Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Wananchi Group appealed an ODPC order to delete customer data and pay compensation. The High Court ruled the ODPC erred, finding the service contract was still active as the customer (Owino) hadn't returned equipment. Thus, Wananchi was entitled to retain the data. The appeal was allowed, and the ODPC's decision set aside.

Facts

The case of concerned an appeal from a decision made by the Office of the Data Commissioner (ODPC) in ODPC No. 1992 of 2023 (see below). The appeal, presided over by Justice DKN Magare, revolved around a dispute between Wananchi Group (K) Limited (the appellant, a data user) and Victory Owino (the 1st Respondent, a data owner), with the Office of the Data Commissioner as the 2nd Respondent.

The original complaint to the ODPC by Victory Owino alleged that Wananchi Group (K) Limited was holding and potentially misusing his personal data. The Data Commissioner, in its decision, found the appellant in contravention of Sections 25(a), 30, 32, 39, and 41 of the Data Protection Act. Consequently, the ODPC issued measures, including an order for the appellant to cease and desist from calling and sending promotional messages and emails to Mr. Owino and other data subjects who had stopped using its services, threatening administrative fines for non-compliance. Furthermore, the Data Commissioner found Wananchi Group (K) Limited liable for infringement of the Complainant’s rights and violation of its obligations under the Act, ordering them to compensate Mr. Owino a sum of Kshs. 250,000. An Enforcement Notice was also to be issued against the Respondent.

<aside> 💡

Link to original ODPC Ruling | Victory Owino vs. Wanainchi Group - ODPC Complaint No.1992 of 2023

</aside>

The appellant argued that the Data Commissioner erred in law and fact by failing to properly appreciate the evidence, disregarding the totality of the appellant’s response and submissions, and consequently arriving at unsupported findings of fact and law. They specifically contended that the ODPC failed to acknowledge that both parties were bound by a set of contractual terms and conditions that explicitly outlined their respective rights and obligations. A crucial point of contention was the 1st Respondent’s alleged refusal to either inform the appellant of the location for the collection of the Zuku router or personally deliver it, which, according to the appellant, effectively maintained the contractual relationship between them.

The appellant further submitted that the Data Commissioner misdirected itself by relying on Section 39 of the Data Protection Act, concerning data retention, in ruling that the appellant ought to delete, erase, anonymise, or pseudonymise the 1st Respondent’s personal data. This was deemed erroneous given the appellant's assertion that the contractual relationship was still in existence. They maintained that the appellant was ready and willing to handle the 1st Respondent’s data in accordance with Section 41 of the Data Protection Act once the 1st Respondent complied with the contractual terms and conditions. The appellant also challenged the Enforcement Order issued on 17th January 2024, arguing it compelled them to pay a "baseless and unfounded" sum of Kshs. 250,000.

In their submissions, the appellant explained their business strategy of issuing routers free of charge for the contract duration and stated that the 1st Respondent sought to close the account on 3rd October 2022. However, the appellant required the return of the equipment for complete account closure, which the 1st Respondent failed to do or even respond to emails regarding it, instead demanding data deletion prior to equipment return. The appellant asserted that the ODPC's decision was based on the "erroneous assumption that the contract had been terminated". They referenced contractual clauses 2.5 (appellant’s option to terminate) and 2.4 (customer’s option to terminate, requiring 30 days’ notice and equipment return), arguing that the ODPC had effectively "re-written the agreement" between the parties. Citing judicial precedents, they argued that courts and tribunals should not rewrite contracts. The appellant also posited that it is against public policy for data subjects to demand data erasure under a subsisting contract to evade compliance with its terms. They claimed a legitimate interest in maintaining data as long as the contract subsisted, noting that deleting data before equipment return would be "absurd" and impractical for recovering property or contacting the customer. Lastly, the appellant contended there was no evidence of data misuse; contacts were solely for account business, and no harassment was proven.

The 1st Respondent, Victory Owino, submitted that he was not informed that the router needed to be returned and assumed it was paid for, stating it was destroyed in January 2022. He also contended that Section 37 of the Data Protection Act prohibits the use of personal data without express consent and that the appellant did not seek permission to send promotional messages. He asserted his entitlement to protection under Section 5 of the Data Protection Act and argued that no good reason was given for overturning the ODPC's decision. The 2nd Respondent (Office of the Data Commissioner) simply affirmed its initial decision and enforcement measures, as detailed above. The High Court noted that the 1st Respondent also introduced "irrelevant" information related to the Kenya Information Communications Act 1998 and new evidence not presented before the Commissioner via submissions.

<aside>

Issues for Determination by the Court:

• Did Credit Watch fulfill its obligations under the Data Protection Act, 2019? Were the Respondents' rights to be informed about the use of their personal data violated?
• Was the compensation awarded to the Respondents excessive? </aside>

As the first appellate court, the High Court re-evaluated the evidence to determine if the Data Commissioner erred in finding the appellant liable. The court underscored that submissions cannot replace evidence, and it would disregard new facts or documents introduced for the first time on appeal. It affirmed the Data Commissioner's quasi-judicial role and its jurisdiction to determine breaches of privacy rights and order remedies, but not to exclusively interpret the Constitution.

Crucially, the High Court found that a contract existed between the parties with clear termination clauses. It held that the 1st Respondent, while initiating termination, did not complete the process as required by giving 30 days’ notice and returning the equipment. The court firmly stated that "courts or tribunals have no business re-writing contracts between parties", concluding that the Data Commissioner was "wrong in finding that the contract was terminated by dint of clause 2.5 of the agreement".