The ODPC can't fine a customer-service complaint dressed up as data protection

A passenger's real grievance was that the airline failed to provide a wheelchair for his elderly mother; the data protection angle — a refused request for a recorded call — was secondary. The ODPC nonetheless proceeded to a KES 250,000 award while the airline's internal resolution process was still active, without waiting for that process to conclude. The Court confirmed that a voice recording is personal data and that access rights under Section 26 are real, but held that the Commissioner breached the doctrine of exhaustion by bypassing internal ADR, and that compensation under Section 65 needs actual proof of damage or distress — not just a technical violation. The determination was set aside in full as an overreach of the ODPC's mandate.