1. Though the application dated 12.9.25 the Applicant is seeking orders:
1) That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of Certiorari to remove into this Honourable Court and quash the decision of the Respondent made on or about 13 March 2025, declining to admit and investigate the Applicant’s Complaint under the Data Protection Act, 2019.
2) That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of Mandamus compelling the Respondent to admit and investigate the Applicant’s complaint in accordance with its statutory mandate.
3) That the grant of leave herein do operate as a stay of the Respondent’s impugned decision pending the hearing and determination of the substantive Judicial Review application.
4) That the costs of and incidental to this application be provided for.
The Applicants case;
2. The Applicant lodged a Complaint with the Respondent against Family Bank Limited (“the Bank”) concerning the collection and processing of her personal data in the registration of a third-party Charge over her matrimonial property, without her knowledge or informed consent.
3. The Applicant subsequently discovered, following the borrower’s default that the Bank had collected and processed her personal data in the course of registering the Charge by relying on a National Identity Card that had earlier been replaced, and which was no longer valid at the time of registration. The Applicant does not know how the Bank came into possession of this document.
4. It is her case that while the Data Protection Act permits a data controller, in limited circumstances, to collect personal data from a source other than the data subject, it nonetheless imposes a mandatory obligation to inform the data subject of the manner of collection and to obtain her informed consent prior to processing. In the present case, the Bank neither notified the Applicant of the source of the data nor sought her consent before processing it according to her.
5. The Bank further relied on an affidavit of spousal consent to Charge purportedly executed by the Applicant. Upon review, the Applicant established that the handwriting and signature were not hers, she neither authored nor executed the affidavit; and notwithstanding this, her personal data was contained in the document and relied upon by the Bank.
6. These matters raised clear questions concerning lawfulness of processing, accuracy of personal data, valid consent; and adequacy of verification safeguards applied by the Bank as a data controller according to her.
7. The Applicant accordingly invoked the Respondent’s regulatory jurisdiction under the Act but The Respondent declined to admit or investigate the complaint.
8. In her further Affidavit she argues that the complaint lodged before the ODPC concerned inter alia Processing of personal data relating to alleged spousal consent, absence of express consent from the data subject, improper collection and use of personal data and refusal to grant access to the Charge and related personal data documents.
9. At the time of filing the present application for leave, there was pending before the Magistrates' Court at Kisumu, a dispute concerning the validity of the Charge instrument founded upon the alleged spousal consent.
10. It is her case that on the 15th January 2026, the Honourable Court in Kisumu MCELC E087 of 2023-Charles Ong'ana Apat v Family Bank Limited delivered a Ruling determining the validity of the said Charge where the Honourable Court found and held that the Charge over her matrimonial property was invalid and void for want of spousal consent confirming that no valid spousal consent was obtained and/or existed in respect of the impugned Charge transaction.
11. The ODPC in declining to admit and investigate the complaint cited, among other reasons, the existence of alleged criminal elements and declined to exercise jurisdiction.
12. It is her case that this development further demonstrates that the complaint raised before the ODPC concerns substantive data protection violations falling within its statutory mandate under the Data Protection Act.
13. The Applicant submits that at the leave stage, the Applicant is only required to demonstrate that the intended application discloses an arguable case, raises a matter falling within public law; and is not frivolous, vexatious, or an abuse of the Court’s process.
14. The Court does not determine the merits, weigh evidence, or resolve contested facts at this stage.
15. It suffices that the Applicant shows that there is a prima facie basis for judicial intervention.
16. She submits that the Respondent is established under the Act as the primary regulator responsible for oversight, enforcement, and promotion of compliance with data protection principles.
17. The Act expressly confers upon the Respondent powers to receive, admit, and investigate complaints relating to the processing of personal data conduct inquiries into alleged contraventions of the Act take regulatory and enforcement action where non-compliance is established.
18. The statutory scheme draws a clear distinction between regulatory and administrative oversight of data processing and criminal investigation and prosecution, which may arise only after or alongside regulatory findings.
19. She submits that complaints concerning consent, accuracy, lawful processing, and data controller compliance lie squarely within the Respondent’s core mandate.
20. The Applicant further submits that the intended judicial review raises clear and arguable public law errors, including failure to Exercise Statutory Power.
21. By declining to admit and investigate the Complaint, the Respondent failed to exercise a discretion conferred by statute.
22. The Respondent did not determine the Complaint on its regulatory merits but instead declined jurisdiction altogether.
23. The Respondent misdirected itself in law by treating the existence of alleged criminality as a basis for displacing its own regulatory function.
24. The Act does not permit the Respondent to abdicate its mandate merely because the facts may also disclose criminal conduct. Regulatory inquiry and criminal investigation are not mutually exclusive.
25. The Applicant submits that diverting the Applicant exclusively to the DCI, the Respondent effectively insulated a regulated entity from administrative scrutiny, contrary to the purpose and structure of the Act.
26. The Applicant discloses that the validity of the Charge over the property is the subject of separate proceedings before the Chief Magistrate’s Court at Kisumu.
27. Those proceedings concern proprietary and contractual questions relating to the Charge. They do not concern, and cannot substitute for, the Respondent’s statutory oversight of personal data processing.
28. It is submitted that the existence of parallel proceedings does not extinguish or diminish the Respondent’s obligations under the Act, nor does it bar this Court’s supervisory jurisdiction.
29. The Applicant’s Complaint raised prima facie issues of unlawful and inaccurate processing of personal data by a regulated data controller.
30. The Respondent’s refusal to admit and investigate that Complaint raises serious and arguable questions as to the scope of the Respondent’s mandate, the lawfulness of its decision-making process; and the protection afforded to data subjects under the Act.
The Respondents case:
31. The Office received the Applicant's complaint on 27 th November 2024 pursuant to Section 56 of the Act and Regulations 4 and 6 of the Enforcement Regulations.
32. The Applicant contends that her personal identification information was unlawfully obtained and used, and that her purported consent was fraudulently manufactured by forgery, including the preparation and filing of an affidavit of spousal consent purporting to bear her signature without her knowledge or authorization.
33. The Respondent conducted a preliminary review and, on 13th March 2025, recommended that she report the incident to the Directorate of Criminal Investigations (DCI) as the matter fell outside the Data Commissioner's mandate.
34. The Respondent derives its jurisdiction from the Act and its accompanying regulations. The Act allows a data subject or any person aggrieved by any matter under the Act to lodge a complaint with the Data Commissioner.
35. The Respondent undertook a preliminary review of the Applicant's complaint upon receipt on 13th March 2025.
36. Regulation 6 of the Enforcement Regulations sets out the steps the Data Commissioner may take after conducting a preliminary review of the complaint.
37. Regulation 6(2)(b) and (c) of the Enforcement Regulations permits the Data Commissioner to advise the Applicant in writing that the matters are neither within the Respondent's mandate nor for determination by another body or institution.
38. Under Regulation 6(3) of the Enforcement Regulations, the Data Commissioner may decline to admit a complaint that does not raise any issue under the Act.
39. The Applicant's contention that her handwriting and signature on the affidavit of spousal consent were fraudulently replicated and/or forged to charge her matrimonial property falls within the scope of Sections 345 to 362 of the Penal Code, Cap. 63, and, by extension, the First Schedule to the Criminal Procedure Code, Cap. 75.
40. Section 3 of the Criminal Procedure Code provides that all offences under the Penal Code, including forgery, must be investigated and tried in accordance with that Code.
41. Section 4 of the Criminal Procedure Code further provides that offences under the Penal Code may be tried by either the High Court or any subordinate court, as prescribed in the fifth column of the First Schedule.
42. The Respondent lacks jurisdiction to investigate allegations of forgery, the validity of charges, and matrimonial property issues.
43. The Applicant has not exhausted the procedures prescribed under the Act nor has she demonstrated any exceptional circumstances that would excuse her from the application of the doctrine of exhaustion.
44. The Respondent submits that the applicable law on leave to commence judicial review proceedings is Order 53, Rule 1 of the Civil Procedure Rules, which provides that no Application for judicial review orders should be made unless leave of the Court is sought and granted.
45. It is also trite that in an Application for leave, the Court ought not to delve into the parties' arguments but should make a cursory perusal of the evidence before the Court and decide whether an Applicant's case is sufficiently meritorious to justify leave.
46. Reliance is placed in In Republic v County Council of Kwale & another Exparte Kondo & 57 Others, Mombasa HCMCA No. 384 of 1996 and in Kihingo Village (Waridi Gardens) Management Limited v Attorney General & 2 others (Judicial Review 169 of 2023) [2023] KEHC 26714 (KLR) (Judicial Review) (20 December 2023) (Ruling)].
47. It is submitted that a cursory review of the Applicant's grounds and the list of annexures reveals a copy of the allegedly forged spousal consent relied upon to register a charge, together with a forensic document examiner's report.
48. These conflicting factual positions according to the Respondent cannot be resolved on affidavit evidence and require direct evidence and cross examination.
49. Reliance is placed on the case of Saisi & 7 others v Director of Public Prosecutions & 2 others [2023] KESC 6 (KLR), in which the Court held that judicial review is not intended to be a full-fledged inquiry into the merits of a matter.
50. The Court emphasized that the affidavit-based nature of evidence in judicial review does not permit the testing of disputed facts, which are better suited to trial proceedings involving testimony and cross-examination.
51. Judicial review is ill-suited to resolving disputed factual issues that require direct evidence and cross-examination, as held in Republic v Zacharia Kahuthu & another (Sued as Trustees of the Kenya Evangelical Lutheran Church) & another [2020] eKLR.
52. It is its case that the present application to proceed would improperly invite this Honourable Court to examine the merits of contested facts, contrary to established law.
53. It submits that the allegations that a charge over matrimonial property was registered under forged consent fall outside this Court's jurisdiction.
54. The Respondent draws this Honourable Court's attention to the structure of both the Act and the accompanying Regulations.
55. In Macharia & another v Kenya Commercial Bank Limited & 2 others [2012] KESC 8 (KLR) at paragraph 68, the Respondent derives its jurisdiction from the Act and the accompanying regulations.
56. It submits that it is uncontroverted that the Respondent's mandate under the Act includes receiving and investigating complaints as part of regulating the processing of personal data.
57. To further give effect to the Act, Regulation 6 of the Enforcement Regulations sets out a wide range of steps the Data Commissioner may take following a preliminary review of a complaint.
58. Regulation 6(2)(b) and (c) of the Enforcement Regulations permits the Data Commissioner to advise the Applicant in writing that the matters are neither within the Respondent's mandate nor for determination by another body or institution.
59. It argues that the Applicant's contention that her handwriting and signature on the affidavit of spousal consent were fraudulently replicated and/or forged to charge her matrimonial property, which falls within the scope of Sections 345 to 362 of the Penal Code, Cap. 63, and, by extension, the First Schedule of the Criminal Procedure Code, Cap. 75.
60. The Respondent lacks jurisdiction to investigate such matters under the Act by virtue of Sections 3 and 4 of the Civil Procedure Code.
61. The Respondent submits that granting the orders sought will ultimately achieve nothing, as the particulars of the Applicant's complaint fall outside the Respondent's mandate.
62. The Respondent lacks jurisdiction to investigate allegations of forgery, the validity of charges, and matrimonial property matters.
63. In the case of Nasieku Tarayia vs Board of Directors, Agricultural Finance Corporation & Anoe [2012] eKLR, which held that judicial review is an alternative remedy of last resort. Where alternative remedies exist, the court must be satisfied that judicial review is the more convenient, beneficial, and efficacious remedy before granting leave.
64. It submits that Section 64 of the Act provides that a person against whom any administrative action is taken by the Data Commissioner, including any enforcement and penalty notices, may appeal to the High Court.
65. The Applicant has neither lodged an appeal to the High Court nor shown that she attempted to do so but was unable to.
66. Section 9(2) and (4) of the Fair Administrative Actions Act, 2015, which preclude the High Court or any other subordinate Court from reviewing an administrative action or decision under the Fair Administrative Actions Act, 2015, in matters where a party has not exhausted internal remedies, except where exceptional circumstances for exemption are established.
67. Reliance is placed in the case of Clifford Kenya v Jackline Ingutiah & 5 others; Atieno Aoko & 3 others (Interested Party) [2022] eKLR, by the Court of Appeal in Speaker of National Assembly v Karume, Civil Application No. NAI 92 of 1992, and by this Honourable Court in Ceres Tech Limited v Commissioner, Office of the Data Protection Commissioner [2024] KEHC 12833 (KLR).
68. In the present case, it is clear that there is an alternative and satisfactory remedy for the Applicant's complaint.
69. The Respondent maintains that the Applicant has adequate alternative remedies and that the Applicant's allegations are unfounded, misdirected, and based on disputed facts unsuitable for determination in judicial review.
70. The Applicant lacks a prima facie case entitling them to leave to file judicial review proceedings, and invites this Court to consider that position.
Analysis and Determination;
The issue for determination is whether or not the Applicant has made out a case for the grant of the orders sought.
71. The applicable law on leave to commence judicial review proceedings is Order 53 Rule 1 of the Civil Procedure Rules, which provides that no Application for judicial review orders should be made unless leave of the court was sought and granted.
72. The reason for the leave was explained by Waki J (as he then was), in Republic v County Council of Kwale & Another Ex Parte Kondo & 57 Others, Mombasa HCMCA No. 384 of 1996 as follows:
“The purpose of Application for leave to apply for judicial review is firstly to eliminate at an early stage any Applications for judicial review which are either frivolous, vexatious or hopeless and secondly to ensure that the Applicant is only allowed to proceed to substantive hearing if the Court is satisfied that there is a case fit for further consideration. The requirement that leave must be obtained before making an Application for judicial review is designed to prevent the time of the court being wasted by busy bodies with misguided or trivial complaints or administrative error, and to remove the uncertainty in which public officers and authorities might be left as to whether they could safely proceed with administrative action while proceedings for judicial review of it were actually pending even though misconceived…Leave may only be granted therefore if on the material available the court is of the view, without going into the matter in depth, that there is an arguable case for granting the relief claimed by the Applicant the test being whether there is a case fit for further investigation at a full inter partes hearing of the substantive Application for judicial review. It is an exercise of the court’s discretion but as always it has to be exercised judicially”.
73. It is also trite that in an Application for leave, the Court ought not to delve deeply into the arguments of the parties, but should make cursory perusal of the evidence before court and make the decision as to whether an Applicant’s case is sufficiently meritorious to justify leave.
74. In Uwe Meixner & another v Attorney General [2005] eKLR, it was held that the leave of court is a prerequisite to making a substantive Application for Judicial Review with a view to filtering out frivolous Applications and the grant or refusal involves an exercise of judicial discretion and the test to be applied is whether the Applicant has an arguable case. Thus, the first step in the Judicial Review procedure involves the mandatory "leave stage." At this stage an Application for leave to bring Judicial Review proceedings must first be made. The leave stage as held by Waki J is used to identify and filter out, at an early stage, claims which may be trivial or without merit.
75. In Republic v National Transport & Safety Authority & 10 others [20141 eKLR, in Kihingo Village (Waridi Gardens) Management Limited v Attorney General & 2 others (Judicial Review 169 of 2023) [20231 KEHC 26714 (KLR) (Judicial Review) (20 December 2023) (Ruling) in granting leave to the Applicant to file judicial review it was held that;
“I have carefully perused through the record and submissions a prima facie case is established to warrant the grant of the leave sought.”
76. The Applicant has made out a prima facie case that has to be heard on merit.
Disposition;
77. The Applicant has made out a prima case that justifies the grant of the orders sought.
Order;
1) The Application is allowed.
2) The Applicant shall file and serve the substantive suit within 14 days which shall be in a separate file.
3) The Respondent file and serve their responses within 14 days of the date of service of the Application.
4) The Applicant shall thereafter file and serve submissions within 7 days of the date of service.
5) The Respondent shall file and serve submissions within 7 days thereafter.
6) This file is closed.
Dated, signed and delivered at Nairobi this 27th day of February, 2026.
1) That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of Certiorari to remove into this Honourable Court and quash the decision of the Respondent made on or about 13 March 2025, declining to admit and investigate the Applicant’s Complaint under the Data Protection Act, 2019.
2) That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of Mandamus compelling the Respondent to admit and investigate the Applicant’s complaint in accordance with its statutory mandate.
3) That the grant of leave herein do operate as a stay of the Respondent’s impugned decision pending the hearing and determination of the substantive Judicial Review application.
4) That the costs of and incidental to this application be provided for.
The Applicants case;
2. The Applicant lodged a Complaint with the Respondent against Family Bank Limited (“the Bank”) concerning the collection and processing of her personal data in the registration of a third-party Charge over her matrimonial property, without her knowledge or informed consent.
3. The Applicant subsequently discovered, following the borrower’s default that the Bank had collected and processed her personal data in the course of registering the Charge by relying on a National Identity Card that had earlier been replaced, and which was no longer valid at the time of registration. The Applicant does not know how the Bank came into possession of this document.
4. It is her case that while the Data Protection Act permits a data controller, in limited circumstances, to collect personal data from a source other than the data subject, it nonetheless imposes a mandatory obligation to inform the data subject of the manner of collection and to obtain her informed consent prior to processing. In the present case, the Bank neither notified the Applicant of the source of the data nor sought her consent before processing it according to her.
5. The Bank further relied on an affidavit of spousal consent to Charge purportedly executed by the Applicant. Upon review, the Applicant established that the handwriting and signature were not hers, she neither authored nor executed the affidavit; and notwithstanding this, her personal data was contained in the document and relied upon by the Bank.
6. These matters raised clear questions concerning lawfulness of processing, accuracy of personal data, valid consent; and adequacy of verification safeguards applied by the Bank as a data controller according to her.
7. The Applicant accordingly invoked the Respondent’s regulatory jurisdiction under the Act but The Respondent declined to admit or investigate the complaint.
8. In her further Affidavit she argues that the complaint lodged before the ODPC concerned inter alia Processing of personal data relating to alleged spousal consent, absence of express consent from the data subject, improper collection and use of personal data and refusal to grant access to the Charge and related personal data documents.
9. At the time of filing the present application for leave, there was pending before the Magistrates' Court at Kisumu, a dispute concerning the validity of the Charge instrument founded upon the alleged spousal consent.
10. It is her case that on the 15th January 2026, the Honourable Court in Kisumu MCELC E087 of 2023-Charles Ong'ana Apat v Family Bank Limited delivered a Ruling determining the validity of the said Charge where the Honourable Court found and held that the Charge over her matrimonial property was invalid and void for want of spousal consent confirming that no valid spousal consent was obtained and/or existed in respect of the impugned Charge transaction.
11. The ODPC in declining to admit and investigate the complaint cited, among other reasons, the existence of alleged criminal elements and declined to exercise jurisdiction.
12. It is her case that this development further demonstrates that the complaint raised before the ODPC concerns substantive data protection violations falling within its statutory mandate under the Data Protection Act.
13. The Applicant submits that at the leave stage, the Applicant is only required to demonstrate that the intended application discloses an arguable case, raises a matter falling within public law; and is not frivolous, vexatious, or an abuse of the Court’s process.
14. The Court does not determine the merits, weigh evidence, or resolve contested facts at this stage.
15. It suffices that the Applicant shows that there is a prima facie basis for judicial intervention.
16. She submits that the Respondent is established under the Act as the primary regulator responsible for oversight, enforcement, and promotion of compliance with data protection principles.
17. The Act expressly confers upon the Respondent powers to receive, admit, and investigate complaints relating to the processing of personal data conduct inquiries into alleged contraventions of the Act take regulatory and enforcement action where non-compliance is established.
18. The statutory scheme draws a clear distinction between regulatory and administrative oversight of data processing and criminal investigation and prosecution, which may arise only after or alongside regulatory findings.
19. She submits that complaints concerning consent, accuracy, lawful processing, and data controller compliance lie squarely within the Respondent’s core mandate.
20. The Applicant further submits that the intended judicial review raises clear and arguable public law errors, including failure to Exercise Statutory Power.
21. By declining to admit and investigate the Complaint, the Respondent failed to exercise a discretion conferred by statute.
22. The Respondent did not determine the Complaint on its regulatory merits but instead declined jurisdiction altogether.
23. The Respondent misdirected itself in law by treating the existence of alleged criminality as a basis for displacing its own regulatory function.
24. The Act does not permit the Respondent to abdicate its mandate merely because the facts may also disclose criminal conduct. Regulatory inquiry and criminal investigation are not mutually exclusive.
25. The Applicant submits that diverting the Applicant exclusively to the DCI, the Respondent effectively insulated a regulated entity from administrative scrutiny, contrary to the purpose and structure of the Act.
26. The Applicant discloses that the validity of the Charge over the property is the subject of separate proceedings before the Chief Magistrate’s Court at Kisumu.
27. Those proceedings concern proprietary and contractual questions relating to the Charge. They do not concern, and cannot substitute for, the Respondent’s statutory oversight of personal data processing.
28. It is submitted that the existence of parallel proceedings does not extinguish or diminish the Respondent’s obligations under the Act, nor does it bar this Court’s supervisory jurisdiction.
29. The Applicant’s Complaint raised prima facie issues of unlawful and inaccurate processing of personal data by a regulated data controller.
30. The Respondent’s refusal to admit and investigate that Complaint raises serious and arguable questions as to the scope of the Respondent’s mandate, the lawfulness of its decision-making process; and the protection afforded to data subjects under the Act.
The Respondents case:
31. The Office received the Applicant's complaint on 27 th November 2024 pursuant to Section 56 of the Act and Regulations 4 and 6 of the Enforcement Regulations.
32. The Applicant contends that her personal identification information was unlawfully obtained and used, and that her purported consent was fraudulently manufactured by forgery, including the preparation and filing of an affidavit of spousal consent purporting to bear her signature without her knowledge or authorization.
33. The Respondent conducted a preliminary review and, on 13th March 2025, recommended that she report the incident to the Directorate of Criminal Investigations (DCI) as the matter fell outside the Data Commissioner's mandate.
34. The Respondent derives its jurisdiction from the Act and its accompanying regulations. The Act allows a data subject or any person aggrieved by any matter under the Act to lodge a complaint with the Data Commissioner.
35. The Respondent undertook a preliminary review of the Applicant's complaint upon receipt on 13th March 2025.
36. Regulation 6 of the Enforcement Regulations sets out the steps the Data Commissioner may take after conducting a preliminary review of the complaint.
37. Regulation 6(2)(b) and (c) of the Enforcement Regulations permits the Data Commissioner to advise the Applicant in writing that the matters are neither within the Respondent's mandate nor for determination by another body or institution.
38. Under Regulation 6(3) of the Enforcement Regulations, the Data Commissioner may decline to admit a complaint that does not raise any issue under the Act.
39. The Applicant's contention that her handwriting and signature on the affidavit of spousal consent were fraudulently replicated and/or forged to charge her matrimonial property falls within the scope of Sections 345 to 362 of the Penal Code, Cap. 63, and, by extension, the First Schedule to the Criminal Procedure Code, Cap. 75.
40. Section 3 of the Criminal Procedure Code provides that all offences under the Penal Code, including forgery, must be investigated and tried in accordance with that Code.
41. Section 4 of the Criminal Procedure Code further provides that offences under the Penal Code may be tried by either the High Court or any subordinate court, as prescribed in the fifth column of the First Schedule.
42. The Respondent lacks jurisdiction to investigate allegations of forgery, the validity of charges, and matrimonial property issues.
43. The Applicant has not exhausted the procedures prescribed under the Act nor has she demonstrated any exceptional circumstances that would excuse her from the application of the doctrine of exhaustion.
44. The Respondent submits that the applicable law on leave to commence judicial review proceedings is Order 53, Rule 1 of the Civil Procedure Rules, which provides that no Application for judicial review orders should be made unless leave of the Court is sought and granted.
45. It is also trite that in an Application for leave, the Court ought not to delve into the parties' arguments but should make a cursory perusal of the evidence before the Court and decide whether an Applicant's case is sufficiently meritorious to justify leave.
46. Reliance is placed in In Republic v County Council of Kwale & another Exparte Kondo & 57 Others, Mombasa HCMCA No. 384 of 1996 and in Kihingo Village (Waridi Gardens) Management Limited v Attorney General & 2 others (Judicial Review 169 of 2023) [2023] KEHC 26714 (KLR) (Judicial Review) (20 December 2023) (Ruling)].
47. It is submitted that a cursory review of the Applicant's grounds and the list of annexures reveals a copy of the allegedly forged spousal consent relied upon to register a charge, together with a forensic document examiner's report.
48. These conflicting factual positions according to the Respondent cannot be resolved on affidavit evidence and require direct evidence and cross examination.
49. Reliance is placed on the case of Saisi & 7 others v Director of Public Prosecutions & 2 others [2023] KESC 6 (KLR), in which the Court held that judicial review is not intended to be a full-fledged inquiry into the merits of a matter.
50. The Court emphasized that the affidavit-based nature of evidence in judicial review does not permit the testing of disputed facts, which are better suited to trial proceedings involving testimony and cross-examination.
51. Judicial review is ill-suited to resolving disputed factual issues that require direct evidence and cross-examination, as held in Republic v Zacharia Kahuthu & another (Sued as Trustees of the Kenya Evangelical Lutheran Church) & another [2020] eKLR.
52. It is its case that the present application to proceed would improperly invite this Honourable Court to examine the merits of contested facts, contrary to established law.
53. It submits that the allegations that a charge over matrimonial property was registered under forged consent fall outside this Court's jurisdiction.
54. The Respondent draws this Honourable Court's attention to the structure of both the Act and the accompanying Regulations.
55. In Macharia & another v Kenya Commercial Bank Limited & 2 others [2012] KESC 8 (KLR) at paragraph 68, the Respondent derives its jurisdiction from the Act and the accompanying regulations.
56. It submits that it is uncontroverted that the Respondent's mandate under the Act includes receiving and investigating complaints as part of regulating the processing of personal data.
57. To further give effect to the Act, Regulation 6 of the Enforcement Regulations sets out a wide range of steps the Data Commissioner may take following a preliminary review of a complaint.
58. Regulation 6(2)(b) and (c) of the Enforcement Regulations permits the Data Commissioner to advise the Applicant in writing that the matters are neither within the Respondent's mandate nor for determination by another body or institution.
59. It argues that the Applicant's contention that her handwriting and signature on the affidavit of spousal consent were fraudulently replicated and/or forged to charge her matrimonial property, which falls within the scope of Sections 345 to 362 of the Penal Code, Cap. 63, and, by extension, the First Schedule of the Criminal Procedure Code, Cap. 75.
60. The Respondent lacks jurisdiction to investigate such matters under the Act by virtue of Sections 3 and 4 of the Civil Procedure Code.
61. The Respondent submits that granting the orders sought will ultimately achieve nothing, as the particulars of the Applicant's complaint fall outside the Respondent's mandate.
62. The Respondent lacks jurisdiction to investigate allegations of forgery, the validity of charges, and matrimonial property matters.
63. In the case of Nasieku Tarayia vs Board of Directors, Agricultural Finance Corporation & Anoe [2012] eKLR, which held that judicial review is an alternative remedy of last resort. Where alternative remedies exist, the court must be satisfied that judicial review is the more convenient, beneficial, and efficacious remedy before granting leave.
64. It submits that Section 64 of the Act provides that a person against whom any administrative action is taken by the Data Commissioner, including any enforcement and penalty notices, may appeal to the High Court.
65. The Applicant has neither lodged an appeal to the High Court nor shown that she attempted to do so but was unable to.
66. Section 9(2) and (4) of the Fair Administrative Actions Act, 2015, which preclude the High Court or any other subordinate Court from reviewing an administrative action or decision under the Fair Administrative Actions Act, 2015, in matters where a party has not exhausted internal remedies, except where exceptional circumstances for exemption are established.
67. Reliance is placed in the case of Clifford Kenya v Jackline Ingutiah & 5 others; Atieno Aoko & 3 others (Interested Party) [2022] eKLR, by the Court of Appeal in Speaker of National Assembly v Karume, Civil Application No. NAI 92 of 1992, and by this Honourable Court in Ceres Tech Limited v Commissioner, Office of the Data Protection Commissioner [2024] KEHC 12833 (KLR).
68. In the present case, it is clear that there is an alternative and satisfactory remedy for the Applicant's complaint.
69. The Respondent maintains that the Applicant has adequate alternative remedies and that the Applicant's allegations are unfounded, misdirected, and based on disputed facts unsuitable for determination in judicial review.
70. The Applicant lacks a prima facie case entitling them to leave to file judicial review proceedings, and invites this Court to consider that position.
Analysis and Determination;
The issue for determination is whether or not the Applicant has made out a case for the grant of the orders sought.
71. The applicable law on leave to commence judicial review proceedings is Order 53 Rule 1 of the Civil Procedure Rules, which provides that no Application for judicial review orders should be made unless leave of the court was sought and granted.
72. The reason for the leave was explained by Waki J (as he then was), in Republic v County Council of Kwale & Another Ex Parte Kondo & 57 Others, Mombasa HCMCA No. 384 of 1996 as follows:
“The purpose of Application for leave to apply for judicial review is firstly to eliminate at an early stage any Applications for judicial review which are either frivolous, vexatious or hopeless and secondly to ensure that the Applicant is only allowed to proceed to substantive hearing if the Court is satisfied that there is a case fit for further consideration. The requirement that leave must be obtained before making an Application for judicial review is designed to prevent the time of the court being wasted by busy bodies with misguided or trivial complaints or administrative error, and to remove the uncertainty in which public officers and authorities might be left as to whether they could safely proceed with administrative action while proceedings for judicial review of it were actually pending even though misconceived…Leave may only be granted therefore if on the material available the court is of the view, without going into the matter in depth, that there is an arguable case for granting the relief claimed by the Applicant the test being whether there is a case fit for further investigation at a full inter partes hearing of the substantive Application for judicial review. It is an exercise of the court’s discretion but as always it has to be exercised judicially”.
73. It is also trite that in an Application for leave, the Court ought not to delve deeply into the arguments of the parties, but should make cursory perusal of the evidence before court and make the decision as to whether an Applicant’s case is sufficiently meritorious to justify leave.
74. In Uwe Meixner & another v Attorney General [2005] eKLR, it was held that the leave of court is a prerequisite to making a substantive Application for Judicial Review with a view to filtering out frivolous Applications and the grant or refusal involves an exercise of judicial discretion and the test to be applied is whether the Applicant has an arguable case. Thus, the first step in the Judicial Review procedure involves the mandatory "leave stage." At this stage an Application for leave to bring Judicial Review proceedings must first be made. The leave stage as held by Waki J is used to identify and filter out, at an early stage, claims which may be trivial or without merit.
75. In Republic v National Transport & Safety Authority & 10 others [20141 eKLR, in Kihingo Village (Waridi Gardens) Management Limited v Attorney General & 2 others (Judicial Review 169 of 2023) [20231 KEHC 26714 (KLR) (Judicial Review) (20 December 2023) (Ruling) in granting leave to the Applicant to file judicial review it was held that;
“I have carefully perused through the record and submissions a prima facie case is established to warrant the grant of the leave sought.”
76. The Applicant has made out a prima facie case that has to be heard on merit.
Disposition;
77. The Applicant has made out a prima case that justifies the grant of the orders sought.
Order;
1) The Application is allowed.
2) The Applicant shall file and serve the substantive suit within 14 days which shall be in a separate file.
3) The Respondent file and serve their responses within 14 days of the date of service of the Application.
4) The Applicant shall thereafter file and serve submissions within 7 days of the date of service.
5) The Respondent shall file and serve submissions within 7 days thereafter.
6) This file is closed.
Dated, signed and delivered at Nairobi this 27th day of February, 2026.