

The Appellant, a licensed Digital Credit Provider, argued that it had fully complied with the Data Protection Act by obtaining the Respondent’s explicit consent through a pop-up message. This pop-up message, which the Respondent allegedly accepted, authorised the use of his contact details as an emergency contact for the borrower, Webstar Moindi. They asserted that the Respondent was aware of the data collection purpose and its intended use, thus fulfilling requirements under Sections 28 and 29 of the Act. The Appellant also contended that the ODPC disregarded its evidence of compliance and failed to justify its findings.

They further cited case law to argue that general damages must be supported by evidence of harm, which they claimed the Respondent failed to demonstrate. The Appellant considered the award excessive and arbitrary. They requested that the ODPC’s decision be overturned or, alternatively, for the damages to be substantially reduced to Kshs. 50,000 .