'Introduction
1. The Petition dated 1st February 2024 is supported by the Petitioner’s verifying affidavit and witness statement of even date and a further supplementary affidavit sworn on 10th June 2024.
2. This Petition was aroused by the disaffection triggered by the nature of the relief that was granted by the Interested Party in a complaint that the Petitioner had lodged at the Interested Party against the Respondents. Accordingly, the Petitioner now seeks this Court’s affirmation that his right to privacy under Article 31 of the Constitution was violated by the Respondents and an award of compensation for the breach.
3. Consequently, the Petitioner seeks the following reliefs:
i. This Court finds the Respondents grossly in violation of the right to privacy set out under Article 31 of the Constitution.
ii. This Court orders the 1st Respondent to pay the Petitioner Four Million Kenyan Shillings (Kshs. 4,000,000) in damages.
iii. This Court orders the 2nd and 3rd Respondents to pay the Petitioner Two Million Nine Hundred and Seventy-Five Thousand Kenyan Shillings (Kshs. 2,975,000) each in damages.
iv. Costs be provided for.
Petitioner’s Case
4. The Petitioner stated that his wife took out loans with the Respondents. She defaulted in repayment of these loans. The Respondents then begun incessantly calling and texting the Petitioner using different numbers requiring him to repay the said loans yet he was not a guarantor or even being privy to the borrowing. He stated that these calls and threats were rude and aggressive.
5. The Petitioner depones that the Respondents actions caused him sleepless nights and great distress taking a toll on his health and emotional state. As a result, he sought medical assistance at Sinai Hospital at Rongai where it was discovered that he had fluctuating blood pressure and persistent headaches owing to the stress.
6. In addition, the Respondents invaded their matrimonial home to harass his family members and worker concerning the loans and slandering his family’s name.
7. Aggrieved by these actions, the Petitioner lodged his complaint with the Interested Party herein on 5th October 2023 via email. He depones that the Interested Party on 2nd January 2024 delivered a Ruling in his favour determining that:
i. The Respondents herein were found liable for unlawfully processing the Plaintiffs personal data.
ii. Enforcement Notices were issued against all the Respondents herein.
iii. Parties were given the right to appeal the Data Commissioner''s determination to the High Court of Kenya within thirty (30) days.
8. The Petitioner contends that the Respondents’ being in possession of his personal data, utilized it in a manner that violated his right to privacy, which is unlawful and unfair to him. Likewise, that the Respondents’ utilized his information in a manner that is incompatible with the purpose for which they had it.
9. The Petitioner postulates that while the Interested Party’s determination was in his favour and does not dispute it, it was a mere slap on the Respondents wrists. According to him, the Respondents outright constitutional violation should not go unpunished. As such, he argues that the Respondents ought to compensate him in damages. He reasons that such a punitive imposition of liability will play a deterrent role to the Respondents who will then not engage in such behavior against other members of the public.
10. He stated that in a Penalty Notice dated 26th September 2023, the Interested Party in another matter, fined Mulla Pride Ltd, which operates KeCredit and Faircash digital credit facilities, Kshs. 2,975,000 for data breaches similar to the ones perpetrated by the Respondents herein.
11. In his case however, he stresses that the Respondents were not rendered a similar fate which would have been instrumental to accord them enough lessons to draw from. On this premise, he maintains that the Respondents should compensate him so as to fill this deterrent void left unfilled by the Interested Party.
1st Respondent’s case
12. The 1st Respondent in response filed a Notice of Preliminary Objection and Grounds of Opposition both dated 20th February 2024. The Preliminary Objection is premised on the ground that:
This Court lacks jurisdiction to hear and determine this suit as there is a prevailing judgment from the Office of the Data Protection Commissioner, rendering the suit res judicata as it was previously heard before a competent tribunal and determined on its merits.
13. Furthermore, the Grounds of Opposition is based on:
i. The Petition suffers from lack of particularity and focus to the extent that neither does it point out the provisions violated nor the nature of violation contrary to Rule 10 (1) (c) and (d) of the Constitution of Kenya (Protection of Rights and fundamental freedoms) Practice and procedure Rules, 2013.
ii. The Petitioner has submitted email communications as evidence, which were made on a without prejudice basis. This action is contrary to Section 23(1) of the Evidence Act, which states that in civil cases, no admission may be proven if it is made either upon an express condition that evidence of it is not to be given, or in circumstances from which the court can infer that the parties agreed together that evidence of it should not be given.
iii. The Petitioner has misdescribed the name of the 1st Respondent and joined an unknown party as an Interested Party in the Petition. This error is in violation of Rule 9 (d) (1) of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, which requires parties to correctly describe the Respondents and Interested Parties. The Petition is therefore defective and deserving to be struck out.
iv. The Petition vitiates the principle of constitutional avoidance. The Petitioner, knowing fully well that the 30 days'' timelines prescribed for lodging an appeal have lapsed, has filed the instant Petition as a means to circumvent the appeal process prescribed in sections 58 (2) (d) and 64 of the Data Protection Act. This is an abuse of the judicial process and undermines the finality of judgments. Allowing such a Petition to proceed would set a dangerous precedent and erode the integrity of the legal system.
v. The Petitioner has filed a verifying affidavit, witness statements, and a list of documents in contravention of Rule 11 of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013. The said rule stipulates that a Petition filed under these rules may be supported by an affidavit, and if a party wishes to rely on any document, the document shall be annexed to the supporting affidavit or the Petition where there is no supporting affidavit. The Petitioner''s failure to comply with this procedural requirement renders the Petition irregular and liable to be struck out.
vi. The Petition is defective, incompetent, misconceived, lacks merit, and constitutes an abuse of the Court process. The Petitioner''s rights and fundamental freedoms have neither been violated nor abused, rendering the Petition without basis or legal standing.
14. Furthermore, the 1st Respondent filed its Replying Affidavit through its legal officer, Emmanuel Bara Mutua sworn on 20th February 2024.
15. On the onset, he asserts that the issues raised in the Petition are the same as those that were raised before the Interested Party which culminated into the Ruling dated 2nd January 2024.He thus argues that the matter has already been heard on merit before the statutorily ordained institution.
16. He notes that the Petitioner as required by the law did not appeal the Interested Party’s decision but instead filed this suit which is in breach of the principle of constitutional avoidance. He postulates that this Petition was an afterthought on the Petitioner’s part.
17. He depones that while the Petitioner states that his family was harassed by the 1st Respondent, no evidence was adduced to support this claim. He adds that the Petitioner’s annexture from Dr. Onsando on his medical condition following his experience, is absurd as the condition of high blood pressure can be caused by various factors.
18. He stresses that evidence demonstrating that the high blood pressure was caused by the circumstances of this cases was not also adduced. That said, he notes that the law requires that a document be adduced by the maker, which in this case was not done by Dr. Onsando through an affidavit.
19. He depones that once the 1st Respondent received the Enforcement Notice from the Interested Party, it undertook to ensure compliance. In doing so, the 1st Respondent’s data protection officer, expunged the Petitioner’s information from its databases. Additionally, the legal team proceeded to prepare adequate policies and conduct trainings within the parameters set by the Interested Party.
2nd Respondent’s Case
20. The 2nd Respondent in reaction to the Petition also filed its Grounds of Opposition dated 11th March 2024 on the premise that:
i. The instant Petition is fatally defective in both substance and form and offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013.
ii. The Petition does not qualify as a constitutional matter as per the threshold in the case of Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272.
iii. A plain reading of the Petition clearly points to a disguised attempt to appeal against the Interested Party''s Enforcement Notice dated 2nd January 2024 which the Petitioner in his pleadings admits to be aggrieved by.
iv. The Petitioner can only approach this Court sitting on appeal against the decision of the Interested Party, or in exercise of its supervisory jurisdiction under Article 165 (3) and (6) of the Constitution to grant the prayers sought.
v. The instant Petition is an abuse of the Court process by attempting to open up a parallel regime for a party aggrieved by a decision of the Interested Party contrary to Section 64 of the Data Protection Act.
vi. It is an abuse of the Court process for the Petitioner to resort to a constitutional petition whereas there exists a clearly defined means of redress for a party aggrieved by a decision of the 1st Respondent.
vii. The Petition is therefore incompetent, fatally defective, misconceived and an abuse of Court process as it negates the well laid down principles and essence of Res Judicata in as far as it invokes this Court''s original and not appellate jurisdiction over a matter already determined by a competent judicial authority.
viii. The entire Petition is therefore incompetent and an abuse of the Court process and warrants to be dismissed with costs at the outset.
3rd Respondent’s Case
21. The 3rd Respondent through its Chief Executive Officer, Wycklife Ochola filed its Replying Affidavit sworn on 14th March 2024.
22. He states that this Court does not have jurisdiction to entertain this matter by dint of provisions in the Data Protection Act and Rule 14(3) of the Data Protection (Complainants Handling and Enforcement Procedures) Regulations, 2021. That is, the issuance of the necessary remedial measures including compensation are vested in the Interested Party.
23. For this reason, the Petition is deemed as a non-starter and an abuse of the Court process as it is an attempt to oust the Interested Party’s jurisdiction. He adds that since the Interested Party has the jurisdiction to make orders on a case by case basis, she is not required to issue a blanket order for compensation as advanced by the Petitioner.
24. For context, he depones that they received a letter dated 9th November 2023 from the Interested Party informing them of the complaint against them which they responded to on 23rd November 2023. In essence, the 3rd Respondent informed the Interested Party that they had advanced a loan of Ksh.90,000 to the Petitioner’s wife, Josephine Kwamboka Nyorera to boost her business.
25. It is said, that she repayed the loan faithfully for the first 4 weeks however defaulted on the fifth week. When their agents made a follow up at her shop, they found the Petitioner who introduced himself as her husband.
26. He depones that the Petitioner acknowledged that he was aware of the loan and committed to repay the same. He informs that the Petitioner on 19th September 2023, made a payment of Ksh.2000 via Mpesa using his safaricom line. In view of this, he states that the Petitioner voluntarily issued his number to them and so they continued to follow up on the payment of the loan which is done on a weekly basis.
27. He depones that the Petitioner undertook to repay the loan in three installments commencing on 27th November, 2023 which the 3rd Respondent agreed to. He stresses that the only reason the 3rd Respondent engaged the Petitioner was because he willingly took over his wife’s obligation to repay the loan. He adds that the Petitioner stated that since his wife was ailing he did not want her to be sued so he agreed to pay the loan.
28. He avers that once this matter was considered by the Interested Party, a decision was rendered and an Enforcement Notice issued. He depones that the Interested Party informed the parties of their right to appeal the decision to the High Court if grieved within 30 days. He informs that neither of the parties appealed the decision.
29. He depones that in compliance with the said decision, the 3rd Respondent executed the directives issued therein. Their compliance was further communicated to the Interested Party in their letter dated 19th February 2024. Additionally, through the same letter, they sought an extension to fully comply with the directive of training its staff members. This was allowed by the Interested Party in its response dated 20th February 2024. The training was subsequently conducted and 3rd Respondent issued with a Certificate for the same.
30. He further informs that as soon as they were notified on the complaint they ceased communicating with the Petitioner and deleted his information from their database. Likewise, he argues that the allegation of harassment of the Petitioner in their home is false.
Interested Party’s Case
31. On 5th April 2024, the Interested Party, through his Deputy, Oscar Otieno swore his Replying Affidavit in response to the Petition.
32. He confirms that the Petitioner’s complaint was filed on 5th October 2023 in accordance with the Data Protection Act. He discerns that the Petitioner in this matter is distressed since the Interested Party did not award him compensation as a remedy.
33. He notes that pursuant to Section 65 of the Data Protection Act as read together with Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulation,2021, compensation is one of the remedies that can be issued by the Interested Party based on the prayers sought and merits of the case.
34. He depones that the Petitioner in his complaint did not seek the remedy of compensation, he only prayed that the Respondents’ be stopped from contacting him over a loan he was not aware of. Upon considering the Petitioner’s case, he avers that the Interested Party determined that the Respondents had not complied with the provisions of the Act thus issued Enforcement Notices to them.
35. He stresses that the Interested Party processed the Petitioner’s complaint lawfully and made her determination on merit.
Petitioner’s Submissions
36. The Petitioner through Dr. Musikali Advocates LLP filed submissions dated 10th June 2024 and identified the issues as: whether the Petition satisfies the principle of specificity; whether this Court has jurisdiction to hear and determine the matter; whether the remedies available to the Petitioner under the Data Protection Act are effective enough; whether the Petitioner’s Constitutional rights were violated and whether the Respondents should pay the Petitioner damages for violations of his Constitutional rights.
37. On the first issue, Counsel submitted that the Petition satisfies the test set out in Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272.Counsel stated that the Petitioner in pleading his case had specified the constitutional right violated being Article 31(c) and (d) of the Constitution. In addition, it was noted that the Petitioner had set out the breached provisions under the Data Protection Act.
38. On the second issue, Counsel submitted that an appeal is not the only way to seek further redress from the Court following the determination by the Interested Party. Counsel noted that this is made manifest in various provisions such as Article 78 in Chapter VIII of The General Data Protection Regulation (GDPR). It emphasizes that an effective legal remedy is not automatically present whenever remedies are available under national law. Further reliance was placed in Schrems v Data Protection Commissioner, ECJ, C-362/14, 06 October 2015, § 95, where the European Court of Justice found that:
“the complete absence of “any possibility for an individual to pursue legal remedies…does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter”.
39. As such, Counsel argued that in the absence of the need for appeal by the Petitioner, the constitutional court was the most appropriate avenue for the Petitioner to seek further redress after the Interested Party’s determination. Considering this, Counsel relying in Article 165 of the Constitution submitted that this Court has jurisdiction to entertain suits on fundamental right and freedoms and grant appropriate reliefs under Article 22 of the Constitution.
40. Turning to the third issue, Counsel stated that the remedies available to the Petitioner under the Data Protection Act fall short in being effective for a number of reasons. First, they require the complainant to state the remedy sought and fails to inform the complainant of the remedies available to him. According to Counsel the availability of such remedies are not within the knowledge of a layman. For this reason, Counsel argued that the Interested Party’s claim that the Petitioner did not pray for compensation cannot suffice.
41. Furthermore, Counsel submitted that outsourcing enforcement solely to the Interested Party creates an illusion of control by data subjects. Equally, that the inconsistencies in the determinations issued by the Interested Party in various similar cases are also an indication of the inefficiencies of the remedies available under the Data Protection Act.
42. Counsel on this basis concluded that although there are remedies available to the Petitioner under the Data Protection Act and that the Interested Party followed due process in arriving at the determination, the said remedies fail the test of effectiveness in upholding the right to privacy as enshrined under Article 31 of the Constitution in view of the facts of this case.
43. On the next issue, Counsel maintained that it was evident that the Petitioner’s right under Article 31 of the Constitution had been violated by the Respondents. Reliance was placed in Kenya Human Rights Commission v Communications Authority of Kenya & 4 others [2018] eKLR where it was observed that:
“Privacy is a fundamental human right, enshrined in numerous international human rights instruments. It is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information, and association. The right to privacy embodies the presumption that individuals should have an area of autonomous development, interaction, and liberty, a “private sphere” with or without interaction with others, free from arbitrary state intervention and from excessive unsolicited intervention by other uninvited individuals. Activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.”
44. Additionally, Counsel submitted that the Respondents had put the Petitioner in danger of suffering further violations of his economic and social rights under Article 43 of the Constitution. This is especially so since loan defaulters in Kenya are listed in the Credit Reference Bureau (CRB) yet he did not take out the alleged loans.
45. On the fifth issue, Counsel submitted that a right without remedy is not a right at all and thus a right should be accompanied by a remedy for its breach as in this case. Counsel urged the Court not to let the outright disregard and contravention of the Petitioner’s right to privacy by the Respondents go unchecked especially since the Interested Party’s determination did not sufficiently punish and deter the Respondents from engaging in similar actions.
46. Reliance was placed in Peter Ndegwa Kiai t/a Pema Wines & Spirits v Attorney General & 2 others (Civil Appeal 243 of 2017) [2021] KECA 328 (KLR), where the Court held that:
“… Punitive damages primarily serve penal and deterrent functions in cases of gross constitutional violations, as well as vindicatory function.”
47. Like dependence was placed in Google Inc v Vidal-Hall [2015] EWCA Civ 311.
1st Respondent’s Submissions
48. The CR Advocates LLP on behalf of the 1st Respondent filled submissions dated 6th May 2024 and underscored the issues for determination as: whether this Court is clothed with the jurisdiction to hear and determine the issues raised in the instant petition and whether the Petitioner is entitled to compensation for the alleged violations.
49. To commence with Counsel relying in Speaker of National Assembly v Karume [1992] KLR 21 submitted that where there is a clear procedure for redress of any particular grievance prescribed by the Constitution or an Act of Parliament that procedure should be strictly followed. In this matter, Counsel recapping the procedure set out in the Data Protection Act when a complaint is lodged, submitted that Section 64 of the Act grants an aggrieved party the right to appeal against the decision of the Interested Party. Counsel noted that the Interested Party had informed the parties concerning this right during her determination however the Petitioner failed to pursue it.
50. Counsel pointed out that a constitutional petition should only focus on constitutional issues. Reliance was placed in Kweri v Beehive Media Limited; Capwel Industries Limited (Interested Party) [2023] KEHC 2684 (KLR) where it was held that:
“A Constitutional and Human Rights Court is supposed to exclusively deal with constitutional issues.
Courts have defined what constitutional issues are. In Fredricks & other v MEC for Education and Training, Eastern Cape & others (2002) 23 ILJ 81 (CC), the Constitutional Court of South Africa rightly so, delimited what a constitutional issue entails and the jurisdiction of a constitutional court as follows: -
The Constitution provides no definition of ‘constitutional matter’. What is a constitutional matter must be gleaned from a reading of the Constitution itself: if regard is had to the provisions of… Constitution, constitutional matters must include disputes as to whether any law or conduct is inconsistent with the Constitution, as well as issues concerning the status, powers and functions of an organ of State…. the interpretation, application and upholding of the Constitution are also constitutional issues. So too…is the question of the interpretation of any legislation or the development of the common law promotes the spirit, purport and object of the Bill of Rights. If regard is had to this and to the wide scope and application of the Bill of Rights, and to the other detailed provisions of the Constitution, such as the allocation of powers to various legislatures and structures of government, the jurisdiction vested in the constitutional court to determine constitutional matters and issues connected with decisions on constitutional matters is clearly on extensive jurisdiction…”
51. Counsel contended that instead of raising constitutional issues, the instant Petition solely focuses on the Petitioner’s dissatisfaction with the Interested Party’s decision on what he considers punitive damages. This in and of itself is argued not to be a valid ground for judicial review. As a consequence, it is argued that the Petition offends the doctrine of constitutional avoidance as the Petitioner failed to utilize his right to appeal the decision.
52. Reliance was placed in Mwanzia v Rhodes (Constitutional Petition E115 of 2022) [2023] KEHC 2688 (KLR) where it was held that:
“The data commissioner has the jurisdiction to determine whether the petitioner’s privacy rights in the Bill of Rights were denied, violated, infringed or threatened. The Commissioner has further powers to order appropriate compensation in the event of proof of the infringement.”
53. Taking this into consideration, Counsel submitted in the second point that the Petitioner was not entitled to the compensation sought. This is since the same is a preserve of the Interested Party as per Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, who may in her discretionary power issue remedies that are proportionate and appropriate. Moreover, Counsel submitted that the 1st Respondent had in its affidavit demonstrated that it complied with the orders issued by the Interested Party.
2nd Respondent’s Submissions
54. On 5th June 2024, the 2nd Respondent filed submissions through Mbugua Ng’ang’a and Company Advocates. Counsel sought to discuss: whether the Petition is competent and whether this Court has jurisdiction to entertain the suit.
55. On the first issue, Counsel submitted that the Petition is fatally defective in both substance and form as offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules and the principle in the case of Anarita Karimi Njeru (supra). v The Republic (1976-1980) KLR 1272. Like dependence was placed in Mumo Matemu v Trusted Society of Human Rights Alliance & 5 others [2013] eKLR.
56. Counsel stressed that the instant Petition neither discloses the constitutional provisions violated nor the nature of injury caused to the Petitioner by the Respondents and so the Petition falls short of the requirement for reasonable precision.
57. On the second issue, Counsel submitted that, Section 64 of the Data Protection Act provides for the right to appeal from the Interested Party’s decision before the High Court. Counsel submitted that the Petitioner is guilty of abusing the Court process as the instant Petition is a disguised attempt at appealing the Interested Party''s determination. Counsel contended that the Petitioner can only approach this Court sitting on appeal.
58. Furthermore, it was submitted that by invoking this Court''s original over a matter already determined by the Interested Party, the Petition negates the principle of Res Judicata. In light of this, Counsel stated that this Court does not have jurisdiction to entertain this suit.
59. Reliance was placed in Orange Democratic Movement v Yusuf Ali Mohamed & 5 others (2018]eKLR where it was held that:
“A party cannot through its pleadings confer jurisdiction to a court when none exists. In this context, a party cannot through draftsmanship and legal craftsmanship couch and convert an election petition into a constitutional petition and confer jurisdiction upon the High Court. Jurisdiction is conferred by law not through pleading and legal draftsmanship. It is both the substance of the claim and relief sought that determines the jurisdictional competence of a Court...”
60. Additional reliance was placed in Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (2023] KESC 113 (KLR).
3rd Respondents’ Submissions
61. The 3rd Respondent filed submissions dated 4th June 2024 through Senteu and Ndung’u Advocates and further submissions dated 3rd July 2024. Counsel discussed the jurisdiction of this Court to entertain this matter and whether the Petitioner''s claim is legally justiciable and whether it should be dismissed.
62. Counsel stated that the Data Protection Act empowers and mandates the Interested Party to receive complaints lodged by data subjects, investigate them and issue the necessary remedial measures and punishment. Counsel noted that in this matter, the Petitioner had lodged his complaint in line with the provisions of the Act. In the end, a decision was made in his favour and an Enforcement Notice issued to the 3rd Respondent.
63. It was contended that the Petitioner being aggrieved by the Interested Party’s failure to impose specific measures, he was required to appeal the same as per Section 64 of the Data Protection Act which he did not do. Likewise, it was argued that the order of compensation sought is a preserve of the Interested Party according to Rule 14(3) (e) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulation.
64. On this basis, Counsel submitted that the Petition is a non-starter and an abuse of the Court process as the Petitioner failed to follow the set procedure. Moreover, that the Petition is only meant to oust the discretionary power of the Interested Party. Counsel stressed thus that this Court can only sit as an appellate Court which the Petitioner ignored to pursue. This Court is adjudged to lack jurisdiction to entertain the matter as filed.
65. Reliance was placed in Anthony Miano & others vs. A.G & Others [2021] eKLR where it was held that:
“If no restriction or limit is imposed, the j
[...truncated]
1. The Petition dated 1st February 2024 is supported by the Petitioner’s verifying affidavit and witness statement of even date and a further supplementary affidavit sworn on 10th June 2024.
2. This Petition was aroused by the disaffection triggered by the nature of the relief that was granted by the Interested Party in a complaint that the Petitioner had lodged at the Interested Party against the Respondents. Accordingly, the Petitioner now seeks this Court’s affirmation that his right to privacy under Article 31 of the Constitution was violated by the Respondents and an award of compensation for the breach.
3. Consequently, the Petitioner seeks the following reliefs:
i. This Court finds the Respondents grossly in violation of the right to privacy set out under Article 31 of the Constitution.
ii. This Court orders the 1st Respondent to pay the Petitioner Four Million Kenyan Shillings (Kshs. 4,000,000) in damages.
iii. This Court orders the 2nd and 3rd Respondents to pay the Petitioner Two Million Nine Hundred and Seventy-Five Thousand Kenyan Shillings (Kshs. 2,975,000) each in damages.
iv. Costs be provided for.
Petitioner’s Case
4. The Petitioner stated that his wife took out loans with the Respondents. She defaulted in repayment of these loans. The Respondents then begun incessantly calling and texting the Petitioner using different numbers requiring him to repay the said loans yet he was not a guarantor or even being privy to the borrowing. He stated that these calls and threats were rude and aggressive.
5. The Petitioner depones that the Respondents actions caused him sleepless nights and great distress taking a toll on his health and emotional state. As a result, he sought medical assistance at Sinai Hospital at Rongai where it was discovered that he had fluctuating blood pressure and persistent headaches owing to the stress.
6. In addition, the Respondents invaded their matrimonial home to harass his family members and worker concerning the loans and slandering his family’s name.
7. Aggrieved by these actions, the Petitioner lodged his complaint with the Interested Party herein on 5th October 2023 via email. He depones that the Interested Party on 2nd January 2024 delivered a Ruling in his favour determining that:
i. The Respondents herein were found liable for unlawfully processing the Plaintiffs personal data.
ii. Enforcement Notices were issued against all the Respondents herein.
iii. Parties were given the right to appeal the Data Commissioner''s determination to the High Court of Kenya within thirty (30) days.
8. The Petitioner contends that the Respondents’ being in possession of his personal data, utilized it in a manner that violated his right to privacy, which is unlawful and unfair to him. Likewise, that the Respondents’ utilized his information in a manner that is incompatible with the purpose for which they had it.
9. The Petitioner postulates that while the Interested Party’s determination was in his favour and does not dispute it, it was a mere slap on the Respondents wrists. According to him, the Respondents outright constitutional violation should not go unpunished. As such, he argues that the Respondents ought to compensate him in damages. He reasons that such a punitive imposition of liability will play a deterrent role to the Respondents who will then not engage in such behavior against other members of the public.
10. He stated that in a Penalty Notice dated 26th September 2023, the Interested Party in another matter, fined Mulla Pride Ltd, which operates KeCredit and Faircash digital credit facilities, Kshs. 2,975,000 for data breaches similar to the ones perpetrated by the Respondents herein.
11. In his case however, he stresses that the Respondents were not rendered a similar fate which would have been instrumental to accord them enough lessons to draw from. On this premise, he maintains that the Respondents should compensate him so as to fill this deterrent void left unfilled by the Interested Party.
1st Respondent’s case
12. The 1st Respondent in response filed a Notice of Preliminary Objection and Grounds of Opposition both dated 20th February 2024. The Preliminary Objection is premised on the ground that:
This Court lacks jurisdiction to hear and determine this suit as there is a prevailing judgment from the Office of the Data Protection Commissioner, rendering the suit res judicata as it was previously heard before a competent tribunal and determined on its merits.
13. Furthermore, the Grounds of Opposition is based on:
i. The Petition suffers from lack of particularity and focus to the extent that neither does it point out the provisions violated nor the nature of violation contrary to Rule 10 (1) (c) and (d) of the Constitution of Kenya (Protection of Rights and fundamental freedoms) Practice and procedure Rules, 2013.
ii. The Petitioner has submitted email communications as evidence, which were made on a without prejudice basis. This action is contrary to Section 23(1) of the Evidence Act, which states that in civil cases, no admission may be proven if it is made either upon an express condition that evidence of it is not to be given, or in circumstances from which the court can infer that the parties agreed together that evidence of it should not be given.
iii. The Petitioner has misdescribed the name of the 1st Respondent and joined an unknown party as an Interested Party in the Petition. This error is in violation of Rule 9 (d) (1) of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, which requires parties to correctly describe the Respondents and Interested Parties. The Petition is therefore defective and deserving to be struck out.
iv. The Petition vitiates the principle of constitutional avoidance. The Petitioner, knowing fully well that the 30 days'' timelines prescribed for lodging an appeal have lapsed, has filed the instant Petition as a means to circumvent the appeal process prescribed in sections 58 (2) (d) and 64 of the Data Protection Act. This is an abuse of the judicial process and undermines the finality of judgments. Allowing such a Petition to proceed would set a dangerous precedent and erode the integrity of the legal system.
v. The Petitioner has filed a verifying affidavit, witness statements, and a list of documents in contravention of Rule 11 of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013. The said rule stipulates that a Petition filed under these rules may be supported by an affidavit, and if a party wishes to rely on any document, the document shall be annexed to the supporting affidavit or the Petition where there is no supporting affidavit. The Petitioner''s failure to comply with this procedural requirement renders the Petition irregular and liable to be struck out.
vi. The Petition is defective, incompetent, misconceived, lacks merit, and constitutes an abuse of the Court process. The Petitioner''s rights and fundamental freedoms have neither been violated nor abused, rendering the Petition without basis or legal standing.
14. Furthermore, the 1st Respondent filed its Replying Affidavit through its legal officer, Emmanuel Bara Mutua sworn on 20th February 2024.
15. On the onset, he asserts that the issues raised in the Petition are the same as those that were raised before the Interested Party which culminated into the Ruling dated 2nd January 2024.He thus argues that the matter has already been heard on merit before the statutorily ordained institution.
16. He notes that the Petitioner as required by the law did not appeal the Interested Party’s decision but instead filed this suit which is in breach of the principle of constitutional avoidance. He postulates that this Petition was an afterthought on the Petitioner’s part.
17. He depones that while the Petitioner states that his family was harassed by the 1st Respondent, no evidence was adduced to support this claim. He adds that the Petitioner’s annexture from Dr. Onsando on his medical condition following his experience, is absurd as the condition of high blood pressure can be caused by various factors.
18. He stresses that evidence demonstrating that the high blood pressure was caused by the circumstances of this cases was not also adduced. That said, he notes that the law requires that a document be adduced by the maker, which in this case was not done by Dr. Onsando through an affidavit.
19. He depones that once the 1st Respondent received the Enforcement Notice from the Interested Party, it undertook to ensure compliance. In doing so, the 1st Respondent’s data protection officer, expunged the Petitioner’s information from its databases. Additionally, the legal team proceeded to prepare adequate policies and conduct trainings within the parameters set by the Interested Party.
2nd Respondent’s Case
20. The 2nd Respondent in reaction to the Petition also filed its Grounds of Opposition dated 11th March 2024 on the premise that:
i. The instant Petition is fatally defective in both substance and form and offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013.
ii. The Petition does not qualify as a constitutional matter as per the threshold in the case of Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272.
iii. A plain reading of the Petition clearly points to a disguised attempt to appeal against the Interested Party''s Enforcement Notice dated 2nd January 2024 which the Petitioner in his pleadings admits to be aggrieved by.
iv. The Petitioner can only approach this Court sitting on appeal against the decision of the Interested Party, or in exercise of its supervisory jurisdiction under Article 165 (3) and (6) of the Constitution to grant the prayers sought.
v. The instant Petition is an abuse of the Court process by attempting to open up a parallel regime for a party aggrieved by a decision of the Interested Party contrary to Section 64 of the Data Protection Act.
vi. It is an abuse of the Court process for the Petitioner to resort to a constitutional petition whereas there exists a clearly defined means of redress for a party aggrieved by a decision of the 1st Respondent.
vii. The Petition is therefore incompetent, fatally defective, misconceived and an abuse of Court process as it negates the well laid down principles and essence of Res Judicata in as far as it invokes this Court''s original and not appellate jurisdiction over a matter already determined by a competent judicial authority.
viii. The entire Petition is therefore incompetent and an abuse of the Court process and warrants to be dismissed with costs at the outset.
3rd Respondent’s Case
21. The 3rd Respondent through its Chief Executive Officer, Wycklife Ochola filed its Replying Affidavit sworn on 14th March 2024.
22. He states that this Court does not have jurisdiction to entertain this matter by dint of provisions in the Data Protection Act and Rule 14(3) of the Data Protection (Complainants Handling and Enforcement Procedures) Regulations, 2021. That is, the issuance of the necessary remedial measures including compensation are vested in the Interested Party.
23. For this reason, the Petition is deemed as a non-starter and an abuse of the Court process as it is an attempt to oust the Interested Party’s jurisdiction. He adds that since the Interested Party has the jurisdiction to make orders on a case by case basis, she is not required to issue a blanket order for compensation as advanced by the Petitioner.
24. For context, he depones that they received a letter dated 9th November 2023 from the Interested Party informing them of the complaint against them which they responded to on 23rd November 2023. In essence, the 3rd Respondent informed the Interested Party that they had advanced a loan of Ksh.90,000 to the Petitioner’s wife, Josephine Kwamboka Nyorera to boost her business.
25. It is said, that she repayed the loan faithfully for the first 4 weeks however defaulted on the fifth week. When their agents made a follow up at her shop, they found the Petitioner who introduced himself as her husband.
26. He depones that the Petitioner acknowledged that he was aware of the loan and committed to repay the same. He informs that the Petitioner on 19th September 2023, made a payment of Ksh.2000 via Mpesa using his safaricom line. In view of this, he states that the Petitioner voluntarily issued his number to them and so they continued to follow up on the payment of the loan which is done on a weekly basis.
27. He depones that the Petitioner undertook to repay the loan in three installments commencing on 27th November, 2023 which the 3rd Respondent agreed to. He stresses that the only reason the 3rd Respondent engaged the Petitioner was because he willingly took over his wife’s obligation to repay the loan. He adds that the Petitioner stated that since his wife was ailing he did not want her to be sued so he agreed to pay the loan.
28. He avers that once this matter was considered by the Interested Party, a decision was rendered and an Enforcement Notice issued. He depones that the Interested Party informed the parties of their right to appeal the decision to the High Court if grieved within 30 days. He informs that neither of the parties appealed the decision.
29. He depones that in compliance with the said decision, the 3rd Respondent executed the directives issued therein. Their compliance was further communicated to the Interested Party in their letter dated 19th February 2024. Additionally, through the same letter, they sought an extension to fully comply with the directive of training its staff members. This was allowed by the Interested Party in its response dated 20th February 2024. The training was subsequently conducted and 3rd Respondent issued with a Certificate for the same.
30. He further informs that as soon as they were notified on the complaint they ceased communicating with the Petitioner and deleted his information from their database. Likewise, he argues that the allegation of harassment of the Petitioner in their home is false.
Interested Party’s Case
31. On 5th April 2024, the Interested Party, through his Deputy, Oscar Otieno swore his Replying Affidavit in response to the Petition.
32. He confirms that the Petitioner’s complaint was filed on 5th October 2023 in accordance with the Data Protection Act. He discerns that the Petitioner in this matter is distressed since the Interested Party did not award him compensation as a remedy.
33. He notes that pursuant to Section 65 of the Data Protection Act as read together with Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulation,2021, compensation is one of the remedies that can be issued by the Interested Party based on the prayers sought and merits of the case.
34. He depones that the Petitioner in his complaint did not seek the remedy of compensation, he only prayed that the Respondents’ be stopped from contacting him over a loan he was not aware of. Upon considering the Petitioner’s case, he avers that the Interested Party determined that the Respondents had not complied with the provisions of the Act thus issued Enforcement Notices to them.
35. He stresses that the Interested Party processed the Petitioner’s complaint lawfully and made her determination on merit.
Petitioner’s Submissions
36. The Petitioner through Dr. Musikali Advocates LLP filed submissions dated 10th June 2024 and identified the issues as: whether the Petition satisfies the principle of specificity; whether this Court has jurisdiction to hear and determine the matter; whether the remedies available to the Petitioner under the Data Protection Act are effective enough; whether the Petitioner’s Constitutional rights were violated and whether the Respondents should pay the Petitioner damages for violations of his Constitutional rights.
37. On the first issue, Counsel submitted that the Petition satisfies the test set out in Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272.Counsel stated that the Petitioner in pleading his case had specified the constitutional right violated being Article 31(c) and (d) of the Constitution. In addition, it was noted that the Petitioner had set out the breached provisions under the Data Protection Act.
38. On the second issue, Counsel submitted that an appeal is not the only way to seek further redress from the Court following the determination by the Interested Party. Counsel noted that this is made manifest in various provisions such as Article 78 in Chapter VIII of The General Data Protection Regulation (GDPR). It emphasizes that an effective legal remedy is not automatically present whenever remedies are available under national law. Further reliance was placed in Schrems v Data Protection Commissioner, ECJ, C-362/14, 06 October 2015, § 95, where the European Court of Justice found that:
“the complete absence of “any possibility for an individual to pursue legal remedies…does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter”.
39. As such, Counsel argued that in the absence of the need for appeal by the Petitioner, the constitutional court was the most appropriate avenue for the Petitioner to seek further redress after the Interested Party’s determination. Considering this, Counsel relying in Article 165 of the Constitution submitted that this Court has jurisdiction to entertain suits on fundamental right and freedoms and grant appropriate reliefs under Article 22 of the Constitution.
40. Turning to the third issue, Counsel stated that the remedies available to the Petitioner under the Data Protection Act fall short in being effective for a number of reasons. First, they require the complainant to state the remedy sought and fails to inform the complainant of the remedies available to him. According to Counsel the availability of such remedies are not within the knowledge of a layman. For this reason, Counsel argued that the Interested Party’s claim that the Petitioner did not pray for compensation cannot suffice.
41. Furthermore, Counsel submitted that outsourcing enforcement solely to the Interested Party creates an illusion of control by data subjects. Equally, that the inconsistencies in the determinations issued by the Interested Party in various similar cases are also an indication of the inefficiencies of the remedies available under the Data Protection Act.
42. Counsel on this basis concluded that although there are remedies available to the Petitioner under the Data Protection Act and that the Interested Party followed due process in arriving at the determination, the said remedies fail the test of effectiveness in upholding the right to privacy as enshrined under Article 31 of the Constitution in view of the facts of this case.
43. On the next issue, Counsel maintained that it was evident that the Petitioner’s right under Article 31 of the Constitution had been violated by the Respondents. Reliance was placed in Kenya Human Rights Commission v Communications Authority of Kenya & 4 others [2018] eKLR where it was observed that:
“Privacy is a fundamental human right, enshrined in numerous international human rights instruments. It is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information, and association. The right to privacy embodies the presumption that individuals should have an area of autonomous development, interaction, and liberty, a “private sphere” with or without interaction with others, free from arbitrary state intervention and from excessive unsolicited intervention by other uninvited individuals. Activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.”
44. Additionally, Counsel submitted that the Respondents had put the Petitioner in danger of suffering further violations of his economic and social rights under Article 43 of the Constitution. This is especially so since loan defaulters in Kenya are listed in the Credit Reference Bureau (CRB) yet he did not take out the alleged loans.
45. On the fifth issue, Counsel submitted that a right without remedy is not a right at all and thus a right should be accompanied by a remedy for its breach as in this case. Counsel urged the Court not to let the outright disregard and contravention of the Petitioner’s right to privacy by the Respondents go unchecked especially since the Interested Party’s determination did not sufficiently punish and deter the Respondents from engaging in similar actions.
46. Reliance was placed in Peter Ndegwa Kiai t/a Pema Wines & Spirits v Attorney General & 2 others (Civil Appeal 243 of 2017) [2021] KECA 328 (KLR), where the Court held that:
“… Punitive damages primarily serve penal and deterrent functions in cases of gross constitutional violations, as well as vindicatory function.”
47. Like dependence was placed in Google Inc v Vidal-Hall [2015] EWCA Civ 311.
1st Respondent’s Submissions
48. The CR Advocates LLP on behalf of the 1st Respondent filled submissions dated 6th May 2024 and underscored the issues for determination as: whether this Court is clothed with the jurisdiction to hear and determine the issues raised in the instant petition and whether the Petitioner is entitled to compensation for the alleged violations.
49. To commence with Counsel relying in Speaker of National Assembly v Karume [1992] KLR 21 submitted that where there is a clear procedure for redress of any particular grievance prescribed by the Constitution or an Act of Parliament that procedure should be strictly followed. In this matter, Counsel recapping the procedure set out in the Data Protection Act when a complaint is lodged, submitted that Section 64 of the Act grants an aggrieved party the right to appeal against the decision of the Interested Party. Counsel noted that the Interested Party had informed the parties concerning this right during her determination however the Petitioner failed to pursue it.
50. Counsel pointed out that a constitutional petition should only focus on constitutional issues. Reliance was placed in Kweri v Beehive Media Limited; Capwel Industries Limited (Interested Party) [2023] KEHC 2684 (KLR) where it was held that:
“A Constitutional and Human Rights Court is supposed to exclusively deal with constitutional issues.
Courts have defined what constitutional issues are. In Fredricks & other v MEC for Education and Training, Eastern Cape & others (2002) 23 ILJ 81 (CC), the Constitutional Court of South Africa rightly so, delimited what a constitutional issue entails and the jurisdiction of a constitutional court as follows: -
The Constitution provides no definition of ‘constitutional matter’. What is a constitutional matter must be gleaned from a reading of the Constitution itself: if regard is had to the provisions of… Constitution, constitutional matters must include disputes as to whether any law or conduct is inconsistent with the Constitution, as well as issues concerning the status, powers and functions of an organ of State…. the interpretation, application and upholding of the Constitution are also constitutional issues. So too…is the question of the interpretation of any legislation or the development of the common law promotes the spirit, purport and object of the Bill of Rights. If regard is had to this and to the wide scope and application of the Bill of Rights, and to the other detailed provisions of the Constitution, such as the allocation of powers to various legislatures and structures of government, the jurisdiction vested in the constitutional court to determine constitutional matters and issues connected with decisions on constitutional matters is clearly on extensive jurisdiction…”
51. Counsel contended that instead of raising constitutional issues, the instant Petition solely focuses on the Petitioner’s dissatisfaction with the Interested Party’s decision on what he considers punitive damages. This in and of itself is argued not to be a valid ground for judicial review. As a consequence, it is argued that the Petition offends the doctrine of constitutional avoidance as the Petitioner failed to utilize his right to appeal the decision.
52. Reliance was placed in Mwanzia v Rhodes (Constitutional Petition E115 of 2022) [2023] KEHC 2688 (KLR) where it was held that:
“The data commissioner has the jurisdiction to determine whether the petitioner’s privacy rights in the Bill of Rights were denied, violated, infringed or threatened. The Commissioner has further powers to order appropriate compensation in the event of proof of the infringement.”
53. Taking this into consideration, Counsel submitted in the second point that the Petitioner was not entitled to the compensation sought. This is since the same is a preserve of the Interested Party as per Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, who may in her discretionary power issue remedies that are proportionate and appropriate. Moreover, Counsel submitted that the 1st Respondent had in its affidavit demonstrated that it complied with the orders issued by the Interested Party.
2nd Respondent’s Submissions
54. On 5th June 2024, the 2nd Respondent filed submissions through Mbugua Ng’ang’a and Company Advocates. Counsel sought to discuss: whether the Petition is competent and whether this Court has jurisdiction to entertain the suit.
55. On the first issue, Counsel submitted that the Petition is fatally defective in both substance and form as offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules and the principle in the case of Anarita Karimi Njeru (supra). v The Republic (1976-1980) KLR 1272. Like dependence was placed in Mumo Matemu v Trusted Society of Human Rights Alliance & 5 others [2013] eKLR.
56. Counsel stressed that the instant Petition neither discloses the constitutional provisions violated nor the nature of injury caused to the Petitioner by the Respondents and so the Petition falls short of the requirement for reasonable precision.
57. On the second issue, Counsel submitted that, Section 64 of the Data Protection Act provides for the right to appeal from the Interested Party’s decision before the High Court. Counsel submitted that the Petitioner is guilty of abusing the Court process as the instant Petition is a disguised attempt at appealing the Interested Party''s determination. Counsel contended that the Petitioner can only approach this Court sitting on appeal.
58. Furthermore, it was submitted that by invoking this Court''s original over a matter already determined by the Interested Party, the Petition negates the principle of Res Judicata. In light of this, Counsel stated that this Court does not have jurisdiction to entertain this suit.
59. Reliance was placed in Orange Democratic Movement v Yusuf Ali Mohamed & 5 others (2018]eKLR where it was held that:
“A party cannot through its pleadings confer jurisdiction to a court when none exists. In this context, a party cannot through draftsmanship and legal craftsmanship couch and convert an election petition into a constitutional petition and confer jurisdiction upon the High Court. Jurisdiction is conferred by law not through pleading and legal draftsmanship. It is both the substance of the claim and relief sought that determines the jurisdictional competence of a Court...”
60. Additional reliance was placed in Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (2023] KESC 113 (KLR).
3rd Respondents’ Submissions
61. The 3rd Respondent filed submissions dated 4th June 2024 through Senteu and Ndung’u Advocates and further submissions dated 3rd July 2024. Counsel discussed the jurisdiction of this Court to entertain this matter and whether the Petitioner''s claim is legally justiciable and whether it should be dismissed.
62. Counsel stated that the Data Protection Act empowers and mandates the Interested Party to receive complaints lodged by data subjects, investigate them and issue the necessary remedial measures and punishment. Counsel noted that in this matter, the Petitioner had lodged his complaint in line with the provisions of the Act. In the end, a decision was made in his favour and an Enforcement Notice issued to the 3rd Respondent.
63. It was contended that the Petitioner being aggrieved by the Interested Party’s failure to impose specific measures, he was required to appeal the same as per Section 64 of the Data Protection Act which he did not do. Likewise, it was argued that the order of compensation sought is a preserve of the Interested Party according to Rule 14(3) (e) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulation.
64. On this basis, Counsel submitted that the Petition is a non-starter and an abuse of the Court process as the Petitioner failed to follow the set procedure. Moreover, that the Petition is only meant to oust the discretionary power of the Interested Party. Counsel stressed thus that this Court can only sit as an appellate Court which the Petitioner ignored to pursue. This Court is adjudged to lack jurisdiction to entertain the matter as filed.
65. Reliance was placed in Anthony Miano & others vs. A.G & Others [2021] eKLR where it was held that:
“If no restriction or limit is imposed, the j
[...truncated]