Harry Stephen Arunda v Office of The Data Protection Commissioner & 1 other

JUDGMENT 1. This Petition raises a significant constitutional question regarding the jurisdiction of the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019 (DPA) to investigate and adjudicate complaints involving alleged breaches of the right to privacy guaranteed under Article 31 of the Constitution. The Petitioner seeks a declaration that Section 56 of the DPA and Regulation 14(5) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 are unconstitutional to the extent that they vest the ODPC with powers akin to those of a judicial authority. 2. The Petition further challenges the ODPC's authority to award remedies, including compensation, for privacy violations, arguing that such powers belong exclusively to the High Court under Article 23(1) and 165(3)(b) of the Constitution. 3. The Respondents and the Interested Party oppose the Petition. They contend that the ODPC is a specialized statutory body created to give effect to the right to privacy under Article 31 and that its quasi-judicial functions are constitutionally permissible, particularly in light of the exhaustion doctrine and the principle of constitutional avoidance. 4. The key issues for determination are: (i) whether the ODPC's powers under the DPA usurp the High Court's exclusive jurisdiction under Articles 23(1) and 165(3)(b); (ii) whether Section 56 and Regulation 14(5) are unconstitutional; and (iii) whether the doctrines of exhaustion and avoidance preclude direct recourse to the High Court. 5. The Petition was canvassed by way of written submissions and in compliance the parties filed their respective submissions. Petitioner’s Case 6. The Petitioner, an advocate of the High Court, contends that the ODPC, an executive agency, lacks jurisdiction to determine whether a breach of Article 31 has occurred. In his submission, he submitted that only the High Court is constitutionally mandated to determine questions relating to the violation of the Bill of Rights under Articles 23(1) and 165(3)(b). 7. He avers that Section 56 and Regulation 14(5) are unconstitutional because they grant the ODPC the authority to issue binding and enforceable orders, including remedies that mirror those granted under Article 23(3). Such provisions, it is argued, impermissibly confer judicial power on an executive body in violation of the separation of powers doctrine. 8. The Petitioner further asserts that the ODPC is not a "subordinate court" within the meaning of Article 169(1) and therefore cannot exercise jurisdiction over constitutional questions. Additionally, the Petitioner claims that the ODPC’s jurisdiction unlawfully overlaps with that of the Kenya National Human Rights and Equality Commission (KNHREC), which is expressly empowered under Article 59 to investigate human rights violations. 9. The Petitioner relies on several authorities including Samura Engineering Ltd v Kenya Revenue Authority [2012] eKLR and Hussein Khalid & 16 Others v Attorney General & 2 others [2017] KESC 90, which underscore the exclusive jurisdiction of the High Court in constitutional matters. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 2

page 2 of 12

Respondents’ Cases 1st Respondent (ODPC) 9. The 1st Respondent asserts that the DPA was enacted to give effect to Article 31(c) and (d), and establishes the ODPC under Section 5 to regulate the processing of personal data. The ODPC's mandate under Sections 8(1)(f), 56, 58 and 65 includes receiving and investigating complaints, issuing enforcement notices, and awarding compensation for breaches of data rights. 10. It is the 1st Respondent’s case that its functions are administrative and quasi-judicial, not judicial in nature, and that Section 64 of the DPA preserves the High Court's appellate jurisdiction, thereby safeguarding constitutional propriety. 11. The ODPC submits that it is a legitimate forum under Article 159(2)(c), which encourages alternative dispute resolution (ADR). It cites authorities such as Kirimi & Another v Mobi Changa Ltd [2023] and, in support of the proposition that statutory bodies may determine disputes within their legislative mandate. 2nd Respondent (Attorney General) 12. The 2nd Respondent concurs with the 1st Respondent and invokes the doctrines of constitutional avoidance and exhaustion. It is submitted that courts must respect statutory dispute resolution frameworks unless exceptional circumstances exist, and that the Petitioner has neither lodged a complaint with the ODPC nor demonstrated that its process is inadequate. Interested Party’s Case 12. The Interested Party submitted that the ODPC was established to fill the legislative and institutional gap in the enforcement of the right to privacy. It emphasizes the ODPC’s technical competence and the need for accessible, sector-specific redress mechanisms for data-related complaints. 13. It contends that the ODPC does not purport to usurp judicial authority but rather offers a specialized forum for administrative enforcement. Citing Nubian Rights Forum v AG [2020] eKLR and comparative jurisprudence from South Africa and Uganda, the Interested Party argues that specialized data protection authorities are globally accepted and constitutionally permissible. Issues for Determination 14. Having considered the pleadings and submissions of the parties, the following issues arise for determination: i. Whether the Office of the Data Protection Commissioner usurps the jurisdiction of the High Court under Articles 23(1) and 165(3)(b) of the Constitution; ii. Whether Section 56 of the Data Protection Act and Regulation 14(5) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 are unconstitutional for purporting to confer judicial powers on the ODPC; iii. Whether the doctrines of exhaustion and constitutional avoidance are applicable and bar the Petitioner from accessing the High Court before exhausting remedies under the DPA; iv. Whether there is an unlawful overlap between the ODPC and the Kenya National Human Rights and Equality Commission in relation to enforcement of Article 31 of the Constitution. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 3

page 3 of 12

Analysis and Determination Does the ODPC usurp the High Court’s jurisdiction under Articles 23(1) and 165(3)(b)? 15. The gravamen of the Petitioner’s argument is that the powers conferred upon the Office of the Data Protection Commissioner (ODPC) under Section 56 of the DPA and Regulation 14(5) amount to an unconstitutional usurpation of the judicial authority exclusively vested in the High Court by Articles 23(1) and 165(3)(b) of the Constitution. Article 23(1) provides that only the High Court has jurisdiction to hear and determine applications for the enforcement of fundamental rights and freedoms. Article 165(3)(b) further mandates the High Court to determine whether a right or fundamental freedom has been denied, violated, infringed or threatened. 16. The Petitioner anchors his case on decisions such as Samura Engineering Ltd v Kenya Revenue Authority [2012] eKLR and Hussein Khalid v AG [2017] KESC 90 (K) where courts have emphasized that the jurisdiction of the High Court under Articles 22 and 23 cannot be ousted or delegated to non-judicial bodies. He argues that by purporting to investigate and make enforceable determinations, including compensatory awards, the ODPC performs functions that are essentially judicial in nature, thereby violating the doctrine of separation of powers. 17. In contrast, the 1st Respondent contends that its mandate is firmly grounded in the Constitution and the Data Protection Act. The 1st Respondent cites Articles 31(c) and (d) which protect against the unnecessary or unlawful collection and misuse of personal data. The DPA operationalizes this right and creates the ODPC to handle complaints related to data protection breaches. Sections 5, 8(1)(f), 56 and 65 confer upon the ODPC the authority to receive complaints, investigate, make determinations, and issue enforcement notices. The Respondents argue that these powers are administrative and quasijudicial, not judicial, and are subject to oversight by the High Court under Section 64 of the DPA, which provides for appeals. 18. In Kirimi & Another v Mobi Changa Ltd [2023], the High Court considered whether parties aggrieved by alleged breaches of the right to privacy could approach the High Court directly. In the cases, the court emphasized the role of the ODPC as the primary forum for dispute resolution in privacy-related matters and endorsed a reading of the DPA that situates the ODPC as a specialized, expert body capable of handling data protection disputes, with the High Court retaining appellate and supervisory jurisdiction. In arriving ate the finding, the court stated thus: 19. “ 20. The Act under Section 64 provides for the right of appeal to the High Court by any person offended by any administrative action taken by the Data Commissioner. 21. The foregoing provisions demonstrate that any person claiming a breach of the provisions of Article 31 of the Constitution MUST first file a complaint with the Office of the Data Commissioner and that such a party can only approach the High Court on appeal of the Data Commissioner’s administrative actions.” The Interested Party supports this position and draws the Court’s attention to comparative experiences from South Africa and Uganda. South Africa’s Protection of Personal Information Act (POPIA) creates the Information Regulator with similar functions, and its jurisprudence upholds the constitutionality of delegating such regulatory and remedial powers to non-judicial entities, provided there is appellate recourse. In Nubian Rights Forum & 2 others v Attorney General & 6 others; Child https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 4

page 4 of 12

Welfare Society & 9 others (Interested Parties) [2020] eKLR the High Court of Kenya recognized the importance of institutional mechanisms for the realization of the right to privacy and endorsed the role of the ODPC as a key actor. 20. This Court finds that while Article 23(1) confers original jurisdiction upon the High Court to redress violations of the Bill of Rights, not every dispute involving a constitutional right must necessarily originate in the High Court. As held in Rich Productions Ltd v Kenya Pipeline Co. [2014] eKLR, the existence of statutory mechanisms and administrative tribunals reflects a constitutional vision of accessible, efficient, and expert resolution of specialized disputes. The fact that such determinations are subject to review or appeal to the High Court ensures that constitutional fidelity is maintained. In arriving at the decision, the Court stated as follows: “ The reason why the Constitution and the law establish different institutions and mechanism for dispute resolution in different sectors is to ensure that such disputes as may arise are resolved by those with the technical competence and the jurisdiction to deal with them. While the Court retains the inherent and wide jurisdiction under Article 165 to supervise bodies such as the 2ndrespondent, such supervision is limited in various respects which I need not go into here. Suffice to say that it cannot exercise such jurisdiction in circumstances where the parties before it seek to avoid the mechanisms and processes provided by law, and convert the issue in dispute into a constitutional issue when it is not.” 21. Moreover, the power to investigate and make administrative findings does not, in and of itself, amount to a judicial function. The test is whether the body in question exercises binding legal authority in a manner that usurps core judicial functions. In this case, the ODPC does not issue final declarations of constitutional violations or enforce court-like judgments. Instead, it operates as a quasi-judicial regulator performing a complementary role within the larger legal framework. 22. Consequently, this Court is not persuaded by the Petitioner’s argument that the ODPC unlawfully usurps the High Court’s jurisdiction under Articles 23(1) and 165(3)(b). The ODPC acts within the statutory framework of the DPA, and its determinations are administrative in nature, subject to judicial review. There exists a clear distinction between the adjudicative role of the High Court in constitutional enforcement and the administrative redress mechanisms facilitated by the ODPC. 23. In conclusion, the Court finds that the ODPC does not usurp the jurisdiction of the High Court. Rather, it provides an important, constitutionally permissible mechanism for the realization of the right to privacy under Article 31, subject to the supervisory jurisdiction of the High Court as preserved under Section 64 of the DPA. Whether Section 56 of the Data Protection Act and Regulation 14(5) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 are unconstitutional for purporting to confer judicial powers on the ODPC 24. In determining whether an impugned legislation or action is unconstitutional, the provisions of the Constitution must be interpreted purposively in line with Article 259(1) and other principles of constitutional interpretation. In the case of Institute of Social Accountability & Another v National Assembly & 4 Others High Court, [2015] eKLR, the court summed up these principles as follows: (57) [T]his Court is enjoined under Article 259 of the Constitution to interpret the Constitution in a manner that promotes its purposes, values and principles, advances the rule of law, human rights and fundamental freedoms in the Bill of Rights and that contributes to good governance. In exercising its judicial https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 5

page 5 of 12

authority, this Court is obliged under Article 159(2)(e) of the Constitution to protect and promote the purpose and principles of the Constitution. In determining whether a statute is constitutional, the court must determine the object and purpose of the impugned statute for it is important to discern the intention expressed in the Act itself (see Murang’a Bar Operators and Another v Minister of State for Provincial Administration and Internal Security and Others Nairobi Petition No. 3 of 2011 [2011]eKLR, Samuel G. Momanyi v Attorney General and Another (supra)). Further, in examining whether a particular statutory provision is unconstitutional, the court must have regard not only to its purpose but also its effect… (59) 25. Fourth, the Constitution should be given a purposive, liberal interpretation...Lastly and fundamentally, it is the principle that the provisions of the Constitution must be read as an integrated whole, without any one particular provision destroying the other but each sustaining the other (see Tinyefuza v Attorney General of Uganda Constitutional Petition No. 1 of 1997 (1997 UGCC 3)). We are duly guided by the principles we have outlined and we accept that while interpreting the impugned legislation alongside the Constitution, we must bear in mind our peculiar circumstances. Ours must be a liberal approach that promotes the rule of law and has jurisprudential value that must take into account the spirit of the Constitution.” Similarly, the Canadian Supreme Court stated in R v Big M Drug Mart Ltd., [1985] 1 S.C.R. 295 that: “ Both purpose and effect are relevant in determining constitutionality; either an unconstitutional purpose or an unconstitutional effect can invalidate legislation. All legislation is animated by an object the legislature intends to achieve. This object is realized through impact produced by the operation and application of the legislation. Purpose and effect respectively, in the sense of the legislation’s object and its ultimate impact, are clearly linked, if not indivisible. Intended and achieved effects have been looked to for guidance in assessing the legislation’s object and thus the validity.” 26. The Petitioner specifically challenges the constitutionality of Section 56 of the Data Protection Act (DPA) and Regulation 14(5) of the 2021 Regulations on grounds that they unconstitutionally confer judicial authority upon the Office of the Data Protection Commissioner (ODPC), contrary to Articles 23(1), 165(3)(b), and the doctrine of separation of powers. The Petitioner asserts that by enabling the ODPC to make enforceable determinations, including the award of compensation, the provisions violate the constitutional delineation of judicial authority, which is the exclusive preserve of courts and subordinate courts duly established under Articles 162 and 169 of the Constitution. 27. Section 56 of the DPA empowers the ODPC to receive and investigate complaints relating to infringement of rights under the Act and to make "enforceable determinations." Regulation 14(5) provides that such determinations may include an order of compliance, cessation of processing, rectification of data, or other remedies. The Petitioner maintains that these provisions amount to arrogating court-like powers to an executive body, allowing it to adjudicate disputes, award remedies, and enforce its decisions, all without express constitutional mandate. 28. The Petitioner relies on jurisprudence such as Samura Engineering Ltd v KRA [2012] eKLR, where the court emphasized that any delegation of judicial power must be clearly anchored in the Constitution or a framework consistent with it. The Petitioner also draws support from Hussein Khalid v AG [2017] https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 6

page 6 of 12

KESC 90, in which the Supreme Court held that administrative bodies may not usurp judicial roles unless they meet the constitutional standard for delegation to subordinate courts. 29. In response, the 1st and 2nd Respondents submit that Section 56 and Regulation 14(5) are not unconstitutional when read in the proper context of the DPA’s objectives. They argue that these provisions facilitate the ODPC’s mandate of promoting and protecting the right to privacy under Article 31, particularly by creating a sector-specific framework for accessible remedies. The Respondents contend that the ODPC does not issue declarations of constitutional rights, but rather investigates factual complaints and applies the statutory framework to provide regulatory redress. 30. The Respondents further argue that the determinations made by the ODPC are subject to appeal before the High Court under Section 64 of the DPA, and therefore do not amount to final and binding judicial orders. The Commissioner’s powers are akin to those of other regulatory agencies such as the Communications Authority, Competition Authority, and the Kenya Revenue Authority, all of which operate under statutes permitting enforcement actions subject to judicial review. 31. The Interested Party reinforces this interpretation by referring to Nubian Rights Forum v AG [2020] eKLR, where the High Court upheld the ODPC’s role in overseeing privacy-related obligations and recognized the need for specialized institutions with the expertise to manage sector-specific complaints. The Interested Party adds that the ODPC’s capacity to make “enforceable” determinations should be understood in the administrative and regulatory context, not as an intrusion into judicial independence. 32. Comparative jurisprudence also supports this view. In South Africa, the Information Regulator under the Protection of Personal Information Act (POPIA) is empowered to make determinations and issue enforcement notices regarding breaches of data protection, subject to review by the High Court. The South African Constitutional Court has held that as long as such determinations are reviewable and not cloaked with the finality of a court judgment, they do not violate the separation of powers. 33. This Court observes that not all binding determinations amount to an exercise of judicial authority. The constitutional test is whether the function in question involves conclusively interpreting and enforcing the Constitution in a manner that overrides the court’s exclusive role. The powers of the ODPC under Section 56 and Regulation 14(5) do not meet this threshold. They are investigatory and regulatory in nature, directed at ensuring compliance with the DPA. 34. Moreover, Article 159(2)(c) of the Constitution encourages alternative dispute resolution mechanisms, which include statutory bodies with quasi-judicial mandates. The use of such mechanisms is consistent with the constitutional goal of expeditious and affordable justice. As held in Geoffrey Muthinja Kabiru & 2 Others v Samuel Munga Henry & 1756 Others [2015] eKLR, statutory processes must be respected unless shown to be inadequate or manifestly unfair. The court stated as follows; “ We find and hold that the exhaustion doctrine applies even where, as was argued by the appellants herein, what is sought to be challenged is the very authority of the organs before whom the dispute was to be placed. We think there were sufficient safeguards in place for a valid determination of the various plaintiffs’ disputes had they filed them within the church set up. And there was always the right, acknowledged by the learned Judge, of approaching the courts after exhaustion of the church mechanisms. By failing to do so, and quite apart from the force of their apprehensions, the appellants effectively failed to exhaust their remedies and essentially short-circuited the process by filing suits prematurely.” 35. While the ODPC may recommend compensation or issue directions to data controllers or processors, these are not declarations of rights in the constitutional sense. They are administrative remedies https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 7

page 7 of 12

available under a statute that expressly provides a right of appeal. This preserves the High Court’s constitutional oversight and ensures the supremacy of the judicial function. 36. In conclusion, the Court finds that Section 56 of the Data Protection Act and Regulation 14(5) of the 2021 Regulations are not unconstitutional. They do not confer judicial power upon the ODPC but authorize administrative and regulatory functions in furtherance of Article 31 of the Constitution. The provisions provide necessary enforcement capacity to a specialized agency while retaining judicial safeguards through appellate oversight by the High Court. Whether the doctrines of exhaustion and constitutional avoidance are applicable and bar the Petitioner from accessing the High Court before exhausting remedies under the DPA 37. The third issue concerns whether the doctrines of exhaustion and constitutional avoidance apply to the present dispute and whether the Petitioner was required to first seek redress through the mechanisms provided under the Data Protection Act before approaching this, Court. 38. The doctrine of exhaustion is now firmly embedded in Kenya’s legal framework, both constitutionally and statutorily. Article 159(2)(c) of the Constitution obligates courts to promote alternative dispute resolution (ADR) mechanisms, which include statutory and administrative procedures such as those administered by the Office of the Data Protection Commissioner. Additionally, Section 9(2) of the Fair Administrative Action Act (FAAA) provides that a person shall not institute judicial review proceedings unless the available statutory mechanisms have been exhausted, unless the court exempts the person from that obligation in exceptional circumstances. 39. The Petitioner, in bypassing the ODPC and filing this Petition directly in the High Court, argues that the DPA mechanism is inadequate and unconstitutional. His position is that since the ODPC lacks jurisdiction to determine violations of Article 31, requiring exhaustion of its procedures would be futile and unconstitutional. He further invokes the decision in Hussein Khalid v AG [2017] KESC 90, to argue that matters involving alleged violations of the Bill of Rights are within the exclusive purview of the High Court and are not subject to the exhaustion doctrine. 40. The 1st and 2nd Respondents vigorously contest this position. They argue that the DPA establishes a complete and adequate dispute resolution framework that includes the power to investigate, make determinations, and enforce compliance, all subject to appellate review by the High Court under Section 64. They further submit that the Petitioner has not demonstrated any exceptional circumstances that would justify deviation from the statutory path. They rely on William Odhiambo Ramogi v AG [2020] and Geoffrey Muthinja Kabiru & 2 Others v Samuel Munga Henry & 1756 Others [2015] eKLR, which underscore the principle that courts must refrain from entertaining disputes unless the prescribed administrative processes have been followed. 41. This Court also considers Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) [2023] KESC 113 (KLR), where the Supreme Court reiterated that the exhaustion doctrine promotes orderly dispute resolution and ensures that statutory bodies are given an opportunity to exercise their specialized mandates. In that case, the Court held that only in rare and exceptional instances, such as when the remedy is ineffective, biased, or manifestly unfair, may a litigant be excused from exhausting administrative remedies. The Supreme Court stated as follows; “ Flowing from the above findings and in that context, it is our view that, where the reliefs under the alternative mechanism are not adequate or effective, then there is nothing that precludes the adoption of a nuanced approach, as we have stated. What must matter at the end is that a path is chosen that safeguards a litigant’s right to access justice https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 8

page 8 of 12

while also recognizing the efficiency and specificity that established alternative dispute resolution mechanisms can offer. This is because, to achieve a harmonious and effective legal framework, it is imperative to strike a judicious balance between the emphasis on providing the initial opportunity for resolution to entities established by law and the assertion of a litigant’s right to access the court. However, such convergence requires a case-by-case assessment by considering issues such as the nature of the dispute and the adequacy of the alternative dispute mechanism. See also our decision in Bia Tosha Distributors Ltd v Kenya Breweries Ltd & 6 Others (Pet No 15 of 2020) [2023] KESC 14(KLR) (Const. and JR) (17 February 2023) (Judgment).” 42. In the present matter, the Petitioner neither attempted to lodge a complaint with the ODPC nor made any formal request to be exempted from the exhaustion requirement under Section 9(4) of the FAAA. He has also not demonstrated that the ODPC is incapable of granting effective redress or that the process is procedurally unfair or substantively unjust. The contention that the DPA’s framework is per se unconstitutional has already been dismissed in the analysis of Issues 1 and 2. 43. On the doctrine of constitutional avoidance, this Court is guided by the Court’s formulation in Valentine Odhiambo& 2 others v Hf Development & Investment Ltd & another [2021] KEELC 392 (KLR), where the Court held that courts should avoid deciding constitutional issues if a matter can be resolved through statutory or administrative mechanisms. The Court observed that constitutional litigation should not be the first port of call where other mechanisms are adequate and available. In arriving at that decision, the court stated as follows; “ The 1st Respondent’s objection which is supported by the 2nd Respondent is that the Petition offends the doctrine of constitutional avoidance. In so doing, the 1st Respondent referred to the Supreme Court decision in Communications Commission of Kenya and 5 Others vs Royal Media Services Limited & 5 Others (Supra). The Supreme Court held that the principle of avoidance entails that a court will not determine a constitutional issue when a matter may properly be decided on another basis. The doctrine interrogates whether there are other ways of resolving a dispute outside a constitutional petition.” The Court further stated: On the jurisdiction of the Water Tribunal established under the Water Act, this Court agrees with the Petitioners that it would not have the jurisdiction to determine any dispute (if any) between them and the 2nd Respondent. Section 121 of the Water Act, 2016 stipulates the jurisdiction of the Tribunal. First and foremost being to handle appeals from the decisions of the Cabinet Secretary, the Authority and Regulatory Board or any other person acting under their authority. Secondly, the Tribunal shall hear and determine any dispute concerning water resources or water services where there is a business contract and where parties have not otherwise agreed on alternative dispute resolution mechanism.” 44. In this case, the DPA offers a structured framework that permits the filing and investigation of complaints and the issuance of remedial directives by the ODPC. If dissatisfied with the outcome, the complainant retains the right to appeal to the High Court. The existence of this appellate jurisdiction ensures that constitutional issues that may arise from the ODPC’s actions can ultimately be scrutinized by this Court. 45. Furthermore, in Faraj & 3 others v Police & 2 others [2022] KEHC 287 (KLR), the High Court emphasized that the doctrine of constitutional avoidance is essential in preventing the premature invocation of the Constitution and in maintaining the sanctity of judicial time and resources. The https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 9

page 9 of 12

principle reinforces the notion that statutory remedies must be pursued to their logical conclusion unless their inadequacy is clearly demonstrated. 46. The Interested Party also highlighted the comparative example of South Africa, where the Information Regulator under the POPIA handles data privacy complaints in the first instance, subject to judicial review. This comparative model supports the view that administrative resolution of data protection disputes is not only efficient but also constitutionally sound. 47. Accordingly, this Court finds that the Petitioner prematurely approached the High Court in contravention of the doctrine of exhaustion. He neither utilized the ODPC’s mechanisms nor sought exemption from the statutory obligation to do so. No exceptional circumstances have been shown to exist, and the available administrative remedy is adequate, effective, and subject to judicial oversight. 48. In conclusion, the doctrines of exhaustion and constitutional avoidance apply to this Petition. The Petitioner’s direct approach to the High Court is procedurally improper and inconsistent with the legal framework established by the DPA and the FAAA. The Petition is therefore premature. Whether there is an unlawful overlap between the ODPC and the Kenya National Human Rights and Equality Commission in relation to enforcement of Article 31 of the Constitution 49. The fourth and final issue for determination is whether the mandate of the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act (DPA) unlawfully overlaps or conflicts with the mandate of the Kenya National Human Rights and Equality Commission (KNHREC) under Article 59(2)(e) of the Constitution, which provides that the Commission shall investigate complaints of violations of human rights and make appropriate recommendations. 50. The Petitioner contends that the DPA effectively creates a parallel institution to the KNHREC with similar investigatory and remedial powers concerning the right to privacy, thereby resulting in a duplication of constitutional mandates and undermining the supremacy of the Constitution. It is argued that Article 59(2)(e) designates the KNHREC as the constitutionally established body responsible for investigating alleged violations of human rights, including those under Article 31, and that any parallel statutory authority exercising similar powers is ultra vires. 51. The 1st Respondent refutes this argument, asserting that the ODPC was established as a distinct entity with a specific statutory mandate to oversee compliance with data protection laws, which are grounded in the enforcement of Article 31(c) and (d) of the Constitution. The ODPC argues that its mandate is focused on the regulation of data processing, the protection of personal information, and the administration of rights and obligations under the DPA, whereas the KNHREC has a broader human rights oversight function. 52. The 2nd Respondent adds that the Constitution contemplates and permits the creation of sectorspecific regulatory and enforcement bodies to actualize constitutional rights. Article 59(4) of the Constitution states that Parliament shall enact legislation to give full effect to the provisions of Article 59. Further, Article 21(3) requires all State organs to address the needs of vulnerable groups and develop frameworks that promote the realization of rights, including the right to privacy. In that context, the creation of the ODPC was not only constitutional but necessary to ensure a focused and expert enforcement mechanism for data protection. 53. The Interested Party supports this position and submits that the mandates of the KNHREC and the ODPC are complementary rather than duplicative. It draws the Court’s attention to the structure of human rights enforcement in jurisdictions such as the European Union and South Africa, where national human rights institutions coexist with independent data protection regulators. In South https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 10

page 10 of 12

Africa, for example, the Information Regulator enforces the Protection of Personal Information Act (POPIA), while the South African Human Rights Commission retains a broader constitutional human rights mandate. These institutions operate within a coordinated framework that avoids functional conflict. 54. This Court agrees with the Respondents and the Interested Party that the mandates of the ODPC and the KNHREC are distinct both in origin and scope. While both institutions may incidentally engage with the same constitutional right, namely, the right to privacy under Article 31, their mandates are not in conflict. The KNHREC operates as an umbrella constitutional body responsible for general oversight, advocacy, and investigation of human rights violations. The ODPC, by contrast, is a specialized statutory regulator with technical oversight over data protection and digital privacy matters. 55. As the High Court noted in Nubian Rights Forum & 2 Others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR, the operationalization of the right to privacy necessitates both general and sector-specific enforcement institutions. The Court therein recognized the necessity of establishing a framework that includes specialized oversight over the increasingly complex issues surrounding data governance, including the collection, storage, and use of personal information. 56. Furthermore, the Constitution allows for functional decentralization and delegation. Article 186(2) and the Fourth Schedule envisage the sharing of responsibility between institutions at different levels of government and among different organs. Functional overlap alone is not unconstitutional unless it results in legal contradiction or jurisdictional paralysis, neither of which has been demonstrated in this case. 57. Additionally, the Petitioner has not shown any instance of direct conflict between the ODPC and the KNHREC. Nor has he produced evidence of a complaint being handled by both bodies simultaneously or inconsistently. In the absence of such demonstrable conflict, the Court cannot conclude that the concurrent mandates create an unconstitutional overlap. 58. Accordingly, the Court finds that the mandate of the ODPC does not unlawfully conflict or overlap with that of the KNHREC. Rather, the two institutions are designed to complement each other within Kenya’s constitutional and statutory human rights enforcement architecture. 59. The creation of the ODPC is a constitutionally valid legislative act designed to enhance the realization of the right to privacy under Article 31. Its existence does not derogate from the authority or mandate of the KNHREC but provides a necessary, expert-driven, and focused avenue for addressing privacyrelated complaints within a rapidly evolving digital context. 60. From the foregoing, the Court finds that the Petition is without merit. The legal architecture provided by the DPA, as currently framed, is sufficiently constitutional, functional, and necessary for the effective enforcement of the right to privacy under Article 31 of the Constitution. 61. Accordingly, the Petition dated 2nd February, 2025 is hereby dismissed in its entirety and each party shall bear their own costs given the public interest nature of the Petition. 52. Orders accordingly. File closed accordingly. DATED, SIGNED, AND DELIVERED VIRTUALLY THIS 12TH DAY OF AUGUST, 2025. BAHATI MWAMUYE JUDGE In the presence of: - https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 11

page 11 of 12

Petitioner In person -Harry Stephen Arunda Counsel for the 1st Respondent -Ms Karanu Counsel for the 2nd Respondent – No appearance Court Assistant – Ms Neema https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/12262/eng@2025-08-12 12

page 12 of 12