Subscribe to our Newsletter to receive the latest updates on our content. By tapping the “Subscribe” button you will be redirected to subscription page. Subscription is free.
Affirming existing jurisprudence, the High Court of Kenya ruled that complaints under the Data Protection Act, 2019 (DPA) ought to be first handled by the Data Commissioner. In a recent alert, we detailed how the Office of the Data Protection Commissioner (ODPC) had begun exercising its wide-ranging powers to enforce the DPA provisions. Long before this, data subjects had made attempts to seek compensation from courts in relation to perceived violations of their rights under the DPA. In several decisions, Kenyan courts have generally affirmed that data subjects ought to exhaust the complaints mechanisms available to them under the DPA before approaching the court. The most recent of these decisions is the High Court at Naivasha’s ruling in Mwangi & another v Naivasha County Hotel t/a Sawela Lodges (Petition E003 of 2021) (the Petition).
Affirming existing jurisprudence, the High Court of Kenya ruled that complaints under the Data Protection Act, 2019 (DPA) ought to be first handled by the Data Commissioner. In a recent alert, we detailed how the Office of the Data Protection Commissioner (ODPC) had begun exercising its wide-ranging powers to enforce the DPA provisions. Long before this, data subjects had made attempts to seek compensation from courts in relation to perceived violations of their rights under the DPA. In several decisions, Kenyan courts have generally affirmed that data subjects ought to exhaust the complaints mechanisms available to them under the DPA before approaching the court. The most recent of these decisions is the High Court at Naivasha’s ruling in Mwangi & another v Naivasha County Hotel t/a Sawela Lodges (Petition E003 of 2021) (the Petition).
On 19 July 2022, the High Court delivered a ruling that struck out the Petition on the basis that the Petitioners had failed to exhaust the remedy available to them under the DPA. The remedy in question was filing a complaint with the Data Commissioner. The complaint raised in the Petition was that the Respondent, Sawela Lodges, took photos of the Petitioners during a retreat and subsequently used those photos for advertising purposes on their social media without the Petitioners’ consent. The Petitioners argued that their constitutional right to privacy was violated and sought relief from the High Court under a provision of the DPA entitling them to compensation in the event they suffered damage.
In response, Sawela Lodges objected to the Petition, arguing that the High Court lacked the jurisdiction to hear and determine the issues. This was supported by the arguments that the Petition did not raise justifiable constitutional issues, and the issue in question fell within the mandate of the ODPC under the DPA. For this reason, they argued that the use of the constitutional petition where there exists a parallel or alternative statutory remedy ought to be discouraged.
High Court Sides with Sawela Lodges
The High Court examined whether it was barred by the doctrine of exhaustion from entertaining the Petition. The doctrine of exhaustion provides that aggrieved parties ought to first use alternative existing statutory remedies before approaching the court unless such remedies are unavailable or insufficient. Under the DPA, the ODPC is mandated to hear and determine complaints arising under the DPA. Therefore, there exists a mechanism for compensation, grounded in statute, that ought to be exhausted prior to instituting an action in court.
Appreciating the provisions of the DPA and the promotion of alternative dispute resolution mandated under Article 159 of the Constitution the High Court then analysed whether an exception to the doctrine of exhaustion was warranted in this case. The High Court was guided by existing jurisprudence in its analysis. It held that firstly, an exception is warranted where the exhaustion of the statutory remedy – in this case, the ODPC – would not serve the values enshrined in the Constitution. Secondly, it held that an exception to the doctrine is justified where the parties lack adequate audience before a forum created by a statute, or may not have the quality of audience before the forum which is proportionate to the interests of the party. In a previous decision, Republic v Joe Mucheru, Cabinet Secretary for ICT and 2 others ex parte Katiba Institute and Yash Pal Ghai [2021], the High Court had conceded that the doctrine of exhaustion could not apply to the DPA as the ODPC was yet to fully establish its operations. This time, in the Petition, the High Court found that the DPA accords aggrieved parties a suitable avenue of dispute resolution and therefore the Petitioners had failed to demonstrate why this specific matter ought to be exempted from the exhaustion rule.
Separately, the High Court also analysed whether the unconsented use of personal data amounts to a constitutional issue. It emphasised the importance of distinguishing between constitutional issues and disputes between private individuals which ought to be resolved through the mechanisms provided in law. Guided by a previous Supreme Court decision, the High Court explained that the Constitution gives every person the right to initiate proceedings claiming that a fundamental right or freedom has been denied. However, the Constitution is not a general substitute for the normal procedures for invoking judicial control of administrative action. If an infringement of rights can be addressed under substantive legislation, the appropriate course is to bring the claim under that law and not under the Constitution. As a result of this analysis, the High Court sided with Sawela Lodges and struck out the Petition.
Conclusion
Though the right to privacy is embedded in our Constitution under Article 31, we must appreciate the significance of the DPA as a statutory mechanism that provides direction on privacy matters. The ODPC has started to make active strides in outlining and enforcing its mandate, including with respect to dispute resolution. Growing jurisprudence affirms that the ODPC is the “court of first instance” when it comes to breaches under the Act.
Should you have any questions regarding the Growing Jurisprudence on the Role of the Data Commissioner in Handling Complaints, please contact Sonal Tejpar or Wangui Kaniaru.