Steve Kamwamu Sande v Nyati Savings & Credit Co-op Society

processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors and for connected purposes. the Constitution therefore provided for in-built resolution mechanisms within the Data Protection Act for resolution of the sort of dispute that has been presented before this Honourable Court. 5. ii. Section 56 of the Data Protection Act, 2019, requires a data subject who is aggrieved by the decision of any person under the Act to lodge a complaint with th4e Data Protection Commissioner. The Data Commissioner is, in turn, enjoined by Section 57(5) of the Act to investigate any complaint and make a determination within ninety days. Section 65 of the Data Protection Act actually prescribes various remedies in cases where the Data Commissioner finds that there is a violation or threat of violation of the provisions of the Act. iii. There exists an alternative remedy under Sections 56 and 64 of the Data Protection Act, 2019 as read with Regulation 3(a) and 4 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 available to the Plaintiff. The Plaintiff therefore ought to have exhausted the available mechanisms for resolution of the instant dispute before invoking the instant court’s jurisdiction. iv. Section 64 of the Data Protection Act provides that a person against whom any administrative action is taken by the Data Commissioner, including enforcement and notices, may appeal to this Honourable Court. This Court cannot therefore be the first port of call for the nature of the dispute. The Plaintiff therefore violated the doctrine of exhaustion. v. The matters raised by the Plaintiff fall under the jurisdiction of the Data Protection Commissioner established under sections 3 (c ) (d) and (e ) of the Data Protection Act, 2019 and this Honourable Court ought to discourage invocation of this court’s jurisdiction where there exists a parallel or alternative statutory remedy. vi. That it is trite law that “where there is clear procedure for redress of any particular grievance prescribed by the Constitution or an Act of Parliament, that procedure should be strictly followed.” Parties were directed to canvass the PO by way of written submissions. Defendant’s submissions 6. 7. The Defendant has identified the following as the issues for determination: i. Whether the Notice of Preliminary Objection dated 11th February 2025 has merit. ii. Which party ought to bear costs of the Notice of Preliminary Objection. On the first issue, it was submitted that the PO is anchored in law and must meet the threshold in the Mukisa Biscuits Manufacturing Co. Ltd v West End Distributors Limited (1969) EA 697 and Oraro v Mbaja [2025] 1 KLR 141. It was submitted that the entire suit is based on the alleged unauthorized use of the Plaintiff’s image or data for the furtherance of the Defendant’s commercial interests as a Sacco and that any other prayers sought thereunder are a continuation or extrapolation of the principal issue of violation of data rights. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 2

page 2 of 8

8. It was submitted that the cause of action relates to the infringement of the image, data and privacy rights of the Plaintiff, which fall under Article 31 of the Constitution of Kenya 2010 as read with Data Protection Act, 2019. The Defendant placed reliance on Article 31 of the Constitution and Section 56 of the Data Protection Act and Regulations 3 and 4 of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations 202, as well as Geoffrey Muthinja & another v Samuel Muguna Henry & 1756 others [2015] eKLR and Oucho v Joseph Otieno Bee, Chief Executive Officer Bandaro Sacco Ltd & 12 others; Sacco Society Regulatory Authority (SASRA) (Interested Party) (Constitutional Petition 57 of 2021) [2022] KEHC 6 (KLR) (25) January 2022) (Ruling), among other authorities to emphasize that there are no exceptional grounds or reasons present to warrant this court to take up jurisdiction and any invitation to do so must be declined. 9. On who should bear the costs of this PO, it was submitted that costs ought to be awarded to the Defendant. The Defendant submitted that costs follow the event and that as it was held in Jasbir Singh Rai & Others v Tarlochan Singh Rai and 4 others [2014] eKLR, “where the court decides not to follow the general principle, the court is enjoined to give reasons for not doing so. In my view, it is the failure to follow the general principle without reasons that would amount to arbitrary exercise of discretion.” 10. The Defendant urged that the PO is merited and ought to be allowed with costs being awarded to the Defendant. Plaintiff ’s submissions 11. The Plaintiff relied on R. v Independence Electoral and Boundaries Commission (I.E.B.C) Ex Parte The National Super Alliance Kenya (NASA) Kenya & 6 Others [2017] KEHC 4663 (KLR) and William Odhiambo Ramogi & 3 Others v Attorney General & 4 Others; Muslims for Human Rights & 2 Others (Interested Parties) [2020], KEHC 10266, (KLR) and submitted that the instant suit primarily seeks to enforce fundamental rights and freedoms of the Plaintiff and therefore it can only be determined by the High Court and cannot be barred by the doctrine of exhaustion and that the statutory provisions available on dispute resolution under the Data Protection Act, Cap 411C cannot be construed in restrictive manner to oust the court’s jurisdiction to determine issues in dispute which qualify under the exceptions set out in Willian Odhiambo Ramogi case. 12. The Plaintiff submitted that the jurisdiction of the courts to consider valid grievances from parties who lack adequate audience before a forum created by a statute or who may not have the quality of audience before the forum which is proportionate to the interests the party wishes to advance in a suit must not be ousted. That the doctrine of exhaustion, though relevant, is not applicable in this case having regard to the nature of the grievance. 13. It was submitted that the issues the Plaintiff has raised in the Plaint can only be adjudicated by this Honourable Court and not the Data Protection Commissioner and therefore this Court is clothed with the requisite jurisdiction to determine this matter and that the PO ought to be dismissed. Analysis and Determination 14. I have considered the PO and the grounds raised therein. I have considered the rival submissions by the parties. To my mind, what the Defendant is saying in the PO raised herein, in so many words, is that the Plaintiff, by coming to this court, has offended the doctrine of exhaustion. That there is in existence, an alternative mechanism to resolve the issues he is raising and he ought not to have come to this court before exhausting that alternative mechanism. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 3

page 3 of 8

15. I have identified the following as the two major issues requiring my intervention to resolve in this matter: i. Whether the PO raised meets the threshold. ii. Whether section 56 of the Data Protection Act ousts the jurisdiction of this court. 16. On whether the PO raised here meets the threshold, it is my considered view, that it is settled that a Preliminary Objection consists a pure point of law which has been pleaded or which arises by clear implication out of pleadings and which if argued as a preliminary point may dispose of the suit. This is the position held in Mukisa Biscuits Manufacturing Co. Ltd v West End Distributors Ltd (1969) EA. 696 and Oraro v Mbaja [2005] 1 KLR 141. 17. I have read the Plaint and the PO and I am satisfied that the issue raised in the instant PO meets the above threshold. The issue that the Plaintiff has not exhausted the alternative mechanisms for resolving the dispute subject of the Plaint filed herein is a point of law as defined in the Mukisa Biscuits case. It is not blurred with factual details requiring proof through evidence. 18. In so finding, I am also guided by the Supreme Court of Kenya decision in Independent Electoral & Boundaries Commission v Jane Cheperenger & 2 others [2015] eKLR which found as follows: “ It is quite clear that a preliminary objection should be founded upon a settled and crisp point of law, to the intent that its application to undisputed facts, leads to but one conclusion: that the facts are incompatible with that point of law.” 19. Turning on the second issue, it is clear to me that the PO raised here rides on the key issue whether this court has jurisdiction to entertain the Plaintiff’s suit by dint of the doctrine of exhaustion. The Defendant has in sum argued that the Plaintiff ought to have first exhausted the alternative dispute resolution mechanisms available under the Data Protection Act Cap. 411C Laws of Kenya (the Act) and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 (the Regulations). In contrast, the Plaintiff has contended that the present suit is properly before this court since the same seeks to enforce certain fundamental rights and freedoms which can only be done by the High Court. 20. It is a settled legal principle that jurisdiction is everything and that without it, a court cannot perform any further action in a matter (see Owners of the Motor Vessel “Lillian S” v Caltex Oil (Kenya) Ltd [1989] eKLR). 21. The doctrine of exhaustion was considered by the Court of Appeal in the case of Geoffrey Muthinja & another v Samuel Muguna Henry & 1756 others [2015] KECA 304 (KLR), cited by the Defendant, with the Court pronouncing itself in the following manner: “ It is imperative that where a dispute resolution mechanism exists outside courts, the same be exhausted before the jurisdiction of the courts is invoked. Courts ought to be the fora of last resort and not the first port of call the moment a storm brews within churches, as is bound to happen. The exhaustion doctrine is a sound one and serves the purpose of ensuring that there is a postponement of judicial consideration of matters to ensure that a party is first of all diligent in the protection of his own interest within the mechanisms in place for resolution outside of courts. This accords with Article 159 of the Constitution which commands Courts to encourage alternative means of dispute resolution. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 4

page 4 of 8

We find and hold that the exhaustion doctrine applies even where, as was argued by the appellants herein, what is sought to be challenged is the very authority of the organs before whom the dispute was to be placed. We think there were sufficient safeguards in place for a valid determination of the various plaintiffs’ disputes had they filed them within the church set up. And there was always the right, acknowledged by the learned Judge, of approaching the courts after exhaustion of the church mechanisms. By failing to do so, and quite apart from the force of their apprehensions, the appellants effectively failed to exhaust their remedies and essentially short-circuited the process by filing suits prematurely.” 22. The applicability of the doctrine of exhaustion was reaffirmed by the Supreme Court in its recent decision in Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (Petition E007 of 2023) [2023] KESC 113 (KLR) (28 December 2023) (Judgment), likewise cited in the Defendant’s submissions, thus: “ On our part, in NGOs Co-ordination Board v EG & 4 others; Katiba Institute (Amicus Curiae) (Petition 16 of 2019) [2023] KESC 17 (KLR) (Constitutional and Human Rights) (24 February 2023) (Judgment) (NGOs Co-ordination Board) we outlined the doctrine of exhaustion of administrative remedies and adopted our finding in Albert Chaurembo Mumbo & 7 others v Maurice Munyao & 148 others; SC Petition No 3 of 2016, [2019] eKLR where we held that: ... even where superior courts had jurisdiction to determine profound questions of law, the first opportunity had to be given to relevant persons, bodies, tribunals or any other quasi-judicial authorities and organs to deal with the dispute as provided for in the relevant parent statute.” In the above decision, we furthermore emphasized that, where there exists an alternative method of dispute resolution established by legislation, courts must exercise restraint in exercising their jurisdiction as conferred by the Constitution and must give deference to the dispute resolution bodies established by statute with the mandate to deal with such specific disputes in the first instance.” 23. My reading and understanding of the above-cited authorities, is that, notwithstanding the jurisdiction of a court to entertain a matter, where an alternative dispute resolution mechanism exists in law, a party is required in the first instance, to pursue his or her dispute under the mechanism provided for. 24. Through its submissions, the Defendant has cited various provisions of the Act and its Regulations, to support its averment that the Data Protection Commissioner (the Data Commissioner), is bestowed with jurisdiction to entertain the dispute herein, at the first instance. 25. The Preamble to the Data Protection Act clearly affirms the intention of the Legislature in enacting that law. It provides that: An ACT of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes 26. Section 2 of the Act defines what constitutes data and further defines a ‘data subject’ as: “an identified or identifiable natural person who is the subject of personal data.” 27. Section 3 of the Act sets out the objectives and purpose thereof, as: https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 5

page 5 of 8

(a) to regulate the processing of personal data; (b) to ensure that the processing of personal data of a data subject is guided by the principles set out in section 25; (c) to protect the privacy of individuals; (d) to establish the legal and institutional mechanism to protect personal data; and (e) to provide data subjects with rights and remedies to protect their personal data from processing that is not in accordance with this Act. 28. The above objects are expounded under Regulation 3 of the Regulations. 29. Section 5 of the Act establishes the office of the Data Commissioner, whereas Section 8 lists the functions of such office, including the undertaking of investigations arising from complaints relating to infringements of any rights provided under the Act. 30. Section 56 of the Act on its part provides for the lodging of complaints as follows: (1) A data subject who is aggrieved by a decision of any person under this Act may lodge a complaint with the Data Commissioner in accordance with this Act. (2) A person who intends to lodge a complaint under this Act shall do so orally or in writing. (3) Where a complaint made under subclause (1) is made orally, the Data Commissioner shall cause the complaint to be recorded in writing and the complaint shall be dealt with in accordance with such procedures as the Data Commissioner may prescribe. (4) A complaint lodged under subclause (1) shall contain such particulars as the Data Commissioner may prescribe. (5) A complaint made to the Data Commissioner shall be investigated and concluded within ninety days. 31. Regulation 4 of the Regulations echoes Section 56 (supra) and in setting out the manner of lodging a complaint 32. Furthermore, Sections 57, 58 and 62 of the Act make provision for the investigations of complaints and enforcement and penalty notices, respectively. The procedure for enforcement of the above notices is set out under Part III of the Regulations. 33. Section 64 makes provision for the right of appeal, by a person who stands aggrieved by any administrative action taken by the Data Commissioner. This right of appeal is further provided for under Regulation 19 of the Regulations. 34. Last but not least, Section 65 provides for compensation to a data subject, thus: (1) A person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor. (2) Subject to subsection (1)— (a) a data controller involved in processing of personal data is liable for any damage caused by the processing; and https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 6

page 6 of 8

(b) a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor— (i) has not complied with an obligation under the Act specifically directed at data processors; or (ii) has acted outside, or contrary to, the data controller's lawful instructions. (3) A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage. (4) In this section, “damage” includes financial loss and damage not involving financial loss, including distress. 35. That said, upon a perusal of the pleadings, it is apparent that the Plaintiff’s dispute is in the nature of alleged infringement of his fundamental rights and freedoms under, inter alia, Article 31 of the Constitution, which protects and promotes the right to privacy. The Plaintiff’s claim arose from the alleged illegal and unconsented use and publication of his image by the Defendant. Consequently, the Plaintiff seeks various declaratory orders as well as injunctive and compensatory reliefs against the Defendant. 36. However, I am satisfied that the provisions of the Data Protection Act and the Regulations thereunder are applicable to the present dispute. Further, clear procedures have been provided for recourse by a party aggrieved by the actions catered for under the Act. Consequently, while it is trite law that the High Court retains unlimited original jurisdiction to handle disputes of both a civil and criminal nature, the general legal principle under the doctrine of exhaustion has been that where separate dispute resolution mechanisms have been provided, they ought to be exhausted before a party can consider taking the next steps, save in exceptional circumstances. 37. I am guided by the decision in R v Independent Electoral and Boundaries Commission (I.E.B.C.) Ex Parte The National Super Alliance Kenya (NASA) Kenya & 6 Others [2017] KEHC 4663 (KLR) where the Court stated as follows: “ What emerges from our jurisprudence in these cases are at least two principles: while, exceptions to the exhaustion requirement are not clearly delineated, Courts must undertake an extensive analysis of the facts, regulatory scheme involved, the nature of the interests involved – including level of public interest involved and the polycentricity of the issue (and hence the ability of a statutory forum to balance them) to determine whether an exception applies. In Shikara Limited Case (supra) the Court of Appeal acknowledged that the High Court may, in exceptional circumstances, find that exhaustion requirement would not serve the values enshrined in the Constitution or law and permit the suit to proceed before it. This exception to the exhaustion requirement is particularly likely where a party pleads issues that verge on Constitutional interpretation especially in virgin areas or where an important constitutional value is at stake.” 38. Upon consideration thereof, it is the court’s view that while the Plaintiff has argued that the exceptions set out in the above authority and echoed in the case of William Odhiambo Ramogi & 3 others v Attorney General & 4 others; Muslims for Human Rights & 2 others (Interested Parties) [2020], KEHC 10266, (KLR) similarly cited in the Plaintiff’s submissions, are applicable to this case, he has not placed any credible material or averments before the court to support that argument. Moreover, https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 7

page 7 of 8

it has not been demonstrated that the provisions of the Act and Regulations are inapplicable to the present circumstances. 39. This matter was filed as a civil dispute falling under this Division. If the intention of the Plaintiff was to file a constitutional petition, he would have done so in the right forum. For this reason, and in view of the responsibility placed on the office of the Data Commissioner, it is my considered view, and I so find, that the Plaintiff was required to firstly exhaust the dispute resolution channels available to him under the Data Protection Act and its Regulations, before moving this court. In the absence of any exceptional circumstances demonstrated by the Plaintiff to indicate otherwise, the court is of the view that the claim as it stands, is prematurely before it. 40. Accordingly, it is my finding, and I so hold, that the existence of an alternative dispute resolution mechanism under the Data Protection Act ousts the jurisdiction of this court to try this matter. Consequently, the Notice of Preliminary Objection dated 11th February 2025 is merited and is hereby allowed with costs to the Defendant. 41. Orders shall issue accordingly. DATED, SIGNED AND DATED THIS 26TH JUNE 2025. S. N. MUTUKU JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11815/eng@2025-06-26 8

page 8 of 8