' REPUBLIC OF KENYA
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI LAW COURTS
CONSTITUTIONAL AND HUMAN RIGHTS DIVISION
PETITION NO. E466 OF 2022
SUZANNE SARDELLI……………………………………………1 ST PETITIONER
LINDA GARNER……………………………………………….2 ND PETITIONER
GILLIAN EDWARDS…………………………………………..3 RD PETITIONER
NICKI FARQUHARSON……………………………………….4 TH PETITIONER
LAELIA SURTEES………………………………………………5 TH PETITIONER
AISHA GROSS………………………………………………….6 TH PETITIONER
VERSUS
SAFARICOM PLC…………………………………………………RESPONDENT
JUDGMENT
Petition
The petitioners filed this petition against the respondent claiming violation of the right of access to information guaranteed under article 35 of the Constitution and section 4 of the Access to Information Act, 2016. The petition was supported by three affidavits sworn by the 1 st petitioner on 30 th September 2022; 21 st February 2023 and 15 th May 2024.
The facts giving rise to this litigation as can be seen from the affidavits, are that the petitioners registered sim cards holders with the respondent operate subscribed to the respondent’s M-pesa services. As registered, they enjoy protection of all constitutional rights and fundamental freedoms as subscribers and that they are citizens for purposes of article 35 of the Constitution.
On various dates between 16 th January 2021 and 4 th February 2022, the petitioners received phone calls from phone numbers 0720368399, 0702122777, 0706214162, 071106214162, 0711068888, 0718610066, 0111337430, 0202680030 and 0208004020. Those phone numbers fraudulently and unlawfully withdrew money from the petitioners’ M-peas and Fuliza accounts, leading to total a loss of Kshs. 1,707, 147.
The petitioners reported the matter to police at Timau Police Station on 21 st December 2021 -OB No. 13/21/12/2021; Karen Police Station on 25 th January 2022- OB No. 43/25/1/2022 and OB 033 ON 15 th January 2022. The petitioners also reported the fraud to their respective banks and to the respondent through its customer care and legal departments.
The petitioners stated that that upon reviewing the phone contacts, they discovered that the numbers had been used on numerous occasions despite having reported and flagged the numbers as being used by fraudsters. Despite bringing this fact to the respondent’s attention, no action was taken in breach of the respondent’s responsibilities as a trustee under its the terms and conditions as well as data protection policy.
On 14 th April 2022, the petitioners’ advocates wrote to the respondent seeking information regarding the perpetrators without any response. The petitioners stated that they intend to bring proceedings against the fraudsters but are unable to do so due to the respondent’s refusal supply information sought.
The petitioners maintained that this court has jurisdiction under article 23(1) as read with article 165(3) of the Constitution to hear and determine this petition and that they have locus to bring this petition to vindicate their rights. The petitioners denied the respondent’s claim that it has put in place comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data.
The petitioners maintained that they supplied information the respondent had requested through the respondent’s customer care such as the dates and time the fraudsters siphoned money from them but the information sought was not given necessitating the filing of this petition.
According to the petitioners, the information requested is on the details and contact numbers of fraudsters who siphoned money from their M-pesa and Fuliza accounts which is within the respondent’s possession; whether the numbers had been flagged and consequently blocked to avoid further fraudulent activity; names and identification card numbers of registered owners of those numbers and the registered names and numbers of the recipients of the money from the fraudulent transactions. The petitioners maintained that the request is reasonable and would only assist in conducting further investigations against the fraudsters.
The petitioners asserted that the request to access is specific to the fraudsters but not universal to all data held by the respondent. According to the petitioners, the respondent has not alleged that any of the phone numbers used to perpetuate fraud against them belongs to a different network service provider and therefore the information is within the respondent’s exclusive knowledge regarding the identity of the fraudsters.
Based on the above concerns, the petitioners sought the following reliefs:
A declaration that the failure by the respondent to provide information sought under article 35(1) of the Constitution of Kenya 2010 on the basis of the petitioners’ request dated 14 th April 2022 is a violation of the right of access to information.
An order compelling the respondent to forthwith provide the petitioners with the information sought in their letter dated 14 th April 2022 to wit:
The names and identification card numbers of the registered owners of the above mentioned numbers.
The names and telephone numbers of the registered recipients of fraudulent M-pesa transactions.
General, exemplary and aggravated damages under article 23(3) of the Constitution of Kenya 2010 for the unconstitutional conduct of the respondent
Costs of this petition.
Any other order that the court may deem fit to grant.
Response
The respondent opposed the petition through a preliminary objection on the jurisdiction of the court. The respondent asserted that the petition is premature because the petitioners did not exhaust the available alternative remedy under the Kenya Information Communications Act and Kenya Information and Communications (Dispute Resolution) Regulations, 2010; that the petition violates the arbitration agreement in clause 12 of the respondent’s and conditions for use of its services which mandates that all disputes between the respondent and its subscribers be resolved through arbitration under the arbitration Act.
The respondent also filed a replying affidavit sworn by Daniel M. Ndaba (Mr. Ndaba). The respondent again denied the jurisdiction of this court on the basis that it had been invoked prematurely since the petitioners should have presented their claim in accordance with the Kenya Information and Communications Act. Further, that the petitioners had failed to demonstrate that they are eligible to present a claim of the Constitution to access the information held by the respondent.
The respondent maintained that it is a data controller and processor under the Data Protection Act thus, takes data protection seriously and has implemented comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data.
The respondent asserted that it takes additional steps such as cautioning subscribers not to share confidential information with third parties; publicly providing information on how it engages with subscribers; numbers it uses, information it seeks or does not; sending fraud tips to create awareness on evolving scams; information on how transactions on Mpesa, Fuliza, PIN changes, and SIM swaps are properly completed, among others. The respondent further stated that it collaborates with security agencies to investigate subscribers that are alleged to be used in perpetrating fraud.
The respondent admitted that the petitioners are its subscribers and that it indeed received the demand letter. The respondent stated, however, that it responded to the petitioners’ demand on 29 th June 2022 and sought detailed and specific information, including dates and subscribers involved in the reported incidents but the petitioners did not supply the information sought instead proceeded to file this petition.
According to the respondent, the petition lacks clarity and substantiation on specific dates and time calls were made by each of the listed numbers to each of the petitioners; circumstances and details surrounding the transactions resulting in the alleged transfer of Kshs. 1,707,147 from Mpesa and Fuliza accounts and registration details of numbers 071106214162; 0202680030 and 0208004020.
The respondent contended that the petitioners had failed to demonstrate that disclosure of the information requested would not result in an unjustified intrusion into the privacy of its subscribers or that it will serve to safeguard or protect a constitutional right. The respondent took the view, that if the information sought is disclosed, it may be subjected to claims of releasing sensitive information and in a manner incompatible with the purposes for which information was collected under the Constitution, the Data Protection Act and the Kenya Information Communication Act.
The respondent denied breaching contractual terms or being negligent in preventing fraud. According to the respondent, the fraud and investigations team did not find abnormal activity on Sim cards; ownership of handsets used and confirmed proper verification of SIM swap interactions. The respondent denied liability for alleged losses.
Submissions
This petition was disposed of through written submissions with brief oral highlights.
Petitioners’ submissions
Mr. Gross, leading Mr. Ojiambo, for the petitioners, highlighting their written submissions, that the respondent violated the petitioners’ right of access to information guaranteed under Article 35 of the Constitution and sections 4 Access to Information Act.
Learned counsel argued that the petitioners were defrauded by the respondent’s subscribers which the respondent cannot deny, and relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another [2012] eKLR.
Learned counsel asserted that the respondent’s argument that the petition is premature had been abandoned in the submissions.
Learned counsel argued that the information sought is not universal to all data held by the respondent but specific to the fraudsters. In learned counsel’s view, the respondent had not denied that the phone numbers used to defraud the petitioners belonged to its subscribers thus, the information is within the respondent’s exclusive knowledge as to who the subscribers and therefore fraudsters are.
Mr. Cross submitted that the information was requested for purposes of instituting proceedings against the fraudsters and the respondent’s continued refusal to allow access to information warrants scrutiny; is a violation of the petitioners’ constitutional rights and the respondent had not shown that reasons for declining to allow access fall within the exceptions in section 6 of the Access to Information Act thus, the refusal is spurious. Learned counsel relied on the decision in Youth Initiative for Human Rights v Serbia (Application No. 48135/06).
Mr. Gross argued that Kenya Information Communications Act and the Regulations do not provide that making a report to the Tribunal is a condition precedent to invoking the jurisdiction of this court when dealing with a petition challenging constitutional violations. The regulations do not also oblige the petitioners to move the tribunal first before approaching this court.
Mr. Gross submitted that this court has unlimited jurisdiction under article 165 (3) (b) of the Constitution to determine the question whether a right or fundamental freedom in the Bill of Rights has been denied, violated, infringed or threatened. Counsel relied on the decision in Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested parties) [2022] KEHC 368 (KLR).
Regarding the petitioners’ locus to bring this petition, learned counsel argued that by virtue of article 24(3) of the Constitution the burden is on the respondent to demonstrate to the court why the information sought should not be accessed. Reliance was placed on Legal Advice Centre t/a Kituo Cha Sheria & 33 others v Cabinet Secretary, Ministry of Education & 7 others [2021] KEHC 390 (KLR).
Mr. Gross went on to argue that the respondent’s contention that disclosure of the information sought would result in an unjustified intrusion to privacy of subscribers was not substantiated. Learned counsel maintained that the petitioners provided details the respondent sought which was in their possession through their advocate such as phone calls and reports made to the respondent’s customer care. Learned counsel again relied on article 23(3) of the Constitution and the decisions in Siewchand Ramanoop v The Attorney General of Trinidad and Tobago , (PC Appeal No 13 of 2004) for the position that when exercising constitutional jurisdiction, the court is concerned with upholding or vindicating the constitutional right which has been contravened. A declaration by the court will articulate the fact of the violation, but in most cases, more will be required than words. If the person wronged has suffered damage, the court may award him compensation.
Learned counsel argued that the issue of citizenship should not arise since the respondent registered the subscribers and should know better. Data protection laws cannot oust the Constitution and refusing to supply information sought is offering protection to the fraudsters.
Respondent’s submissions
Miss. Opondo, learned counsel for the respondent submitted highlighting their written submissions, that although access to information is a constitutional right, the right is qualified. Counsel relied on article 35 of the Constitution, sections 2, 4 and 6(d) of Access to Information Act.
Learned counsel maintained that the right of access to information is not absolute: First, the respondent is not a state agency to justify allowing access to information under article 35(1) of the Constitution. Second, to enforce the right against a non-state entity, a citizen seeking to access information must demonstrate that the information is held by the entity in question and that the information sought is necessary for exercising or enforcing another right. Lastly, limitation is justified within article 24 of the Constitution.
Miss. Opondo maintained that the petitioners are not citizens for purposes of accessing information under article 35. Counsel relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another & 4 others (supra); Nairobi Law Monthly Company Limited Kenya Electricity Generating Company & 2 others [2013] eKLR; Timothy Njoya v Attorney General & another [2014] eKLR; and Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested Parties) [2022] KEHC 368 (KLR).
Learned counsel took the view, that providing information sought would disclose names and identification card numbers of registered subscribers of the mobile phone numbers which would violate customers’ right to privacy. Counsel maintained that the respondent has implemented technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data; that the respondent is bound by its data privacy statement whose clause 4 stipulates to whom it can disclose customer data and that the petitioners do not fall under the categories at clause 4.
Miss. Opondo again argued that disclosing the information sought would risk claims against the respondent for disclosing sensitive information and in a manner incompatible with the purposes for which that information was collected, thus, a violation of sections 25(a), 25(c), 25(d), 26(a)and 26(c) of the Data Protection Act; section 27A (2) of the Kenya Information and Communication Act as read with regulation 16(1) of the Kenya Information and Communication (Registration of SIM-Cards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
Learned counsel asserted that the respondent has been proactive in its efforts to reduce fraud and has taken steps to that effect. According to counsel, the respondent acted properly in declining to allow access to the information requested and urged the court to dismiss the petition with costs.
Determination
I have considered the pleadings, arguments made on behalf of the parties and the decisions relied on. The issues that arise for determination are whether this court has jurisdiction to preside over this petition and, depending on the answer to this issue, whether the petitioners’ right of access to information was violated and what reliefs to grant.
Jurisdiction
The respondent argued that the petitioners approached this court prematurely before exhausting the available alternative remedy provided for under the Kenya Information Communications Act and regulations made thereunder. In essence, the respondent’s objection is that this court cannot exercise jurisdiction to determine this petition where the available alternative remedy has not been exhausted.
The petitioners contended, on their part, that alternative remedy provisions cannot oust the jurisdiction of this court where the issue raised is on violation of constitutional rights. They therefore maintained that this court has jurisdiction to hear and determine this petition.
Jurisdiction is the power or authority given to a court to hear and determine a dispute presented before it. When jurisdiction of the court is in issue, the court has to carefully consider and determine this fundamental question of its jurisdiction over the matter. Whether a court has jurisdiction to hear a matter or not, is a threshold question to be determined based on the facts of the particular case before court and at the earliest opportunity.
Should the court determine that it has no jurisdiction to hear the matter, that is the end of the matter. The court should not take any further step, but down its tools. (See Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited [1989] eKLR).
In Samuel Kamau Macharia v Kenya Commercial Bank Ltd & 2 others [2012] eKLR, the Supreme Court stated:
[68] A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law…without jurisdiction, the Court cannot entertain any proceedings…Where the Constitution exhaustively provides for the jurisdiction of a Court of law, the Court must operate within the constitutional limits. It cannot expand its jurisdiction through judicial craft or innovation.
In re the Matter of the Interim Independent Electoral Commission (Applicant), Constitutional Application Number 2 of 2011 [2011] eKLR, the Supreme Court, after referring to the decision in Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited (supra), observed:
[30] The Lillian ‘S’ case establishes that jurisdiction flows from the law, and the recipient-Court is to apply the same, with any limitations embodied therein. Such a Court may not arrogate to itself jurisdiction through the craft of interpretation, or by way of endeavours to discern or interpret the intentions of Parliament, where the wording of legislation is clear and there is no ambiguity. In the case of the Supreme Court, Court of Appeal and High Court, their respective jurisdictions are donated by the Constitution.
It follows that jurisdiction of a court must flow from the Constitution, statute or both. The court should therefore only exercise jurisdiction as conferred on it by the Constitution or the law. It must not act without jurisdiction.
The respondent’s argument is that this court has no jurisdiction because the petitioners had an alternative remedy provided for under the Kenya Information and Communications Act and regulations made thereunder which they should have exhausted before invoking the jurisdiction of this court and therefore this Court should not hear the petition.
The objection, if I understand it, cannot be that this court has no jurisdiction to hear this petition. Rather, the respondent urges the court to decline to exercise its jurisdiction since the petitioners had not exhausted the available alternative remedy.
Section 9(2) and (3) of the Fair Administrative Action Act preclude this court from reviewing administrative decisions unless a party had exhausted all the remedies available. Section 6 of the Act provides that a person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision to a court in accordance with section 8; or a tribunal in exercise of its jurisdiction conferred in that regard under any written law.
Subsection (2) provides for the decisions the tribunal may make in reviewing the administrative action. Section 8 states that an application for the review of an administrative action or an appeal under the Act should be determined within ninety days of filing the application.
On the other hand, section 9(1) provides that subject to subsection (2), a person who is aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of any administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution. Subsection (2) states that the High Court or a subordinate court under subsection (1) should not review an administrative action or decision under the Act unless the mechanisms, including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted.
Under subsection (3), the High Court or a subordinate court should, if it is not satisfied that the remedies referred to in subsection (2) have been exhausted, direct an applicant to first exhaust such remedy before instituting proceedings under subsection (1).
Sub section (4) states that notwithstanding subsection (3), the High Court or a subordinate court may, in exceptional circumstances and on application, exempt such person from the obligation to exhaust any remedy if the court considers such exemption to be in the interest of justice.
The import of section 9(2) is that a person aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of an administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution after being satisfied that alternative remedies have been exhausted. If not, the court should direct the person to first exhaust such remedies before instituting proceedings before it.
The respondent argued that the Kenya Information and Communications Act, provides an alternative remedy for resolution of the petitioners’ grievances which they did not invoke. The request to access would also violate regulation 16(1) of the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
The petitioners’ position is that they approached this court raising a claim on constitutional violations which cannot be determined through an alternative remedy as the respondent argued. According to the petitioners, the respondent’s refusal to allow access to the information sought violated their right of access to information guaranteed under article 35 of the Constitution which this court has jurisdiction to remedy but not to any other body or tribunal.
Section 27A of the Kenya Information Communications Act is on the duties of telecommunications operators. Subsection (3) of the Act provides that notwithstanding the provisions of subsection (2) (c) (which requires that details of a subscriber be kept in secure and confidential manner), a telecommunications operator may disclose the registration particulars of a subscriber-
for the purpose of facilitating the performance of any statutory functions of the Authority;
In connection with the investigations of any criminal offence or for the purpose of any criminal proceedings; or
for the purpose of any civil proceedings under the Act.
Section 27A (3) (b)(c) seems to allow disclosure of particulars of a registered subscriber for purposes of criminal investigations or in case of civil proceedings, with regard to civil proceedings initiated under the Act.
Section 102 of the Act on the other hand establishes the Communications and Multimedia Appeals Tribunal, provides for its membership and the manner of its constitution. Section 102A provides for the complaints the Tribunal may consider while section 102F provides for appeals to the Tribunal. The petitioner’s claim is based on article 35 (1)(b) of the Constitution because of the respondent’s failure to allow their request to access information.
The respondent’s argument that the petitioners did not exhaust the available remedy under Kenya Information and Communications Act was not demonstrated. That is; the respondent did not identify the section that provided the petitioners with a remedy that would be effective to the petitioners’ case in so far as their request to access information was concerned. The respondents did not also show how the body would deal with the petitioners’ complaint on the decline to allow access.
The respondent made reference to section 16(1) of Kenya Information and Communication (Registration of SIM-Cards) Regulations, 2015 arguing that the request if acceded to would be violative to the regulations as well as regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
The respondents did not argue that the alternative remedy the petitioners should have invoked was efficient and effective in the circumstances of the petitioners’ case. The respondent did not also demonstrate how, if at all, that remedy would be effective to the petitioners’ claim. This court takes the view, that where the controversy is purely one raising constitutional violation, interpretation or violation of rights and fundamental freedoms, the issue should be decided by this court exercising its constitutional jurisdiction instead of dismissing the petition on ground of availability of an alternative remedy.
This view is informed by the fact that article 22 of the Constitution grants every person the right to institute court proceedings claiming that a right or fundamental freedom in the Bill of Rights has been denied, violated or infringed, or is threatened. Article 23 (1) as read with article 165(3) then confers on the court jurisdiction to hear and determine applications for redress of denial, violation or infringement of, or threat to, a right or fundamental freedom in the Bill of Rights while Article 23 (3) provides for remedies the court may grant in respect of proceedings brought under article 22.
Article 165(3) (b) provides that this court has jurisdiction to determine the question whether a right and fundamental freedom in the Bill of rights has been denied, violated, infringed or is threatened. Indeed, section 9(1) of the Fair Administrative Action Act acknowledges that original jurisdiction is conferred on this court. In that regard, everything else, including exhaustion of alternative remedy, is subject to the Constitution and not otherwise.
In R v National Environmental Management Authority , (CA No 84 of 2010); [2011] eKLR, the Court of Appeal observed that:
Where there was an alternative remedy and especially where Parliament had provided a statutory appeal procedure, it is only in exceptional circumstances that an order for judicial review would be granted, and that in determining whether an exception should be made and judicial review granted, it was necessary for the court to look carefully at the suitability of the statutory appeal in the context of the particular case and ask itself what, in the context of the statutory powers, was the real issue to be determined and whether the statutory appeal procedure was suitable to determine it.
In Albert Chaurembo Mumba & 7 others v Maurice Munyao & 148 others (Petition No. 3 of 2016), [2019] KESC 83 (KRL), the Supreme Court stated:
Where there exists an alternative method of dispute resolution established by legislation, courts must exercise restraint in exercising their jurisdiction as conferred by the Constitution and must give deference to the dispute resolution bodies established by statute with the mandate to deal with such specific disputes in the first instance.
In Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (Petition E007 of 2023), [2023] KESC 113 (KLR), the Supreme Court again stated:
[105] [T]he availability of an alternative remedy does not necessarily bar an individual from seeking constitutional relief. This is because the act of seeking constitutional relief is contingent upon the adequacy of an existing alternative means of redress. If the alternative remedy is deemed inadequate in addressing the issue at hand, then the court is not restrained from providing constitutional relief. But there is also a need to emphasize the need for the court to scrutinize the purpose for which a party is seeking relief, in determining whether the granting of such constitutional reliefs is appropriate in the given circumstances. This means that a nuanced approach to the relationship between constitutional reliefs for violation of rights and alternative means of redress, while also considering the specific circumstances of each case to determine the appropriateness of seeking such constitutional reliefs, is a necessary prerequisite on the part of any superior court.
Far afield, the Supreme of India observed in Union of India v. T.R. Vermai , 1957 AIR 882, 1958 SCR 499,
[...truncated]
IN THE HIGH COURT OF KENYA AT NAIROBI
MILIMANI LAW COURTS
CONSTITUTIONAL AND HUMAN RIGHTS DIVISION
PETITION NO. E466 OF 2022
SUZANNE SARDELLI……………………………………………1 ST PETITIONER
LINDA GARNER……………………………………………….2 ND PETITIONER
GILLIAN EDWARDS…………………………………………..3 RD PETITIONER
NICKI FARQUHARSON……………………………………….4 TH PETITIONER
LAELIA SURTEES………………………………………………5 TH PETITIONER
AISHA GROSS………………………………………………….6 TH PETITIONER
VERSUS
SAFARICOM PLC…………………………………………………RESPONDENT
JUDGMENT
Petition
The petitioners filed this petition against the respondent claiming violation of the right of access to information guaranteed under article 35 of the Constitution and section 4 of the Access to Information Act, 2016. The petition was supported by three affidavits sworn by the 1 st petitioner on 30 th September 2022; 21 st February 2023 and 15 th May 2024.
The facts giving rise to this litigation as can be seen from the affidavits, are that the petitioners registered sim cards holders with the respondent operate subscribed to the respondent’s M-pesa services. As registered, they enjoy protection of all constitutional rights and fundamental freedoms as subscribers and that they are citizens for purposes of article 35 of the Constitution.
On various dates between 16 th January 2021 and 4 th February 2022, the petitioners received phone calls from phone numbers 0720368399, 0702122777, 0706214162, 071106214162, 0711068888, 0718610066, 0111337430, 0202680030 and 0208004020. Those phone numbers fraudulently and unlawfully withdrew money from the petitioners’ M-peas and Fuliza accounts, leading to total a loss of Kshs. 1,707, 147.
The petitioners reported the matter to police at Timau Police Station on 21 st December 2021 -OB No. 13/21/12/2021; Karen Police Station on 25 th January 2022- OB No. 43/25/1/2022 and OB 033 ON 15 th January 2022. The petitioners also reported the fraud to their respective banks and to the respondent through its customer care and legal departments.
The petitioners stated that that upon reviewing the phone contacts, they discovered that the numbers had been used on numerous occasions despite having reported and flagged the numbers as being used by fraudsters. Despite bringing this fact to the respondent’s attention, no action was taken in breach of the respondent’s responsibilities as a trustee under its the terms and conditions as well as data protection policy.
On 14 th April 2022, the petitioners’ advocates wrote to the respondent seeking information regarding the perpetrators without any response. The petitioners stated that they intend to bring proceedings against the fraudsters but are unable to do so due to the respondent’s refusal supply information sought.
The petitioners maintained that this court has jurisdiction under article 23(1) as read with article 165(3) of the Constitution to hear and determine this petition and that they have locus to bring this petition to vindicate their rights. The petitioners denied the respondent’s claim that it has put in place comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data.
The petitioners maintained that they supplied information the respondent had requested through the respondent’s customer care such as the dates and time the fraudsters siphoned money from them but the information sought was not given necessitating the filing of this petition.
According to the petitioners, the information requested is on the details and contact numbers of fraudsters who siphoned money from their M-pesa and Fuliza accounts which is within the respondent’s possession; whether the numbers had been flagged and consequently blocked to avoid further fraudulent activity; names and identification card numbers of registered owners of those numbers and the registered names and numbers of the recipients of the money from the fraudulent transactions. The petitioners maintained that the request is reasonable and would only assist in conducting further investigations against the fraudsters.
The petitioners asserted that the request to access is specific to the fraudsters but not universal to all data held by the respondent. According to the petitioners, the respondent has not alleged that any of the phone numbers used to perpetuate fraud against them belongs to a different network service provider and therefore the information is within the respondent’s exclusive knowledge regarding the identity of the fraudsters.
Based on the above concerns, the petitioners sought the following reliefs:
A declaration that the failure by the respondent to provide information sought under article 35(1) of the Constitution of Kenya 2010 on the basis of the petitioners’ request dated 14 th April 2022 is a violation of the right of access to information.
An order compelling the respondent to forthwith provide the petitioners with the information sought in their letter dated 14 th April 2022 to wit:
The names and identification card numbers of the registered owners of the above mentioned numbers.
The names and telephone numbers of the registered recipients of fraudulent M-pesa transactions.
General, exemplary and aggravated damages under article 23(3) of the Constitution of Kenya 2010 for the unconstitutional conduct of the respondent
Costs of this petition.
Any other order that the court may deem fit to grant.
Response
The respondent opposed the petition through a preliminary objection on the jurisdiction of the court. The respondent asserted that the petition is premature because the petitioners did not exhaust the available alternative remedy under the Kenya Information Communications Act and Kenya Information and Communications (Dispute Resolution) Regulations, 2010; that the petition violates the arbitration agreement in clause 12 of the respondent’s and conditions for use of its services which mandates that all disputes between the respondent and its subscribers be resolved through arbitration under the arbitration Act.
The respondent also filed a replying affidavit sworn by Daniel M. Ndaba (Mr. Ndaba). The respondent again denied the jurisdiction of this court on the basis that it had been invoked prematurely since the petitioners should have presented their claim in accordance with the Kenya Information and Communications Act. Further, that the petitioners had failed to demonstrate that they are eligible to present a claim of the Constitution to access the information held by the respondent.
The respondent maintained that it is a data controller and processor under the Data Protection Act thus, takes data protection seriously and has implemented comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data.
The respondent asserted that it takes additional steps such as cautioning subscribers not to share confidential information with third parties; publicly providing information on how it engages with subscribers; numbers it uses, information it seeks or does not; sending fraud tips to create awareness on evolving scams; information on how transactions on Mpesa, Fuliza, PIN changes, and SIM swaps are properly completed, among others. The respondent further stated that it collaborates with security agencies to investigate subscribers that are alleged to be used in perpetrating fraud.
The respondent admitted that the petitioners are its subscribers and that it indeed received the demand letter. The respondent stated, however, that it responded to the petitioners’ demand on 29 th June 2022 and sought detailed and specific information, including dates and subscribers involved in the reported incidents but the petitioners did not supply the information sought instead proceeded to file this petition.
According to the respondent, the petition lacks clarity and substantiation on specific dates and time calls were made by each of the listed numbers to each of the petitioners; circumstances and details surrounding the transactions resulting in the alleged transfer of Kshs. 1,707,147 from Mpesa and Fuliza accounts and registration details of numbers 071106214162; 0202680030 and 0208004020.
The respondent contended that the petitioners had failed to demonstrate that disclosure of the information requested would not result in an unjustified intrusion into the privacy of its subscribers or that it will serve to safeguard or protect a constitutional right. The respondent took the view, that if the information sought is disclosed, it may be subjected to claims of releasing sensitive information and in a manner incompatible with the purposes for which information was collected under the Constitution, the Data Protection Act and the Kenya Information Communication Act.
The respondent denied breaching contractual terms or being negligent in preventing fraud. According to the respondent, the fraud and investigations team did not find abnormal activity on Sim cards; ownership of handsets used and confirmed proper verification of SIM swap interactions. The respondent denied liability for alleged losses.
Submissions
This petition was disposed of through written submissions with brief oral highlights.
Petitioners’ submissions
Mr. Gross, leading Mr. Ojiambo, for the petitioners, highlighting their written submissions, that the respondent violated the petitioners’ right of access to information guaranteed under Article 35 of the Constitution and sections 4 Access to Information Act.
Learned counsel argued that the petitioners were defrauded by the respondent’s subscribers which the respondent cannot deny, and relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another [2012] eKLR.
Learned counsel asserted that the respondent’s argument that the petition is premature had been abandoned in the submissions.
Learned counsel argued that the information sought is not universal to all data held by the respondent but specific to the fraudsters. In learned counsel’s view, the respondent had not denied that the phone numbers used to defraud the petitioners belonged to its subscribers thus, the information is within the respondent’s exclusive knowledge as to who the subscribers and therefore fraudsters are.
Mr. Cross submitted that the information was requested for purposes of instituting proceedings against the fraudsters and the respondent’s continued refusal to allow access to information warrants scrutiny; is a violation of the petitioners’ constitutional rights and the respondent had not shown that reasons for declining to allow access fall within the exceptions in section 6 of the Access to Information Act thus, the refusal is spurious. Learned counsel relied on the decision in Youth Initiative for Human Rights v Serbia (Application No. 48135/06).
Mr. Gross argued that Kenya Information Communications Act and the Regulations do not provide that making a report to the Tribunal is a condition precedent to invoking the jurisdiction of this court when dealing with a petition challenging constitutional violations. The regulations do not also oblige the petitioners to move the tribunal first before approaching this court.
Mr. Gross submitted that this court has unlimited jurisdiction under article 165 (3) (b) of the Constitution to determine the question whether a right or fundamental freedom in the Bill of Rights has been denied, violated, infringed or threatened. Counsel relied on the decision in Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested parties) [2022] KEHC 368 (KLR).
Regarding the petitioners’ locus to bring this petition, learned counsel argued that by virtue of article 24(3) of the Constitution the burden is on the respondent to demonstrate to the court why the information sought should not be accessed. Reliance was placed on Legal Advice Centre t/a Kituo Cha Sheria & 33 others v Cabinet Secretary, Ministry of Education & 7 others [2021] KEHC 390 (KLR).
Mr. Gross went on to argue that the respondent’s contention that disclosure of the information sought would result in an unjustified intrusion to privacy of subscribers was not substantiated. Learned counsel maintained that the petitioners provided details the respondent sought which was in their possession through their advocate such as phone calls and reports made to the respondent’s customer care. Learned counsel again relied on article 23(3) of the Constitution and the decisions in Siewchand Ramanoop v The Attorney General of Trinidad and Tobago , (PC Appeal No 13 of 2004) for the position that when exercising constitutional jurisdiction, the court is concerned with upholding or vindicating the constitutional right which has been contravened. A declaration by the court will articulate the fact of the violation, but in most cases, more will be required than words. If the person wronged has suffered damage, the court may award him compensation.
Learned counsel argued that the issue of citizenship should not arise since the respondent registered the subscribers and should know better. Data protection laws cannot oust the Constitution and refusing to supply information sought is offering protection to the fraudsters.
Respondent’s submissions
Miss. Opondo, learned counsel for the respondent submitted highlighting their written submissions, that although access to information is a constitutional right, the right is qualified. Counsel relied on article 35 of the Constitution, sections 2, 4 and 6(d) of Access to Information Act.
Learned counsel maintained that the right of access to information is not absolute: First, the respondent is not a state agency to justify allowing access to information under article 35(1) of the Constitution. Second, to enforce the right against a non-state entity, a citizen seeking to access information must demonstrate that the information is held by the entity in question and that the information sought is necessary for exercising or enforcing another right. Lastly, limitation is justified within article 24 of the Constitution.
Miss. Opondo maintained that the petitioners are not citizens for purposes of accessing information under article 35. Counsel relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another & 4 others (supra); Nairobi Law Monthly Company Limited Kenya Electricity Generating Company & 2 others [2013] eKLR; Timothy Njoya v Attorney General & another [2014] eKLR; and Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested Parties) [2022] KEHC 368 (KLR).
Learned counsel took the view, that providing information sought would disclose names and identification card numbers of registered subscribers of the mobile phone numbers which would violate customers’ right to privacy. Counsel maintained that the respondent has implemented technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data; that the respondent is bound by its data privacy statement whose clause 4 stipulates to whom it can disclose customer data and that the petitioners do not fall under the categories at clause 4.
Miss. Opondo again argued that disclosing the information sought would risk claims against the respondent for disclosing sensitive information and in a manner incompatible with the purposes for which that information was collected, thus, a violation of sections 25(a), 25(c), 25(d), 26(a)and 26(c) of the Data Protection Act; section 27A (2) of the Kenya Information and Communication Act as read with regulation 16(1) of the Kenya Information and Communication (Registration of SIM-Cards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
Learned counsel asserted that the respondent has been proactive in its efforts to reduce fraud and has taken steps to that effect. According to counsel, the respondent acted properly in declining to allow access to the information requested and urged the court to dismiss the petition with costs.
Determination
I have considered the pleadings, arguments made on behalf of the parties and the decisions relied on. The issues that arise for determination are whether this court has jurisdiction to preside over this petition and, depending on the answer to this issue, whether the petitioners’ right of access to information was violated and what reliefs to grant.
Jurisdiction
The respondent argued that the petitioners approached this court prematurely before exhausting the available alternative remedy provided for under the Kenya Information Communications Act and regulations made thereunder. In essence, the respondent’s objection is that this court cannot exercise jurisdiction to determine this petition where the available alternative remedy has not been exhausted.
The petitioners contended, on their part, that alternative remedy provisions cannot oust the jurisdiction of this court where the issue raised is on violation of constitutional rights. They therefore maintained that this court has jurisdiction to hear and determine this petition.
Jurisdiction is the power or authority given to a court to hear and determine a dispute presented before it. When jurisdiction of the court is in issue, the court has to carefully consider and determine this fundamental question of its jurisdiction over the matter. Whether a court has jurisdiction to hear a matter or not, is a threshold question to be determined based on the facts of the particular case before court and at the earliest opportunity.
Should the court determine that it has no jurisdiction to hear the matter, that is the end of the matter. The court should not take any further step, but down its tools. (See Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited [1989] eKLR).
In Samuel Kamau Macharia v Kenya Commercial Bank Ltd & 2 others [2012] eKLR, the Supreme Court stated:
[68] A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law…without jurisdiction, the Court cannot entertain any proceedings…Where the Constitution exhaustively provides for the jurisdiction of a Court of law, the Court must operate within the constitutional limits. It cannot expand its jurisdiction through judicial craft or innovation.
In re the Matter of the Interim Independent Electoral Commission (Applicant), Constitutional Application Number 2 of 2011 [2011] eKLR, the Supreme Court, after referring to the decision in Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited (supra), observed:
[30] The Lillian ‘S’ case establishes that jurisdiction flows from the law, and the recipient-Court is to apply the same, with any limitations embodied therein. Such a Court may not arrogate to itself jurisdiction through the craft of interpretation, or by way of endeavours to discern or interpret the intentions of Parliament, where the wording of legislation is clear and there is no ambiguity. In the case of the Supreme Court, Court of Appeal and High Court, their respective jurisdictions are donated by the Constitution.
It follows that jurisdiction of a court must flow from the Constitution, statute or both. The court should therefore only exercise jurisdiction as conferred on it by the Constitution or the law. It must not act without jurisdiction.
The respondent’s argument is that this court has no jurisdiction because the petitioners had an alternative remedy provided for under the Kenya Information and Communications Act and regulations made thereunder which they should have exhausted before invoking the jurisdiction of this court and therefore this Court should not hear the petition.
The objection, if I understand it, cannot be that this court has no jurisdiction to hear this petition. Rather, the respondent urges the court to decline to exercise its jurisdiction since the petitioners had not exhausted the available alternative remedy.
Section 9(2) and (3) of the Fair Administrative Action Act preclude this court from reviewing administrative decisions unless a party had exhausted all the remedies available. Section 6 of the Act provides that a person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision to a court in accordance with section 8; or a tribunal in exercise of its jurisdiction conferred in that regard under any written law.
Subsection (2) provides for the decisions the tribunal may make in reviewing the administrative action. Section 8 states that an application for the review of an administrative action or an appeal under the Act should be determined within ninety days of filing the application.
On the other hand, section 9(1) provides that subject to subsection (2), a person who is aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of any administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution. Subsection (2) states that the High Court or a subordinate court under subsection (1) should not review an administrative action or decision under the Act unless the mechanisms, including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted.
Under subsection (3), the High Court or a subordinate court should, if it is not satisfied that the remedies referred to in subsection (2) have been exhausted, direct an applicant to first exhaust such remedy before instituting proceedings under subsection (1).
Sub section (4) states that notwithstanding subsection (3), the High Court or a subordinate court may, in exceptional circumstances and on application, exempt such person from the obligation to exhaust any remedy if the court considers such exemption to be in the interest of justice.
The import of section 9(2) is that a person aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of an administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution after being satisfied that alternative remedies have been exhausted. If not, the court should direct the person to first exhaust such remedies before instituting proceedings before it.
The respondent argued that the Kenya Information and Communications Act, provides an alternative remedy for resolution of the petitioners’ grievances which they did not invoke. The request to access would also violate regulation 16(1) of the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
The petitioners’ position is that they approached this court raising a claim on constitutional violations which cannot be determined through an alternative remedy as the respondent argued. According to the petitioners, the respondent’s refusal to allow access to the information sought violated their right of access to information guaranteed under article 35 of the Constitution which this court has jurisdiction to remedy but not to any other body or tribunal.
Section 27A of the Kenya Information Communications Act is on the duties of telecommunications operators. Subsection (3) of the Act provides that notwithstanding the provisions of subsection (2) (c) (which requires that details of a subscriber be kept in secure and confidential manner), a telecommunications operator may disclose the registration particulars of a subscriber-
for the purpose of facilitating the performance of any statutory functions of the Authority;
In connection with the investigations of any criminal offence or for the purpose of any criminal proceedings; or
for the purpose of any civil proceedings under the Act.
Section 27A (3) (b)(c) seems to allow disclosure of particulars of a registered subscriber for purposes of criminal investigations or in case of civil proceedings, with regard to civil proceedings initiated under the Act.
Section 102 of the Act on the other hand establishes the Communications and Multimedia Appeals Tribunal, provides for its membership and the manner of its constitution. Section 102A provides for the complaints the Tribunal may consider while section 102F provides for appeals to the Tribunal. The petitioner’s claim is based on article 35 (1)(b) of the Constitution because of the respondent’s failure to allow their request to access information.
The respondent’s argument that the petitioners did not exhaust the available remedy under Kenya Information and Communications Act was not demonstrated. That is; the respondent did not identify the section that provided the petitioners with a remedy that would be effective to the petitioners’ case in so far as their request to access information was concerned. The respondents did not also show how the body would deal with the petitioners’ complaint on the decline to allow access.
The respondent made reference to section 16(1) of Kenya Information and Communication (Registration of SIM-Cards) Regulations, 2015 arguing that the request if acceded to would be violative to the regulations as well as regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010.
The respondents did not argue that the alternative remedy the petitioners should have invoked was efficient and effective in the circumstances of the petitioners’ case. The respondent did not also demonstrate how, if at all, that remedy would be effective to the petitioners’ claim. This court takes the view, that where the controversy is purely one raising constitutional violation, interpretation or violation of rights and fundamental freedoms, the issue should be decided by this court exercising its constitutional jurisdiction instead of dismissing the petition on ground of availability of an alternative remedy.
This view is informed by the fact that article 22 of the Constitution grants every person the right to institute court proceedings claiming that a right or fundamental freedom in the Bill of Rights has been denied, violated or infringed, or is threatened. Article 23 (1) as read with article 165(3) then confers on the court jurisdiction to hear and determine applications for redress of denial, violation or infringement of, or threat to, a right or fundamental freedom in the Bill of Rights while Article 23 (3) provides for remedies the court may grant in respect of proceedings brought under article 22.
Article 165(3) (b) provides that this court has jurisdiction to determine the question whether a right and fundamental freedom in the Bill of rights has been denied, violated, infringed or is threatened. Indeed, section 9(1) of the Fair Administrative Action Act acknowledges that original jurisdiction is conferred on this court. In that regard, everything else, including exhaustion of alternative remedy, is subject to the Constitution and not otherwise.
In R v National Environmental Management Authority , (CA No 84 of 2010); [2011] eKLR, the Court of Appeal observed that:
Where there was an alternative remedy and especially where Parliament had provided a statutory appeal procedure, it is only in exceptional circumstances that an order for judicial review would be granted, and that in determining whether an exception should be made and judicial review granted, it was necessary for the court to look carefully at the suitability of the statutory appeal in the context of the particular case and ask itself what, in the context of the statutory powers, was the real issue to be determined and whether the statutory appeal procedure was suitable to determine it.
In Albert Chaurembo Mumba & 7 others v Maurice Munyao & 148 others (Petition No. 3 of 2016), [2019] KESC 83 (KRL), the Supreme Court stated:
Where there exists an alternative method of dispute resolution established by legislation, courts must exercise restraint in exercising their jurisdiction as conferred by the Constitution and must give deference to the dispute resolution bodies established by statute with the mandate to deal with such specific disputes in the first instance.
In Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (Petition E007 of 2023), [2023] KESC 113 (KLR), the Supreme Court again stated:
[105] [T]he availability of an alternative remedy does not necessarily bar an individual from seeking constitutional relief. This is because the act of seeking constitutional relief is contingent upon the adequacy of an existing alternative means of redress. If the alternative remedy is deemed inadequate in addressing the issue at hand, then the court is not restrained from providing constitutional relief. But there is also a need to emphasize the need for the court to scrutinize the purpose for which a party is seeking relief, in determining whether the granting of such constitutional reliefs is appropriate in the given circumstances. This means that a nuanced approach to the relationship between constitutional reliefs for violation of rights and alternative means of redress, while also considering the specific circumstances of each case to determine the appropriateness of seeking such constitutional reliefs, is a necessary prerequisite on the part of any superior court.
Far afield, the Supreme of India observed in Union of India v. T.R. Vermai , 1957 AIR 882, 1958 SCR 499,
[...truncated]