Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Regus Kenya appealed a Kshs. 5,000,000/- penalty issued by the Data Commissioner after ignoring a spam complaint and subsequent Enforcement Notice. The High Court found the notices lawful. However, finding the maximum penalty excessive for a first offender, the court reduced the fine to Kshs. 2,500,000/-.

Facts

The Appellant, Regus Kenya Limited, lodged the appeal seeking to have the appeal allowed and the Penalty Notice set aside in its entirety. Their primary contentions revolved around the procedure followed by the Data Protection Commissioner (1st Respondent) and the severity of the fine imposed.

<aside> <img src="/icons/forward_red.svg" alt="/icons/forward_red.svg" width="40px" />

Link to the ODPC Ruling | Being an appeal from the Determination dated 23rd May 2023, Penalty Notice dated 11th April 2023 and Enforcement Notice dated 16th February 2023 of Immaculate Kasait (MBS/Data Commissioner) (Not in Database)

</aside>

The Appellant claimed the following acts or errors were committed by the Commissioner:

• Jurisdiction and Timelines: The Commissioner lacked jurisdiction because the penalty decision was rendered long after the 90 days prescribed by Section 56(5) of the Data Protection Act for investigating and concluding a complaint had lapsed. The Appellant noted the complaint was lodged on 6th October 2021, while the Penalty Notice was issued on 11th April 2023.
• Procedural Fairness: The Commissioner failed to accord the Appellant its right to a fair hearing and fair administrative action, specifically under Articles 50(1), 24, 47, and 48 of the Constitution.
• Failure to Investigate: The Commissioner faulted the 1st Respondent for failing to investigate the case, which is a requirement under Section 56(5) and 57 of the Act, before rendering a decision and imposing the maximum fine.
• Improper Review Dismissal: The Commissioner erred in dismissing the Appellant's application for review and failed to appreciate the evidence tendered regarding the Appellant's innocence. The Appellant submitted that it only became aware of the Enforcement Notice on 11th April 2023 and exercised its right of review within the 30-day period under the Regulations.
• Excessive Penalty: The Commissioner imposed an excessive fine of Kshs. 5,000,000/- without establishing any violations or considering the evidence tendered, noting that imposing a maximum sentence on a first offender is unusual.
• Defence on Violation: The Appellant maintained that it did not violate the Act and was already compliant with the Enforcement Notice measures before the dispute began. They asserted they had an "opt in" or "opt out" choice mechanism and a Data Protection Policy. The 2nd Respondent was identified as a former client whose contract for virtual office services was terminated due to arrears.

Both the 1st Respondent (Data Protection Commissioner) and the 2nd Respondent (James Ndungo) challenged the appeal.