MP Muchangi Patrick& Associates Advocates
Talk to an Expert
Practice Areas Case Digest Knowledge Centre Insights About Contact Talk to an Expert
Muchangi Patrick & Associates Advocates logo Muchangi Patrick & Associates Advocates ← Back to the Blog

Case Note

Case Notes & Commentary
ODPC & High Court, Kenya
One ruling, digested on its own — the facts, the holding, and the practice point
[2026] KEHC 4944

A recycled phone number doesn't make the new owner a data subject of the old customer's data

Taifa DT Sacco Society Limited v Otieno

Appeal allowed Case Note Data Protection · Administrative Law
By the Editorial Board, Muchangi Patrick & Associates Advocates

A man who had never joined a SACCO kept receiving its credit and debit alerts after inheriting a recycled mobile number from an existing member. The ODPC ordered KES 250,000 in compensation for the SACCO's failure to stop the messages fast enough. The High Court reversed entirely: the complainant was not a data subject in respect of that number because no data of his was ever processed — only the original member's — and a month's delay in verifying a number reassignment the telco carried out without the SACCO's knowledge was reasonable, not a breach. The Court was blunt that the Act "should not be used as a cash cow," warning against turning number-recycling inconvenience into a compensation industry.

Practice pointThe person receiving unwanted messages is not automatically the "data subject" if no data about them was actually processed — and reasonable verification time before switching off a communication channel is a valid defence.
Cite this page: Muchangi Patrick & Associates Advocates, "A recycled phone number doesn't make the new owner a data subject of the old customer's data: Taifa DT Sacco Society Limited v Otieno" (dataprivacyadvocates.co.ke, 2026) <https://dataprivacyadvocates.co.ke/case-taifa-dt-sacco-society-limited-v-otieno.html>.
How this touches a live ODPC matter

Whether you are defending a complaint, appealing a determination, or bringing a privacy claim of your own, the forum you choose and the procedural record you build early usually decide the outcome.

Muchangi Patrick & Associates Advocates represents complainants and respondents before the Office of the Data Protection Commissioner and on appeal, judicial review and constitutional petition before the High Court.

Related resource

SACCOs sit on some of the most sensitive member data in the country. Our board-level executive brief sets out what digital trust and data governance actually require of a SACCO board.

Open the SACCO Digital Trust Executive Brief →

Continue reading
← Vicarious liability holds — but so does proportionality
All Case Notes on the Blog
Mandamus compels the ODPC to act after 90 days of silence →