Godrey Kaburu Chabari & 1 other v Longhorn Publishers

3. Upon being served with the Notification of Complaint, the Respondent lodged its Statement of Response dated the 19th August 2024. It claimed that it neither knew the Appellants, nor what they did. It denied infringing their right to privacy. For purposes of publishing its works, it claimed that it sought materials from various entities. In respect to the Appellants’ photograph, it was its case that it sourced it from Nation Media Group PLC. It asserted that it purchased the photograph from them and that at the time of publication, the photograph belonged to the Nation Media Group. 4. In its letter dated 28th August 2024, the Data Protection Commissioner wrote to the Appellants indicating discontinuation of its case. It cited section 52(1)(a) of the Data Protection Act (hereinafter referred to as ‘the Act’), Regulation 7(1) of the Data Protection (Complaints Handling procedure and enforcement) Regulations], 2021 [hereinafter referred to as ‘the Regulations’] and the fact that the Respondent was duly registered-Government-Licenced publisher, publishing educational and creative books used in the Kenyan curriculum. 5. It was the said decision that led to the instant appeal. The Appeal: 6. The Appellants were disgruntled by the discontinuation of their case. Through a Memorandum of Appeal dated 18th November 2024 filed before this Court, they sought the setting aside and the substitution of the Data Commissioner’s decision with an order that their constitutional rights were infringed. They also sought compensation on grounds as hereunder: 1. The Data Protection Commissioner erred in law and in fact by holding that the use of the Appellants’ image was permitted by the Act. 2. The Data Protection Commissioner erred in law and in fact by failing to consider all the evidence on record before delivering its decision. 3. The Data Commissioner erred in law and in fact by finding that the image was covered under Section 52(1)(a) of the Data Protection Act whereas the said image was processed outside the scope of the Act as it was not used for educational purposes but for commercial purposes. 4. The Data Protection Commissioner erred in law and in fact by failing to take into account the fact that the image of the Appellants was published without their consent which amounts to an infringement of their right to privacy. 5. The Data Protection Commissioner erred in law and in fact by finding that the image was covered by section 52(1)(a) of the Act whereas the same was not pleaded not proven. 6. The Data Protection Commissioner erred in law and in fact by failing to direct its mind on the relationship between the said image and the Atlas which was so tenuous to be said to have any legitimate relation to the address. The Appellants’ submissions: 7. In their written submissions dated 10th March 2025, the Appellants argued that it was illegal for the Respondent to use its image without their consent, a right protected under Article 31 of the Constitution as read alongside Section 26 of the Data Protection Act. The Appellants relied on Jessicar Clarisse Wanjiru -vs- Davinci Aesthetics & Reconstruction Centre & 2 Others (2017) eKLR where the right to privacy was discussed to include the protection of intrusion into personal life or affairs or those of his family by direct physical means or by publication. The decision in FAF (suing on her own behalf and as a next friend of SAS and NAMS) -vs- the Norwegian Refugee Council (2019) eKLR was https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 2

page 2 of 10

also cited where it was observed the wide distribution of a pamphlet which had the photograph of the Petitioner and her children without their consent amounted to an infringing of their right to privacy. 8. In contesting the Data Commissioner’s decision to discontinue the case under section 52 of the Data Protection Act, the Appellants submitted that the principles of data protection were not applicable to processing of personal data. 9. The Appellants submitted that the use of their image in the Respondent’s literary works was not reasonable and justifiable under Article 24 of the Constitution. The Supreme Court decision in Karen Njeri Kandie -vs- Alassane Ba & Another (2017) eKLR and the Court of Appeal decision in Seventh Day Adventist Church (east Africa) limited -vs- Minster for Education & 3 Others (2017) eKLR were cited where it was rendered that any limitation of a constitutional right must pass the constitutional muster. The Appellants submitted that their publication was too wide and that Section 52(1)(a) is not specific enough to as to whether the publication of a person’s image is exempted in literary works. It was their case that the Atlas is used to educate learners on geographical features and their image was not necessary to illustrate to the learners any educational issue. 10. The Appellants further submitted that the Atlases are sold at approximately Kshs. 1728/- and Kshs. 986/- for CBC Edition and Comprehensive Primary School Atlas respectively and as such, the Respondent was in the business of publishing material for sale. It was their case that the Respondent conduct was contrary to Section 37 of the Data Protection Act which prohibits the use of personal data for commercial purposes. It was their case that pursuant to the decision in Shivenje Simani -vsNewspaper & Another (2021) eKLR, the use of their image was for public interest. The Respondent’s case: 11. The Respondent challenged the appeal through written submissions dated 9th April 2025. It was its case that, pursuant to Regulation 7(1)(a), the Data Commissioner did not fall into error when it discontinued the complaint. It submitted that the publication of the Appellants’ image was exempted from application of the Act under Section 52(1)(a) of the Act. It was its case that public interest was tied to the historic significance of the hike which marked the rebirth of the Kenya’s new Constitution. It submitted that the image in question was already publicly available and obscuring it would have undermined the significance and symbolism of the pivotal occasion. The Respondent also claimed that subject to Rule 14 of the Data Protection (General) Regulations, the Appellants’ image did not cover the scope over which data may be said to be used for commercial purposes. 12. Based on the exemption by Section 52(1)(a) of the Act, it was its case that the Atlas is a literary material approved by the Kenya Institute of Curriculum Development, used currently in Kenya. It asserted that the use of the image was in no way inducing the learners to purchase the book. It also submitted that the sole reason learners purchased the book was because it was approved by the Kenya Institute of Curriculum Development and the image added no commercial value to the book. 13. In submitting on Article 31 of the Constitution, the Respondent claimed that the Appellants’ image was not obtained in an intrusive manner as they were aware that the photograph was taken for public consumption during the hike. It was its case that the claimants failed to meet the threshold, as set in the case of Jessicar Clarisse Wanjiru -vs- Davinci Aesthetics & Reconstruction Centre & 2 Others (2017) eKLR to prove all the necessary elements to establish violation of the right to privacy. Further to the foregoing, the Respondent submitted that the Appellants’ failure to enjoin Nation Media Group to the suit was intentional so as to bolster the assumption that no consent was obtained. It argued that at the time of publishing the photograph, it understood that Nation Media Group PLC owned the image, https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 3

page 3 of 10

having sold the usage rights to it and any subsequent usage of the image was based on its authorization that was consistently renewed over time. 14. In maintained the position that if consent was to be obtained, the responsibility lied with Nation Media Group. Support to that end was drawn from the case of Clearview AI Inc -vs- The Information Commissioner (2023) UKFTT 00819 (GRC) where it was observed that data brokers bear the primary responsibility for compliance with data protection laws. In a different line of argument, the Respondent argued that statutes don’t operate retroactively, a principle that ensures individual and entities are given a fair notice of their legal obligations. It was also its case that the Appellants’ failure to object to the use of their image for a period of 10 years raised significant concerns on laches and it was unreasonable for them to suddenly challenge the usage of their images after more than 10 years. It claimed that the Appellants acquiesced to the ongoing use the image. 15. In conclusion, the Respondent urged this Court to find that the Appellants were not entitled to the reliefs sought and in the event this Court finds there was a was breach, a nominal award of Kshs. 100,000/-, based on the decision in Alternative Media Limited -vs- Safaricom Limited (2005) eKLR, Rukia Idris Barri -vs- Mada Hotels Limited (2013) eKLR and in Shivenje Simani -vs- Newspaper & Another (2021) eKLR be made. Analysis: 16. Having carefully considered the parties’ cases, the written submissions and the decisions referred thereto, two issues arise for determination. The first issue is preliminary in nature and relates to the retroactive application of the Act. Depending on the outcome of the preliminary issue, the Court may consider whether the decision by the Data Commissioner to discontinue the Appellants’ case was merited. 17. The jurisdiction of this Court to hear and determine an appeal from the decision of the Data Commissioner is not in dispute in this matter. It is donated by Section 64 of the Act. Being a first appeal, the role of this Court is as set out in Abok James Odera t/a AJ Odera & Associates -vs- John Patrick Machira t/a Machira & Co Advocates [2013] eKLR where it was observed thus: … This being a first appeal, we are reminded of our primary role as a first appellate court, namely, to re-evaluate, re-assess and re-analyse the extracts on the record and then determine whether the conclusions reached by the learned trial judge are to stand or not and give reasons either way. See the case of Kenya Ports Authority vs Kustron (Kenya) Limited 2000 2EA 212. 18. A consideration of the above issues now follows. The retroactive application of the Act: 19. It was the Respondent who raised this issue. It argued that since the Act was not in force at the time of the alleged infringement, then the Appellant’s claim is unsustainable under the Act. The Appellants took the contrary view in arguing that the infringement was against Article 31 of the Constitution and was ongoing. 20. With such divergent positions, a legal tour on the doctrine of retroactive application of the law is paramount. The Black’s Law Dictionary defines ‘retrospective’ law as: A law which looks backward or contemplates the past; one which is made to affect acts or facts occurring, or rights accruing, before it came into force. Every statute which takes away or impairs vested rights acquired under existing laws, or creates a new obligation, imposes https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 4

page 4 of 10

a new duty, or attaches a new disability in respect of transactions or considerations already past. One that relates back to a previous transaction and gives it a different legal effect from that which it had under the new law when it occurred. 21. In Republic -vs- Chengo & 2 others (Petition 5 of 2015) [2017] KESC 15 (KLR) the Supreme Court of Kenya cited U.S Supreme Court in Mapp -vs- Ohio, 367 US 643 (1961), where the Learned Judges, in deciding whether a convict could be released based on a new decision which held that illegally acquired evidence was inadmissible, spoke to retrospective application of statutes as follows: …. The effect of a subsequent Ruling of invalidity on prior final Judgments when collaterally attacked is not automatic retroactive invalidity, but depends upon a consideration of particular relations and conduct, or rights claimed to have become vested, of status, of prior determinations deemed to have finality, and of public policy in the light of the nature of the statute and its previous application…. The Constitution neither prohibits nor requires retroactive effect, and in each case, the Court determines whether retroactive or prospective application is appropriate. 22. The Apex Court further discussed the doctrine as under: 100. It is generally accepted that the prospectivity or retrospectivity of a statutory provision is to be determined on a case-to-case basis. That is why this Court, in the case of Samuel Kamau Macharia & Another v. Kenya Commercial Bank & Two Others (supra) stated: ….in interpreting the Constitution to determine whether it permits retrospective application of any of its provisions, a Court of law must pay due regard to the language of the Constitution. If the words used in a particular provision are forward-looking, and do not contain even a whiff of retrospectivity, the Court ought not to impart it into the language of the Constitution. Such caution is still more necessary if the importation of retrospectivity would have the effect of divesting an individual of his rights legitimately [accrued] before the commencement of the Constitution. 23. In the above case, although the Court was dealing with the retrospective application of the Constitution, the principles developed apply with equal force to statutes. 24. Earlier, the Supreme Court of Kenya had spoke to the retrospective application of statutes in Samuel Kamau Macharia & Another v. Kenya Commercial Bank and Two Others, Sup. Ct. Civil Application No. 2 of 2011, where the Court observed thus: …. As for non-criminal legislation, the general rule is that all statutes other than those which are merely declaratory or which relate only to matters of procedure or evidence are prima facie prospective, and retrospective effect is not to be given to them unless, by express words or necessary implication, it appears that this was the intention of the legislature. (Halsbury’s Laws of England, 4th Edition Vol. 44 at p.570). A retroactive law is not unconstitutional unless it: i. is in the nature of a bill of attainder; ii. impairs the obligation under contracts; iii. divests vested rights; or iv. is constitutionally forbidden. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 5

page 5 of 10

25. Deriving from the foregoing, it is apparent that the bar against retrospective application of the law is not cast in stone and such application is assessed on a case-to-case basis and on consideration of settled legal principles. 26. Turning back to the issue at hand, that is whether the Act applies retrospectively, a tour of the Act is imperative. The starting point is the Preamble which states that it is ‘An Act of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.’ Article 31[c] of the Constitution creates the right to privacy not to have one’s information relating to their family or private affairs unnecessarily required or revealed and Article 31[d] prohibits the infringement of the privacy of one’s communications. Therefore, the Act is primarily intended to protect persons from infringement of their private affairs. However, the right to privacy is also subject to some limitations provided for in the Act and in very clear instances. 27. In the case at hand, Sections 3 and 4 of the Act offer crucial insight on the question of whether the Act applies retrospectively. Section 3 is on the object and purpose of the Act. It provides inter alia that the Act aims at regulating the processing of personal data; ensuring that the processing of personal data of a data subject is guided by the principles set out in Section 25; protects the privacy of individuals; establishes the legal and institutional mechanism to protect personal data; and provides data subjects with rights and remedies to protect their personal data from processing that is not in accordance with this Act. 28. Section 4 is on the application of the Act. It provides that the Act applies to the processing of personal data which is entered in a record, by or for a data controller or processor, by making use of automated or nonautomated means provided that when the recorded personal data is processed by non-automated means, it forms a whole or part of a filing system. The Act also applies to a data controller or data processor who is established or ordinarily resident in Kenya and processes personal data while in Kenya; or not established or ordinarily resident in Kenya, but processing personal data of data subjects located in Kenya. 29. A reading of the above provisions makes it clear that the Act is aimed at giving effect to Article 31(c) and (d) of the Constitution. The Appellants’ complaint emanated from the events of 27th August 2010, the historic day which this country promulgated its current Constitution. The day was celebrated by many significant events heralding Kenya as a great nation world over. One of the events was the hoisting of the Kenyan flag at the top of Mt. Kenya alongside the new Constitution. From the record, it seems that the Appellants took part in that event. It can, therefore, be safely said that by the time the Kenyan flag was hoisted, the now Constitution was already in force and as such, the Appellants right to privacy was firmly guaranteed under Article 31 thereof. In other words, by the time the Kenyan flag and the Constitution found their way to the top of Mt. Kenya, the Appellants’ right to privacy had vested. 30. The Appellants voiced their complaint sometimes in June 2024 after the Act became operational on 25th November 2019. That was 5 years later. Therefore, to the Appellants, there is a continuing violation of their rights by the Respondent. 31. In that case, this Court finds and hold that the Act should apply to the complaint for three main reasons. The first reason is that, unlike in other instances, there was no timeline provided for under the Fifth Schedule of the Constitution [as read with Article 261] within which a legislation giving effect to the Article 31 rights would be enacted. It, therefore, means the Article 31 rights vested on the promulgation of the Constitution and became applicable unless specifically prohibited under the Constitution and the law. The Act could then not stand on the way of the Constitution. The second https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 6

page 6 of 10

reason is that the Act is not in the nature of an Act of attainder, there is also no evidence that the Act impairs any of the parties’ obligations under any contracts; and the Act does not divest any of the parties’ already vested rights, but instead gives effect to such and, lastly, the Act has not been declared unconstitutional. The third reason is the allegation that the violation of the right to privacy is continuing. Such must be interrogated. It is for these reasons that this Court affirms that the Act applies to the complaint at hand unless specifically prohibited in law. 32. With the above finding, a consideration of the second issue follows. Whether the decision by the Data Commissioner to discontinue the Appellants’ case was merited: 33. It is not disputed that the complaint was discontinued by the Data Commissioner on the basis of inter alia Section 52(1)(a) of the Act as the Commissioner was persuaded that the processing of the Appellants’ photograph was undertaken for the publication of a literary or artistic material. However, the Appellants contended that their image was protected under Section 26 of the Act and as such, the principles of data protection were applicable. The Appellants also contested that the publication was done not only without their consent, but also were used to advance the Respondent’s commercial interest. To that end, they stated that there are two editions of the Respondent’s Atlases where their photograph appears and the publications are retailing at approximately at Kshs. 1728/= and Kshs. 986/= respectively, hence the appeal. 34. Before going further into this discussion, this Court will look at some provisions of the Act and Regulations which are pertinent herein. Section 25 of the Act provides for the principles of data protection as follows: Principles of Data Protection 25. 35. Every data controller or data processor shall ensure that personal data is a. processed in accordance with the right to privacy of the data subject; b. processed lawfully, fairly and in a transparent manner in relation to any data subject; c. collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; d. adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; e. collected only where a valid explanation is provided whenever information relating to family or private affairs is required; f. accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; g. kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and (h) not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject. The above principles are specifically curtailed from application by Sections 51[2], 52, 53 and 54 of the Act. Given the centrality of these provisions to the subject at hand, this Court will reproduce them verbatim. Section 51[2] states as under: The processing of personal data is exempt from the provisions of this Act if- https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 7

page 7 of 10

36. (a) it relates to processing of personal data by an individual in the course of a purely personal or household activity; (b) if it is necessary for national security or public interest; or (c) disclosure is required by or under any written law or by an order of the Court. Section 52 of the Act provides as follows: Journalism, literature and art: (1) 37. The principles of processing personal data shall not apply where a. processing is undertaken by a person for the publication of a literary or artistic material; b. data controller reasonably believes that publication would be in the public interest; and c. data controller reasonably believes that, in all the circumstances, compliance with the provision is incompatible with the special purposes. (2) Subsection (1)(b) shall only apply where it can be demonstrated that the processing is in compliance with any self-regulatory or issued code of ethics in practice and relevant to the publication in question. (3) The Data Commissioner shall prepare a code of practice containing practical guidance in relation to the processing of personal data for purposes of Journalism, Literature and Art. Section 53 has the following: Research, history and statistics (1) The further processing of personal data shall be compatible with the purpose of collection if the data is used for historical, statistical or research purposes and the data controller or data processor shall ensure that the further processing is carried out solely for such purposes and will not be published in an identifiable form. (2) The data controller or data processor shall take measures to establish appropriate safeguards against the records being used for any other purposes. (3) Personal data which is processed only for research purposes is exempt from the provisions of this Act if— (4) (a) data is processed in compliance with the relevant conditions; and (b) results of the research or resulting statistics are not made available in a form which identifies the data subject or any of them. The Data Commissioner shall prepare a code of practice containing practical guidance in relation to the processing of personal data for purposes of Research, History and Statistics. 38. Section 54 of the Act gives the Data Commissioner powers to prescribe other instances where compliance with certain provisions of this Act may be exempted. 39. Further exemptions are provided for under the Data Protection (General) Regulations. For instance, Part III of the Regulations restricts the commercial use of personal data in some great detail whereas Part II robustly enables the rights of a data subject. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 8

page 8 of 10

40. Returning to the matter at hand, the Data Commissioner served the complaint on the Respondent and called for a response. In its Statement of Response, the Respondent described itself as a publisher of quality educational and creative books in East and Central Africa region. It averred that the publication of the Appellants’ image was exempted from application of the Act under Section 52 of the Act as the material was used in publication of a literary or artistic material and in public interest. It was its case that public interest was tied to the historic significance of the hike which marked the rebirth of the Kenya’s new Constitution. It further stated that the image in question was already publicly available and obscuring it would have undermined the significance and symbolism of the pivotal occasion. The Respondent also stated that it understood that Nation Media Group PLC owned the image, having sold the usage rights to it and any subsequent usage of the image was based on its authorization that was consistently renewed over time. The Respondent, therefore, also claimed that subject to Rule 14 of the Data Protection (General) Regulations, the Appellants’ image did not cover the scope over which data may be said to be used for commercial purposes. 41. It was upon consideration of the said response as against the complaint that the Data Commissioner was satisfied that the complaint be discontinued under Section 52[1][b] of the Act as read with Regulation 7 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations. 42. This Court has keenly considered this issue. Whereas there can be no dispute that the Data Commissioner has power under the Act to discontinue a complaint, the exercise of such administrative action ought to be in line with the Constitution and the law. In this case, from the appreciation of the parties’ cases, it is apparent that several issues emerged that needed a further consideration by the Data Commissioner before reaching the decision to discontinue the complaint. For instance, there were several unsettled contentions by the parties including that the publication was used for literary and artistic purposes on one hand and on the other hand that it was used for commercial purposes, the issue of the Appellants’ consent given that the Respondent alleged to have obtained the photograph from Nation Media Group at a price; among other issues. 43. It is, therefore, apparent that the complaint was not a clear cut one which could be determined summarily. It called for a further consideration including according the Appellant an opportunity to react to the Respondent’s Statement of Response and a proper look into the issue of whether the publication was used for literary and artistic purposes alongside the consent allegedly obtained from Nation Media Group at a fee was to follow. 44. Having said so, this Court takes the position that since the Act routes for giving effect to, and the protection of the right to privacy under Article 31[c] and [d] of the Constitution, and in such a detailed manner, then a decision to discontinue a complaint instituted before the Data Commissioner should only be reached in the clearest of cases or alternatively, in instances where all parties are heard on the proposed discontinuation in line with Article 47 of the Constitution. By doing so, the Data Commissioner will be yielding to the will of the people of Kenya. To this Court, the complaint raised serious constitutional and legal issues which called upon the Data Commissioner to clearly express itself on each of them. 45. Having so found and held, it goes beyond any peradventure that the Data Commissioner’s decision to discontinue the complaint was premature. The Data Commissioner’s decision be and is hereby accordingly impugned. Disposition: 46. In the premises, the appeal succeeds and the following final orders hereby issue: - https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 9

page 9 of 10

(a) The Data Commissioner’s letter of 28th August 2024 Referenced; ‘Discontinuation of ODPC/ COMP/0966/2024 Godfrey Kaburu Chabari & Absolom Gachoria Gatiaga -vs- Longhorn Publishers (Kenya) PLC’ communicating to the Appellants’ Advocates the decision to discontinue the Appellants’ case is hereby quashed and is set aside in its entirety. (b) An order hereby issues remitting the dispute, ODPC/COMP/0966/2024 Godfrey Kaburu Chabari & Absalom Gachoria Gatiaga -vs- Longhorn Publishers (Kenya) PLC, to the Office of Data Protection Commissioner for further consideration and in line with this judgment. (c) The Respondent shall bear the costs of the appeal. Orders accordingly. DELIVERED, DATED AND SIGNED AT NAIROBI THIS 30TH DAY OF SEPTEMBER, 2025. A. C. MRIMA JUDGE Judgment virtually delivered in the presence of: Mrs Lenaola, Learned Counsel for the Appellants. Michael/Amina – Court Assistants. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/13387/eng@2025-09-30 10

page 10 of 10