Sardelli & 5 others v Safaricom Plc

3. On various dates between 16th January 2021 and 4th February 2022, the petitioners received phone calls from phone numbers 072036xxxx, 070212xxxx, 070621xxxx, 07110621xxxx, 071106xxxx, 071861xxxx, 011133xxxx, 020268xxxxand 020800xxxxx. Those phone numbers fraudulently and unlawfully withdrew money from the petitioners’ M-peas and Fuliza accounts, leading to total a loss of Kshs. 1,707, 147. 4. The petitioners reported the matter to police at Timau Police Station on 21st December 2021 -OB No. 13/21/12/2021; Karen Police Station on 25th January 2022- OB No. 43/25/1/2022 and OB 033 on 15th January 2022. The petitioners also reported the fraud to their respective banks and to the respondent through its customer care and legal departments. 5. The petitioners stated that that upon reviewing the phone contacts, they discovered that the numbers had been used on numerous occasions despite having reported and flagged the numbers as being used by fraudsters. Despite bringing this fact to the respondent’s attention, no action was taken in breach of the respondent’s responsibilities as a trustee under its the terms and conditions as well as data protection policy. 6. On 14th April 2022, the petitioners’ advocates wrote to the respondent seeking information regarding the perpetrators without any response. The petitioners stated that they intend to bring proceedings against the fraudsters but are unable to do so due to the respondent’s refusal supply information sought. 7. The petitioners maintained that this court has jurisdiction under article 23(1) as read with article 165(3) of the Constitution to hear and determine this petition and that they have locus to bring this petition to vindicate their rights. The petitioners denied the respondent’s claim that it has put in place comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data. 8. The petitioners maintained that they supplied information the respondent had requested through the respondent’s customer care such as the dates and time the fraudsters siphoned money from them but the information sought was not given necessitating the filing of this petition. 9. According to the petitioners, the information requested is on the details and contact numbers of fraudsters who siphoned money from their M-pesa and Fuliza accounts which is within the respondent’s possession; whether the numbers had been flagged and consequently blocked to avoid further fraudulent activity; names and identification card numbers of registered owners of those numbers and the registered names and numbers of the recipients of the money from the fraudulent transactions. The petitioners maintained that the request is reasonable and would only assist in conducting further investigations against the fraudsters. 10. The petitioners asserted that the request to access is specific to the fraudsters but not universal to all data held by the respondent. According to the petitioners, the respondent has not alleged that any of the phone numbers used to perpetuate fraud against them belongs to a different network service provider and therefore the information is within the respondent’s exclusive knowledge regarding the identity of the fraudsters. 11. Based on the above concerns, the petitioners sought the following reliefs: a. A declaration that the failure by the respondent to provide information sought under article 35(1) of the Constitution of Kenya 2010 on the basis of the petitioners’ request dated 14th April 2022 is a violation of the right of access to information. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 2

page 2 of 15

b. An order compelling the respondent to forthwith provide the petitioners with the information sought in their letter dated 14th April 2022 to wit: c. The names and identification card numbers of the registered owners of the above mentioned numbers. d. The names and telephone numbers of the registered recipients of fraudulent M-pesa transactions. e. General, exemplary and aggravated damages under article 23(3) of the Constitution of Kenya 2010 for the unconstitutional conduct of the respondent f. Costs of this petition. g. Any other order that the court may deem fit to grant. Response 12. The respondent opposed the petition through a preliminary objection on the jurisdiction of the court. The respondent asserted that the petition is premature because the petitioners did not exhaust the available alternative remedy under the Kenya Information Communications Act and Kenya Information and Communications (Dispute Resolution) Regulations, 2010; that the petition violates the arbitration agreement in clause 12 of the respondent’s and conditions for use of its services which mandates that all disputes between the respondent and its subscribers be resolved through arbitration under the arbitration Act. 13. The respondent also filed a replying affidavit sworn by Daniel M. Ndaba (Mr. Ndaba). The respondent again denied the jurisdiction of this court on the basis that it had been invoked prematurely since the petitioners should have presented their claim in accordance with the Kenya Information and Communications Act. Further, that the petitioners had failed to demonstrate that they are eligible to present a claim of the Constitution to access the information held by the respondent. 14. The respondent maintained that it is a data controller and processor under the Data Protection Act thus, takes data protection seriously and has implemented comprehensive technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data. 15. The respondent asserted that it takes additional steps such as cautioning subscribers not to share confidential information with third parties; publicly providing information on how it engages with subscribers; numbers it uses, information it seeks or does not; sending fraud tips to create awareness on evolving scams; information on how transactions on M-pesa, Fuliza, PIN changes, and SIM swaps are properly completed, among others.The respondent further stated that it collaborates with security agencies to investigate subscribers that are alleged to be used in perpetrating fraud. 16. The respondent admitted that the petitioners are its subscribers and that it indeed received the demand letter. The respondent stated, however, that it responded to the petitioners’ demand on 29th June 2022 and sought detailed and specific information, including dates and subscribers involved in the reported incidents but the petitioners did not supply the information sought instead proceeded to file this petition. 17. According to the respondent, the petition lacks clarity and substantiation on specific dates and time calls were made by each of the listed numbers to each of the petitioners; circumstances and details surrounding the transactions resulting in the alleged transfer of Kshs. 1,707,147 from M-pesa and Fuliza accounts and registration details of numbers 071106214162; 0202680030 and 0208004020. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 3

page 3 of 15

18. The respondent contended that the petitioners had failed to demonstrate that disclosure of the information requested would not result in an unjustified intrusion into the privacy of its subscribers or that it will serve to safeguard or protect a constitutional right.The respondent took the view, that if the information sought is disclosed, it may be subjected to claims of releasing sensitive information and in a manner incompatible with the purposes for which information was collected under the Constitution, the Data Protection Act and the Kenya Information Communication Act. 19. The respondent denied breaching contractual terms or being negligent in preventing fraud. According to the respondent, the fraud and investigations team did not find abnormal activity on Sim cards; ownership of handsets used and confirmed proper verification of SIM swap interactions. The respondent denied liability for alleged losses. Submissions 20. This petition was disposed of through written submissions with brief oral highlights. Petitioners’ submissions 21. Mr. Gross, leading Mr. Ojiambo, for the petitioners, highlighting their written submissions, that the respondent violated the petitioners’ right of access to information guaranteed under Article 35 of the Constitution and sections 4 Access to Information Act. 22. Learned counsel argued that the petitioners were defrauded by the respondent’s subscribers which the respondent cannot deny, and relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another [2012] eKLR. 23. Learned counsel asserted that the respondent’s argument that the petition is premature had been abandoned in the submissions. 24. Learned counsel argued that the information sought is not universal to all data held by the respondent but specific to the fraudsters. In learned counsel’s view, the respondent had not denied that the phone numbers used to defraud the petitioners belonged to its subscribers thus, the information is within the respondent’s exclusive knowledge as to who the subscribers and therefore fraudsters are. 25. Mr. Cross submitted that the information was requested for purposes of instituting proceedings against the fraudsters and the respondent’s continued refusal to allow access to information warrants scrutiny; is a violation of the petitioners’ constitutional rights and the respondent had not shown that reasons for declining to allow access fall within the exceptions in section 6 of the Access to Information Act thus, the refusal is spurious. Learned counsel relied on the decision in Youth Initiative for Human Rights v Serbia (Application No. 48135/06). 26. Mr. Gross argued that Kenya Information Communications Act and the Regulations do not provide that making a report to the Tribunal is a condition precedent to invoking the jurisdiction of this court when dealing with a petition challenging constitutional violations. The regulations do not also oblige the petitioners to move the tribunal first before approaching this court. 27. Mr. Gross submitted that this court has unlimited jurisdiction under article 165 (3) (b) of the Constitution to determine the question whether a right or fundamental freedom in the Bill of Rights has been denied, violated, infringed or threatened. Counsel relied on the decision in Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested parties) [2022] KEHC 368 (KLR). https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 4

page 4 of 15

28. Regarding the petitioners’ locus to bring this petition, learned counsel argued that by virtue of article 24(3) of the Constitution the burden is on the respondent to demonstrate to the court why the information sought should not be accessed. Reliance was placed on Legal Advice Centre t/a Kituo Cha Sheria & 33 others v Cabinet Secretary, Ministry of Education & 7 others [2021] KEHC 390 (KLR). 29. Mr. Gross went on to argue that the respondent’s contention that disclosure of the information sought would result in an unjustified intrusion to privacy of subscribers was not substantiated. Learned counsel maintained that the petitioners provided details the respondent sought which was in their possession through their advocate such as phone calls and reports made to the respondent’s customer care. Learned counsel again relied on article 23(3) of the Constitution and the decisions in Siewchand Ramanoop v The Attorney General of Trinidad and Tobago, (PC Appeal No 13 of 2004) for the position that when exercising constitutional jurisdiction, the court is concerned with upholding or vindicating the constitutional right which has been contravened. A declaration by the court will articulate the fact of the violation, but in most cases, more will be required than words. If the person wronged has suffered damage, the court may award him compensation. 30. Learned counsel argued that the issue of citizenship should not arise since the respondent registered the subscribers and should know better. Data protection laws cannot oust the Constitution and refusing to supply information sought is offering protection to the fraudsters. Respondent’s submissions 31. Miss. Opondo, learned counsel for the respondent submitted highlighting their written submissions, that although access to information is a constitutional right, the right is qualified. Counsel relied on article 35 of the Constitution, sections 2, 4 and 6(d) of Access to Information Act. 32. Learned counsel maintained that the right of access to information is not absolute: First, the respondent is not a state agency to justify allowing access to information under article 35(1) of the Constitution. Second, to enforce the right against a non-state entity, a citizen seeking to access information must demonstrate that the information is held by the entity in question and that the information sought is necessary for exercising or enforcing another right. Lastly, limitation is justified within article 24 of the Constitution. 33. Miss. Opondo maintained that the petitioners are not citizens for purposes of accessing information under article 35. Counsel relied on the decision in Famy Care Limited v Public Procurement Administrative Review Board & another & 4 others (supra); Nairobi Law Monthly Company Limited Kenya Electricity Generating Company & 2 others [2013] eKLR; Timothy Njoya v Attorney General & another [2014] eKLR; and Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Interested Parties) [2022] KEHC 368 (KLR). 34. Learned counsel took the view, that providing information sought would disclose names and identification card numbers of registered subscribers of the mobile phone numbers which would violate customers’ right to privacy. Counsel maintained that the respondent has implemented technical and operational measures to safeguard the integrity and confidentiality of subscribers’ data; that the respondent is bound by its data privacy statement whose clause 4 stipulates to whom it can disclose customer data and that the petitioners do not fall under the categories at clause 4. 35. Miss. Opondo again argued that disclosing the information sought would risk claims against the respondent for disclosing sensitive information and in a manner incompatible with the purposes for which that information was collected, thus, a violation of sections 25(a), 25(c), 25(d), 26(a)and 26(c) of the Data Protection Act; section 27A (2) of the Kenya Information and Communication Act as https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 5

page 5 of 15

read with regulation 16(1) of the Kenya Information and Communication (Registration of SIMCards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010. 36. Learned counsel asserted that the respondent has been proactive in its efforts to reduce fraud and has taken steps to that effect. According to counsel, the respondent acted properly in declining to allow access to the information requested and urged the court to dismiss the petition with costs. Determination 37. I have considered the pleadings, arguments made on behalf of the parties and the decisions relied on. The issues that arise for determination are whether this court has jurisdiction to preside over this petition and, depending on the answer to this issue, whether the petitioners’ right of access to information was violated and what reliefs to grant. Jurisdiction 38. The respondent argued that the petitioners approached this court prematurely before exhausting the available alternative remedy provided for under the Kenya Information Communications Act and regulations made thereunder. In essence, the respondent’s objection is that this court cannot exercise jurisdiction to determine this petition where the available alternative remedy has not been exhausted. 39. The petitioners contended, on their part, that alternative remedy provisions cannot oust the jurisdiction of this court where the issue raised is on violation of constitutional rights. They therefore maintained that this court has jurisdiction to hear and determine this petition. 40. Jurisdiction is the power or authority given to a court to hear and determine a dispute presented before it. When jurisdiction of the court is in issue, the court has to carefully consider and determine this fundamental question of its jurisdiction over the matter. Whether a court has jurisdiction to hear a matter or not, is a threshold question to be determined based on the facts of the particular case before court and at the earliest opportunity. 41. Should the court determine that it has no jurisdiction to hear the matter, that is the end of the matter. The court should not take any further step, but down its tools. (See Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited [1989] eKLR). 42. In Samuel Kamau Macharia v Kenya Commercial Bank Ltd & 2 others [2012] eKLR, the Supreme Court stated: (68) 43. A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law…without jurisdiction, the Court cannot entertain any proceedings…Where the Constitution exhaustively provides for the jurisdiction of a Court of law, the Court must operate within the constitutional limits. It cannot expand its jurisdiction through judicial craft or innovation. In re the Matter of the Interim Independent Electoral Commission (Applicant), Constitutional Application Number 2 of 2011 [2011] eKLR, the Supreme Court, after referring to the decision in Owners of Motor Vessel “Lillian S” v Caltex Oil (Kenya) Limited (supra), observed: https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 6

page 6 of 15

[30] The Lillian ‘S’ case establishes that jurisdiction flows from the law, and the recipient-Court is to apply the same, with any limitations embodied therein. Such a Court may not arrogate to itself jurisdiction through the craft of interpretation, or by way of endeavours to discern or interpret the intentions of Parliament, where the wording of legislation is clear and there is no ambiguity. In the case of the Supreme Court, Court of Appeal and High Court, their respective jurisdictions are donated by the Constitution. 44. It follows that jurisdiction of a court must flow from the Constitution, statute or both. The court should therefore only exercise jurisdiction as conferred on it by the Constitution or the law. It must not act without jurisdiction. 45. The respondent’s argument is that this court has no jurisdiction because the petitioners had an alternative remedy provided for under the Kenya Information and Communications Act and regulations made thereunder which they should have exhausted before invoking the jurisdiction of this court and therefore this Court should not hear the petition. 46. The objection, if I understand it, cannot be that this court has no jurisdiction to hear this petition. Rather, the respondent urges the court to decline to exercise its jurisdiction since the petitioners had not exhausted the available alternative remedy. 47. Section 9(2) and (3) of the Fair Administrative Action Act preclude this court from reviewing administrative decisions unless a party had exhausted all the remedies available. Section 6 of the Act provides that a person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision to a court in accordance with section 8; or a tribunal in exercise of its jurisdiction conferred in that regard under any written law. 48. Subsection (2) provides for the decisions the tribunal may make in reviewing the administrative action. Section 8 states that an application for the review of an administrative action or an appeal under the Act should be determined within ninety days of filing the application. 49. On the other hand, section 9(1) provides that subject to subsection (2), a person who is aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of any administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution. Subsection (2) states that the High Court or a subordinate court under subsection (1) should not review an administrative action or decision under the Act unless the mechanisms, including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted. 50. Under subsection (3), the High Court or a subordinate court should, if it is not satisfied that the remedies referred to in subsection (2) have been exhausted, direct an applicant to first exhaust such remedy before instituting proceedings under subsection (1). 51. Sub section (4) states that notwithstanding subsection (3), the High Court or a subordinate court may, in exceptional circumstances and on application, exempt such person from the obligation to exhaust any remedy if the court considers such exemption to be in the interest of justice. 52. The import of section 9(2) is that a person aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of an administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to article 22(3) of the Constitution after being satisfied that alternative remedies have been exhausted. If not, the court should direct the person to first exhaust such remedies before instituting proceedings before it. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 7

page 7 of 15

53. The respondent argued that the Kenya Information and Communications Act, provides an alternative remedy for resolution of the petitioners’ grievances which they did not invoke. The request to access would also violate regulation 16(1) of the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015 and regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010. 54. The petitioners’ position is that they approached this court raising a claim on constitutional violations which cannot be determined through an alternative remedy as the respondent argued. According to the petitioners, the respondent’s refusal to allow access to the information sought violated their right of access to information guaranteed under article 35 of the Constitution which this court has jurisdiction to remedy but not to any other body or tribunal. 55. Section 27A of the Kenya Information Communications Act is on the duties of telecommunications operators.Subsection (3) of the Act provides that notwithstanding the provisions of subsection (2) (c) (which requires that details of a subscriber be kept in secure and confidential manner), a telecommunications operator may disclose the registration particulars of a subscribera. for the purpose of facilitating the performance of any statutory functions of the Authority; b. In connection with the investigations of any criminal offence or for the purpose of any criminal proceedings; or c. for the purpose of any civil proceedings under the Act. 56. Section 27A (3) (b)(c) seems to allow disclosure of particulars of a registered subscriber for purposes of criminal investigations or in case of civil proceedings, with regard to civil proceedings initiated under the Act. 57. Section 102 of the Act on the other hand establishes the Communications and Multimedia Appeals Tribunal, provides for its membership and the manner of its constitution. Section 102A provides for the complaints the Tribunal may consider while section 102F provides for appeals to the Tribunal. The petitioner’s claim is based on article 35 (1)(b) of the Constitution because of the respondent’s failure to allow their request to access information. 58. The respondent’s argument that the petitioners did not exhaust the available remedy under Kenya Information and Communications Act was not demonstrated. That is; the respondent did not identify the section that provided the petitioners with a remedy that would be effective to the petitioners’ case in so far as their request to access information was concerned. The respondents did not also show how the body would deal with the petitioners’ complaint on the decline to allow access. 59. The respondent made reference to section 16(1) of Kenya Information and Communication (Registration of SIM-Cards) Regulations, 2015 arguing that the request if acceded to would be violative to the regulations as well as regulations 3(1) (d) and 15 of Kenya Information and Communications (Consumer Protection) Regulations, 2010. 60. The respondents did not argue that the alternative remedy the petitioners should have invoked was efficient and effective in the circumstances of the petitioners’ case. The respondent did not also demonstrate how, if at all, that remedy would be effective to the petitioners’ claim. This court takes the view, that where the controversy is purely one raising constitutional violation, interpretation or violation of rights and fundamental freedoms, the issue should be decided by this court exercising its constitutional jurisdiction instead of dismissing the petition on ground of availability of an alternative remedy. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 8

page 8 of 15

61. This view is informed by the fact that article 22 of the Constitution grants every person the right to institute court proceedings claiming that a right or fundamental freedom in the Bill of Rights has been denied, violated or infringed, or is threatened. Article 23 (1) as read with article 165(3) then confers on the court jurisdiction to hear and determine applications for redress of denial, violation or infringement of, or threat to, a right or fundamental freedom in the Bill of Rights while Article 23 (3) provides for remedies the court may grant in respect of proceedings brought under article 22. 62. Article 165(3) (b) provides that this court has jurisdiction to determine the question whether a right and fundamental freedom in the Bill of rights has been denied, violated, infringed or is threatened. Indeed, section 9(1) of the Fair Administrative Action Act acknowledges that original jurisdiction is conferred on this court. In that regard, everything else, including exhaustion of alternative remedy, is subject to the Constitution and not otherwise. 63. In R v National Environmental Management Authority, (CA No 84 of 2010); [2011] eKLR, the Court of Appeal observed that: Where there was an alternative remedy and especially where Parliament had provided a statutory appeal procedure, it is only in exceptional circumstances that an order for judicial review would be granted, and that in determining whether an exception should be made and judicial review granted, it was necessary for the court to look carefully at the suitability of the statutory appeal in the context of the particular case and ask itself what, in the context of the statutory powers, was the real issue to be determined and whether the statutory appeal procedure was suitable to determine it. 64. In Albert Chaurembo Mumba & 7 others v Maurice Munyao & 148 others (Petition No. 3 of 2016), [2019] KESC 83 (KRL), the Supreme Court stated: Where there exists an alternative method of dispute resolution established by legislation, courts must exercise restraint in exercising their jurisdiction as conferred by the Constitution and must give deference to the dispute resolution bodies established by statute with the mandate to deal with such specific disputes in the first instance. 65. In Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (Petition E007 of 2023), [2023] KESC 113 (KLR), the Supreme Court again stated: [105] [T]he availability of an alternative remedy does not necessarily bar an individual from seeking constitutional relief. This is because the act of seeking constitutional relief is contingent upon the adequacy of an existing alternative means of redress. If the alternative remedy is deemed inadequate in addressing the issue at hand, then the court is not restrained from providing constitutional relief. But there is also a need to emphasize the need for the court to scrutinize the purpose for which a party is seeking relief, in determining whether the granting of such constitutional reliefs is appropriate in the given circumstances. This means that a nuanced approach to the relationship between constitutional reliefs for violation of rights and alternative means of redress, while also considering the specific circumstances of each case to determine the appropriateness of seeking such constitutional reliefs, is a necessary prerequisite on the part of any superior court. 66. Far afield, the Supreme of India observed in Union of India v. T.R. Vermai, 1957 AIR 882, 1958 SCR 499, that “It is well settled that when an alternative and equally efficacious remedy is open to a litigant, https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 9

page 9 of 15

he should be required to pursue that remedy and not to invoke the special jurisdiction of the High Court to issue a prerogative writ.” 67. The Supreme Court of India again stated in Godrej sara lee Ltd v the Excise and Taxation OfficerCum-Assessing Authority & Others (Civil Appeal No 5393 of 2010), that “entertainability” and “maintainability” of a writ petition are distinct concepts. Availability of an alternative remedy does not operate as an absolute bar to the “maintainability” of a writ petition. The rule which requires a party to pursue the alternative remedy provided by a statute is a rule of policy, convenience and discretion rather than a rule of law. 68. The jurisprudence emerging from the above decisions is that an alternative remedy should be effective and efficacious otherwise the court has original jurisdiction to hear the dispute if the available alternative remedy is not suitable in the circumstances of the particular case. 69. In the circumstances of this case, the respondent did not demonstrate that there was an efficacious and effective remedy under Kenya Information and Communications Act to the petitioners’ claim for access to information to persuade this court decline to exercise its jurisdiction over the petition. Consequently, the argument that this court has no jurisdiction fails. Right of access 70. Having determined the issue of jurisdiction, the next issue is whether the petitioners’ right of access to information was violated. The petitioners argued that the respondent violated this right when it declined to supply information sought. According to the petitioners, the information sought was in the respondent’s possession and was for purposes of instituting criminal investigations and civil proceedings against the persons who defrauded them but the respondent declined despite giving the details the respondent wanted. 71. The respondent on its part argued that the petitioners did not give details it had sought; that if the information sought was supplied it would have violated the right to privacy thus, expose it to claims of violation of privacy and that the petitioners are not citizens for purposes of access to information under article 35 of the Constitution. 72. Article 35 provides: (1). Every citizen has the right of access toa. information held by the State; and b. information held by another person and required for the exercise or protection of any right or fundamental freedom. 73. There is no dispute that the right to information is at the core of the exercise and enjoyment of all other rights by citizens and is a right expressly recognised in the Constitution. The essence of the right of access to information has been explained in many decisions. 74. In Brummer v Minister for Social Development (CCT 25/09) [2009] ZACC 21; the Constitutional Court of South Africa stated that “access to information is fundamental to the realisation of the rights guaranteed in the Bill of Rights. For example, access to information is crucial to the right to freedom of expression which includes freedom of the press and other media and freedom to receive or impart information or ideas.” https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 10

page 10 of 15

75. In President of Republic of South Africa v M & G Media (CCT 03/11) [2011] ZACC 32; the Constitutional Court of South Africa again stated: [10] The constitutional guarantee of the right of access to information held by the state gives effect to “accountability, responsiveness and openness” as founding values of our constitutional democracy. It is impossible to hold accountable a government that operates in secrecy. The right of access to information is also crucial to the realisation of other rights in the Bill of Rights. The right to receive or impart information or ideas, for example, is dependent on it. In a democratic society such as our own, the effective exercise of the right to vote also depends on the right of access to information. For without access to information, the ability of citizens to make responsible political decisions and participate meaningfully in public life is undermined. 76. Back at home, in Nairobi Law Monthly Company Limited Kenya Electricity Generating Company & 2 others (supra) the court stated: [56] …State organs or public entities … have a constitutional obligation to provide information to citizens as of right under the provisions of Article 35(1)(a)....they cannot escape the constitutional requirement that they provide access to such information as they hold to citizens. 77. Similarly, in Katiba Institute v President’s Delivery unit (supra), this court observed that the right to access information is a foundational human right upon which other rights must flow. And for citizens to protect their other rights, the right to access information becomes critical for any meaningful and effective participation in the democratic governance of their country. 78. The court went on to state: (29) 79. The importance of this right was fully appreciated by the drafters of our Constitution and they dutifully included Article 35 to make this right attainable as the foundation for an open, responsive, accountable and democratic government and its institutions. The Constitution therefore, grants citizens’ access to information as a constitutional right and only the same Constitution can limit that access. To actualize article 35, Parliament enacted Access to Information Act in 2016 whose section 4 provides for accessing information. The section repeats the words in article 35 providing: 1. 2. 3) Subject to this Act and any other written law, every citizen has the right of access to information held by— (a) the State; and b) another person and where that information is required for the exercise or protection of any right or fundamental freedom. Subject to this Act, every citizen's right to access information is not affected by— a) any reason the person gives for seeking access; or b) the public entity's belief as to what are the person's reasons for seeking access. Access to information held by a public entity or a private body shall be provided expeditiously at a reasonable cost. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 11

page 11 of 15

4) This Act shall be interpreted and applied on the basis of a duty to disclose and non-disclosure shall be permitted only in circumstances exempted under section 6 80. Under section 8, a citizen wishing to access information should do so in writing with sufficient details and particulars to enable the public officer understand what information is being requested. The Act makes it clear that information should be given without delay and at a reasonable cost, notwithstanding why the citizen wants to access information. Section 9 provides that a decision on the request to access information should be made and communicated within 21 days. The communication should include whether the public entity has the information and whether it will provide access to the information. 81. The petitioners stated that they requested information in writing but the respondent did not provide the information sought. The respondent on its part argued, first; that it sought details regarding the information but the petitioners did not provide the details. Second; the respondent argued that providing the information would have violated the data protection law and expose it to claims of breach of data privacy and that the petitioners are not citizens for purposes of accessing information under article 35 of the Constitution. 82. I have considered respective parties’ arguments and perused the record. The respondent is a private entity and not a state agency. Even then, the Constitution applies to every person, including a juristic person. (See section 2 of Access to Information Act). In that regard, article 35(1)(b) which is relevant to the petitioners’ case, applies to the respondent so that access information to held by another person is permissible if the information is required for the exercise or protection of a right or fundamental freedom. 83. The petitioners stated that their advocate sent a letter dated 14th April 2022 to the respondent on the information they requested to access. The respondent stated it wrote to the petitioners’ advocate requesting certain details which were not, however, supplied. The petitioners countered that their advocate did supply the details. 84. I have perused the demand letter dated 14th April 2022 from the petitioners’ advocates to the respondent’s CEO-Peter Ndegwa; the Legal Department of the respondent and the respondent’s Headquarters. The demand letter headed “Perpetuation of fraud through Safaricom Mpesa and Fuliza platforms.” makes reference to various dates between 16th January 2021 and 4th February 2022 when the petitioners received calls from numbers said to be registered with the respondent and which fraudulently obtained funds from the petitioners’ Mpesa and Fuliza services amounting to Kshs. 1,707,147. 85. The letter made reference to article 35(1) (b) and Access to information Act on the right of access to information and the fact that the fraud had been reported at various police stations, namely; Karen Police Station on 15th January 2022 (OB 033); Timau Police Station (OB13/21/12/2021) and CID Karen on 24th November 2021 (OB No. 31/24/11/2021). According to the demand letter, the fraud was also reported the petitioners’ banks and the respondent’s customer care and legal departments. 86. The letter then went on to state as follows; “ Our instructions are to demand from you, which we hereby do: (1) A refund of Kshs. 1,707,147 as more particularly set out in the spread sheet attached, being the total funds fraudulently transferred from our clients’ accounts https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 12

page 12 of 15

(2) Confirmation that you are taking steps to safeguard any internal fraud, and that you are taking out a full-page daily notice to all your customers alerting them to the scams being perpetrated. (3) Confirmation that the details and contact numbers of the fraudsters are within your database and that these numbers have been flagged and consequently blocked to avoid further fraudulent activities. (4) The names and identification card numbers of the registered owners of these numbers (5) The names and numbers of the fraudulent registered number recipients of these fraudulent M-pesa transactions (6) That you have preferred criminal charges against the registered owners of those numbers making such fraudulent calls and or those who have received the Mpesa funds which are the receipts of the defrauded sums. (6) (sic) That all such information requested under the Access to Information Act section 4 and section 5 be received within seven (7) days of today’s date failing which we are constrained to institute legal proceedings as against you, and at your costs, seeking exemplary damages for withholding critical information in clear contravention of our respective client’s right to access information which is guaranteed under Article 35 of the Constitution.” 87. The petitioners’ claim for access to information falls under article 35(1) (b) which guarantees every citizen’s right of access to information held by another person and required for the exercise or protection of a right or fundamental freedom. The petitioners’ case is that the respondent, a private entity, refused to supply information. For the petitioners to access information under article 35(1)(b), the information had to be for purposes of exercising or protecting a right or fundamental freedom in the Bill of Rights. 88. The demand letter dated 14th April 2022 did not state why information was requested. Access to information Act does not seem to suggest that reason should be given for seeking information. However, article 35(1)(b) is clear that information from another person should be for the exercise or protection of a right or fundamental freedom. This must be understood to mean that the person seeking to access should show that information is required for exercising or protecting a right or fundamental freedom. 8.9 The issue of access to information from a private entity was considered in Dande & 3 others v Inspector General, National Police Service & 5 others (Petition 6 (E007), 4 (E005) & 8 (E010) of 2022 (Consolidated)) [2023] KESC 40 (KLR). 90. This court allowed petition No 539 of 2016, Edwin Harold Dayan Dande & 3 others v British American Investments Co (K) Ltd & another seeking access to information from a private entity.An appeal was lodged and the Court of Appeal in its judgment delivered on March 4, 2022, allowed the appeal with costs holding that this Court as the trial court erred in granting the orders sought. 91. At the Supreme Court, several appeals were consolidated and one of the issues that arose for determination was when access to information from a private entity under article 35(1)(b) should be allowed. The Supreme Court agreed with the Court of Appeal’s holding that: https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 13

page 13 of 15

[122] …[A] party requesting information from a private person must place before the court a demonstrable and sufficient link between the right sought to be exercised or protected and the information requested. Once this is done, the onus is on the private person from whom information is requested to show why such information should not be disclosed. Having examined the pleadings and submissions, the appellate court held that the pleadings before the trial court did not meet the standard set for a request for information held by a private person and there was no demonstrable or sufficient connection between the requested information and the exercise or protection of the rights under articles 28, 32(2), 48 and 50 of the Constitution. 92. The Supreme Court was clear that requests made to private entities require proof of a direct connection between the information sought and the constitutional right being protected so that courts can balance the right of access against the privacy and commercial interests of private entities and third parties. The Supreme Court thus, settled the issue of access to information from a private entity. 93. In this petition, the petitioners argued that the information they requested was for purposes of criminal investigations and filing of suits against the persons who defrauded them. The petitioners stated [at paragraph 2.2 of the petition] that criminal and civil proceedings against their oppressors had been impeded by the respondent’s refusal to furnish them with the contact details of the fraudsters. 94. I noted from the demand letter through which the petitioners argued they requested information, that the letter made several demands some of which were general in nature. For instance, the petitioners demanded refund of the money they were defrauded; confirmation that the details and contact numbers of the fraudsters were within the respondent’s database and that those numbers had been flagged and consequently blocked to avoid further fraudulent activities; confirmation that the respondent was taking steps to safeguard any internal fraud, and that it was taking out a full-page daily notice to alert customers about the scams that were being perpetrated; names and identification card numbers of the registered owners of the numbers; names and numbers of the fraudulent registered number that received the fraudulent M-pesa transactions and confirmation that the respondent had preferred criminal charges against the registered owners of the numbers making such fraudulent calls and or those who had received the from M-pesa funds. 95. First; the respondent does not carry out criminal investigations as this is the responsibility of the police to whom the petitioner had reported the fraud. If anyone wanted to conduct criminal investigations it would be the police. It was not made clear to this court whether information was being sought on behalf of the police or not. 96. Second; the demand letter, the subject of this petition, made general demands rather than a specific request for information. The petitioners, apart from making general demands, did not indicate the particular information they wanted since the demands included many aspects such as payment of the amount the petitioners are said to have lost through fraud. 97. An application for or request to access information under section 8(1) of the Act should not only be in writing, it should provide details and sufficient particulars to enable the public officer or any other officer to understand what information is being requested. The request should be clear and unambiguous so that the entity required to allow access understands the nature of the information sought and determine whether or not to allow access. 98. From the demand letter dated 14th April 2022, it is difficult to tell which information the petitioners were requesting since the letter is a general demand made on several matters, including payment of https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 14

page 14 of 15

Kshs. 1,707,147 which the petitioners were said to have been defrauded. Even in the petition, the petitioners did not state which of the 5 items in the demand letter they wanted to access. 99. Even if this court were to allow the petition, it would have to order access to all the items in the demand letter since one of the prayers sought is “An order compelling the respondent to provide information sought in the letter dated 14/4/2022” which would include the amount of money demanded thus, making the petition difficult to allow as it is. 100. The respondent raised the issue of citizenship, arguing that the petitioners are not citizens for purposes of article 35 of the Constitution. There must be no doubt who a citizen is. However, for avoidance of doubt, section 2 of the Act defines a "citizen" to mean any individual who has Kenyan citizenship, and any private entity that is controlled by one or more Kenyan citizens, making access to information limited to citizens only. In this petition, the issue of citizenship was only addressed in passing yet this is an issue of evidence as opposed to mere allegation that one is or is not a citizen. 101. In the circumstances, having considered the petition, responses and argument by the parties and considering the facts in this petition, the conclusion I come to, is that the petitioners did not demonstrate that they had established a proper basis for purposes of access to information and if so, which information to enable the court determine whether the information requested falls within the limitation in section 6 of the Act as the respondent argued. 102. Consequently, and for the above reasons, the petition is declined and dismissed. Costs being discretionary, and taking into account the circumstances of this petition, each party shall bear their own costs. DATED AND DELIVERED AT NAIROBI THIS 14TH DAY OF OCTOBER 2025 E C MWITA JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/14948/eng@2025-10-14 15

page 15 of 15