High Court Questions ODPC Power to Award Compensation, Sets Aside KSh1.25m Award

Justice Francis Andayi of the High Court set aside a KSh1.25 million compensation order issued by the Office of the Data Protection Commissioner (ODPC) against a Nairobi healthcare business, raising doubts about the regulator’s legal authority to award damages.

The judge explained that the Data Protection Act authorises the Commissioner to impose penalties, fines and rectification orders, but does not expressly grant power to determine compensation, and that Regulation 14(3)(e) may exceed the authority Parliament provided.

“The issue needs to be considered further through an appropriate application due to its ramifications,” Andayi said, adding that a hearing conducted by the same Commissioner who investigated and prosecuted the case would violate natural justice, “Even if a hearing were to be conducted, I again doubt that it would be by the same Data Commissioner to be the one investigating, then prosecuting it and then deciding. That would be against all the rules of natural justice.”

The ruling does not overturn previous compensation awards, including more than KSh30 million paid to individuals in 2025, nor specific orders such as KSh50,000 to Andrew Endovo by Standard Investment Bank, KSh900,000 to Philip Bolo by Platinum Credit, KSh500,000 to former employee Cyrus Mwaniki Ndung’u by Moja Expressway Company, and a KSh2.6 million award to Tech Limited that was already being challenged.

While leaving Regulation 14(3)(e) in place, the judgment indicated that its validity should be tested through a judicial review or constitutional petition, with the Attorney-General given an opportunity to participate.

The ODPC’s enforcement record shows 51 determinations in 2024 with average fines of about KSh522,308 per case, and a growing portfolio of compensation claims across sectors such as financial services, healthcare, lending and digital commerce.

The regulator is also preparing for a leadership transition after President William Ruto nominated Lydia Sitienei Chelagat, formerly Director of Legal Services at the Communications Authority of Kenya, to succeed Immaculate Kassait, whose six-year tenure handled over 13,000 complaints, issued 459 determinations and took 206 enforcement actions.