Elijah Mokua v Asa Kenya Limited & 2 others

i. This Court finds the Respondents grossly in violation of the right to privacy set out under Article 31 of the Constitution. ii. This Court orders the 1st Respondent to pay the Petitioner Four Million Kenyan Shillings (Kshs. 4,000,000) in damages. iii. This Court orders the 2nd and 3rd Respondents to pay the Petitioner Two Million Nine Hundred and Seventy-Five Thousand Kenyan Shillings (Kshs. 2,975,000) each in damages. iv. Costs be provided for. Petitioner’s Case 4. The Petitioner stated that his wife took out loans with the Respondents. She defaulted in repayment of these loans. The Respondents then begun incessantly calling and texting the Petitioner using different numbers requiring him to repay the said loans yet he was not a guarantor or even being privy to the borrowing. He stated that these calls and threats were rude and aggressive. 5. The Petitioner depones that the Respondents actions caused him sleepless nights and great distress taking a toll on his health and emotional state. As a result, he sought medical assistance at Sinai Hospital at Rongai where it was discovered that he had fluctuating blood pressure and persistent headaches owing to the stress. 6. In addition, the Respondents invaded their matrimonial home to harass his family members and worker concerning the loans and slandering his family’s name. 7. Aggrieved by these actions, the Petitioner lodged his complaint with the Interested Party herein on 5th October 2023 via email. He depones that the Interested Party on 2nd January 2024 delivered a Ruling in his favour determining that: i. The Respondents herein were found liable for unlawfully processing the Plaintiffs personal data. ii. Enforcement Notices were issued against all the Respondents herein. iii. Parties were given the right to appeal the Data Commissioner's determination to the High Court of Kenya within thirty (30) days. 8. The Petitioner contends that the Respondents’ being in possession of his personal data, utilized it in a manner that violated his right to privacy, which is unlawful and unfair to him. Likewise, that the Respondents’ utilized his information in a manner that is incompatible with the purpose for which they had it. 9. The Petitioner postulates that while the Interested Party’s determination was in his favour and does not dispute it, it was a mere slap on the Respondents wrists. According to him, the Respondents outright constitutional violation should not go unpunished. As such, he argues that the Respondents ought to compensate him in damages. He reasons that such a punitive imposition of liability will play a deterrent role to the Respondents who will then not engage in such behavior against other members of the public. 10. He stated that in a Penalty Notice dated 26th September 2023, the Interested Party in another matter, fined Mulla Pride Ltd, which operates KeCredit and Faircash digital credit facilities, Kshs. 2,975,000 for data breaches similar to the ones perpetrated by the Respondents herein. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 2

page 2 of 15

11. In his case however, he stresses that the Respondents were not rendered a similar fate which would have been instrumental to accord them enough lessons to draw from. On this premise, he maintains that the Respondents should compensate him so as to fill this deterrent void left unfilled by the Interested Party. 1st Respondent’s case 12. The 1st Respondent in response filed a Notice of Preliminary Objection and Grounds of Opposition both dated 20th February 2024. The Preliminary Objection is premised on the ground that: This Court lacks jurisdiction to hear and determine this suit as there is a prevailing judgment from the Office of the Data Protection Commissioner, rendering the suit res judicata as it was previously heard before a competent tribunal and determined on its merits. 13. Furthermore, the Grounds of Opposition is based on: i. The Petition suffers from lack of particularity and focus to the extent that neither does it point out the provisions violated nor the nature of violation contrary to Rule 10 (1) (c) and (d) of the Constitution of Kenya (Protection of Rights and fundamental freedoms) Practice and procedure Rules, 2013. ii. The Petitioner has submitted email communications as evidence, which were made on a without prejudice basis. This action is contrary to Section 23(1) of the Evidence Act, which states that in civil cases, no admission may be proven if it is made either upon an express condition that evidence of it is not to be given, or in circumstances from which the court can infer that the parties agreed together that evidence of it should not be given. iii. The Petitioner has misdescribed the name of the 1st Respondent and joined an unknown party as an Interested Party in the Petition. This error is in violation of Rule 9 (d) (1) of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, which requires parties to correctly describe the Respondents and Interested Parties. The Petition is therefore defective and deserving to be struck out. iv. The Petition vitiates the principle of constitutional avoidance. The Petitioner, knowing fully well that the 30 days' timelines prescribed for lodging an appeal have lapsed, has filed the instant Petition as a means to circumvent the appeal process prescribed in sections 58 (2) (d) and 64 of the Data Protection Act. This is an abuse of the judicial process and undermines the finality of judgments. Allowing such a Petition to proceed would set a dangerous precedent and erode the integrity of the legal system. v. The Petitioner has filed a verifying affidavit, witness statements, and a list of documents in contravention of Rule 11 of the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013. The said rule stipulates that a Petition filed under these rules may be supported by an affidavit, and if a party wishes to rely on any document, the document shall be annexed to the supporting affidavit or the Petition where there is no supporting affidavit. The Petitioner's failure to comply with this procedural requirement renders the Petition irregular and liable to be struck out. vi. The Petition is defective, incompetent, misconceived, lacks merit, and constitutes an abuse of the Court process. The Petitioner's rights and fundamental freedoms have neither been violated nor abused, rendering the Petition without basis or legal standing. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 3

page 3 of 15

14. Furthermore, the 1st Respondent filed its Replying Affidavit through its legal officer, Emmanuel Bara Mutua sworn on 20th February 2024. 15. On the onset, he asserts that the issues raised in the Petition are the same as those that were raised before the Interested Party which culminated into the Ruling dated 2nd January 2024.He thus argues that the matter has already been heard on merit before the statutorily ordained institution. 16. He notes that the Petitioner as required by the law did not appeal the Interested Party’s decision but instead filed this suit which is in breach of the principle of constitutional avoidance. He postulates that this Petition was an afterthought on the Petitioner’s part. 17. He depones that while the Petitioner states that his family was harassed by the 1st Respondent, no evidence was adduced to support this claim. He adds that the Petitioner’s annexture from Dr. Onsando on his medical condition following his experience, is absurd as the condition of high blood pressure can be caused by various factors. 18. He stresses that evidence demonstrating that the high blood pressure was caused by the circumstances of this cases was not also adduced. That said, he notes that the law requires that a document be adduced by the maker, which in this case was not done by Dr. Onsando through an affidavit. 19. He depones that once the 1st Respondent received the Enforcement Notice from the Interested Party, it undertook to ensure compliance. In doing so, the 1st Respondent’s data protection officer, expunged the Petitioner’s information from its databases. Additionally, the legal team proceeded to prepare adequate policies and conduct trainings within the parameters set by the Interested Party. 2nd Respondent’s Case 20. The 2nd Respondent in reaction to the Petition also filed its Grounds of Opposition dated 11th March 2024 on the premise that: i. The instant Petition is fatally defective in both substance and form and offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013. ii. The Petition does not qualify as a constitutional matter as per the threshold in the case of Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272. iii. A plain reading of the Petition clearly points to a disguised attempt to appeal against the Interested Party's Enforcement Notice dated 2nd January 2024 which the Petitioner in his pleadings admits to be aggrieved by. iv. The Petitioner can only approach this Court sitting on appeal against the decision of the Interested Party, or in exercise of its supervisory jurisdiction under Article 165 (3) and (6) of the Constitution to grant the prayers sought. v. The instant Petition is an abuse of the Court process by attempting to open up a parallel regime for a party aggrieved by a decision of the Interested Party contrary to Section 64 of the Data Protection Act. vi. It is an abuse of the Court process for the Petitioner to resort to a constitutional petition whereas there exists a clearly defined means of redress for a party aggrieved by a decision of the 1st Respondent. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 4

page 4 of 15

vii. The Petition is therefore incompetent, fatally defective, misconceived and an abuse of Court process as it negates the well laid down principles and essence of Res Judicata in as far as it invokes this Court's original and not appellate jurisdiction over a matter already determined by a competent judicial authority. viii. The entire Petition is therefore incompetent and an abuse of the Court process and warrants to be dismissed with costs at the outset. 3rd Respondent’s Case 21. The 3rd Respondent through its Chief Executive Officer, Wycklife Ochola filed its Replying Affidavit sworn on 14th March 2024. 22. He states that this Court does not have jurisdiction to entertain this matter by dint of provisions in the Data Protection Act and Rule 14(3) of the Data Protection (Complainants Handling and Enforcement Procedures) Regulations, 2021. That is, the issuance of the necessary remedial measures including compensation are vested in the Interested Party. 23. For this reason, the Petition is deemed as a non-starter and an abuse of the Court process as it is an attempt to oust the Interested Party’s jurisdiction. He adds that since the Interested Party has the jurisdiction to make orders on a case by case basis, she is not required to issue a blanket order for compensation as advanced by the Petitioner. 24. For context, he depones that they received a letter dated 9th November 2023 from the Interested Party informing them of the complaint against them which they responded to on 23rd November 2023. In essence, the 3rd Respondent informed the Interested Party that they had advanced a loan of Ksh.90,000 to the Petitioner’s wife, Josephine Kwamboka Nyorera to boost her business. 25. It is said, that she repayed the loan faithfully for the first 4 weeks however defaulted on the fifth week. When their agents made a follow up at her shop, they found the Petitioner who introduced himself as her husband. 26. He depones that the Petitioner acknowledged that he was aware of the loan and committed to repay the same. He informs that the Petitioner on 19th September 2023, made a payment of Ksh.2000 via Mpesa using his safaricom line. In view of this, he states that the Petitioner voluntarily issued his number to them and so they continued to follow up on the payment of the loan which is done on a weekly basis. 27. He depones that the Petitioner undertook to repay the loan in three installments commencing on 27th November, 2023 which the 3rd Respondent agreed to. He stresses that the only reason the 3rd Respondent engaged the Petitioner was because he willingly took over his wife’s obligation to repay the loan. He adds that the Petitioner stated that since his wife was ailing he did not want her to be sued so he agreed to pay the loan. 28. He avers that once this matter was considered by the Interested Party, a decision was rendered and an Enforcement Notice issued. He depones that the Interested Party informed the parties of their right to appeal the decision to the High Court if grieved within 30 days. He informs that neither of the parties appealed the decision. 29. He depones that in compliance with the said decision, the 3rd Respondent executed the directives issued therein. Their compliance was further communicated to the Interested Party in their letter dated 19th February 2024. Additionally, through the same letter, they sought an extension to fully comply with the directive of training its staff members. This was allowed by the Interested Party in its response https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 5

page 5 of 15

dated 20th February 2024. The training was subsequently conducted and 3rd Respondent issued with a Certificate for the same. 30. He further informs that as soon as they were notified on the complaint they ceased communicating with the Petitioner and deleted his information from their database. Likewise, he argues that the allegation of harassment of the Petitioner in their home is false. Interested Party’s Case 31. On 5th April 2024, the Interested Party, through his Deputy, Oscar Otieno swore his Replying Affidavit in response to the Petition. 32. He confirms that the Petitioner’s complaint was filed on 5th October 2023 in accordance with the Data Protection Act. He discerns that the Petitioner in this matter is distressed since the Interested Party did not award him compensation as a remedy. 33. He notes that pursuant to Section 65 of the Data Protection Act as read together with Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulation,2021, compensation is one of the remedies that can be issued by the Interested Party based on the prayers sought and merits of the case. 34. He depones that the Petitioner in his complaint did not seek the remedy of compensation, he only prayed that the Respondents’ be stopped from contacting him over a loan he was not aware of. Upon considering the Petitioner’s case, he avers that the Interested Party determined that the Respondents had not complied with the provisions of the Act thus issued Enforcement Notices to them. 35. He stresses that the Interested Party processed the Petitioner’s complaint lawfully and made her determination on merit. Petitioner’s Submissions 36. The Petitioner through Dr. Musikali Advocates LLP filed submissions dated 10th June 2024 and identified the issues as: whether the Petition satisfies the principle of specificity; whether this Court has jurisdiction to hear and determine the matter; whether the remedies available to the Petitioner under the Data Protection Act are effective enough; whether the Petitioner’s Constitutional rights were violated and whether the Respondents should pay the Petitioner damages for violations of his Constitutional rights. 37. On the first issue, Counsel submitted that the Petition satisfies the test set out in Anarita Karimi Njeru v The Republic (1976-1980) KLR 1272.Counsel stated that the Petitioner in pleading his case had specified the constitutional right violated being Article 31(c) and (d) of the Constitution. In addition, it was noted that the Petitioner had set out the breached provisions under the Data Protection Act. 38. On the second issue, Counsel submitted that an appeal is not the only way to seek further redress from the Court following the determination by the Interested Party. Counsel noted that this is made manifest in various provisions such as Article 78 in Chapter VIII of The General Data Protection Regulation (GDPR). It emphasizes that an effective legal remedy is not automatically present whenever remedies are available under national law. Further reliance was placed in Schrems v Data Protection https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 6

page 6 of 15

Commissioner, ECJ, C-362/14, 06 October 2015, § 95, where the European Court of Justice found that: “ the complete absence of “any possibility for an individual to pursue legal remedies…does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter”. 39. As such, Counsel argued that in the absence of the need for appeal by the Petitioner, the constitutional court was the most appropriate avenue for the Petitioner to seek further redress after the Interested Party’s determination. Considering this, Counsel relying in Article 165 of the Constitution submitted that this Court has jurisdiction to entertain suits on fundamental right and freedoms and grant appropriate reliefs under Article 22 of the Constitution. 40. Turning to the third issue, Counsel stated that the remedies available to the Petitioner under the Data Protection Act fall short in being effective for a number of reasons. First, they require the complainant to state the remedy sought and fails to inform the complainant of the remedies available to him. According to Counsel the availability of such remedies are not within the knowledge of a layman. For this reason, Counsel argued that the Interested Party’s claim that the Petitioner did not pray for compensation cannot suffice. 41. Furthermore, Counsel submitted that outsourcing enforcement solely to the Interested Party creates an illusion of control by data subjects. Equally, that the inconsistencies in the determinations issued by the Interested Party in various similar cases are also an indication of the inefficiencies of the remedies available under the Data Protection Act. 42. Counsel on this basis concluded that although there are remediesavailable to the Petitioner under the Data Protection Act and that the Interested Party followed due process in arriving at the determination, the said remedies fail the test of effectiveness in upholding the right to privacy as enshrined under Article 31 of the Constitution in view of the facts of this case. 43. On the next issue, Counsel maintained that it was evident that the Petitioner’s right under Article 31 of the Constitution had been violated by the Respondents. Reliance was placed in Kenya Human Rights Commission v Communications Authority of Kenya & 4 others [2018] eKLR where it was observed that: “ Privacy is a fundamental human right, enshrined in numerous international human rights instruments. It is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information, and association. The right to privacy embodies the presumption that individuals should have an area of autonomous development, interaction, and liberty, a “private sphere” with or without interaction with others, free from arbitrary state intervention and from excessive unsolicited intervention by other uninvited individuals. Activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.” 44. Additionally, Counsel submitted that the Respondents had put the Petitioner in danger of suffering further violations of his economic and social rights under Article 43 of the Constitution. This is especially so since loan defaulters in Kenya are listed in the Credit Reference Bureau (CRB) yet he did not take out the alleged loans. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 7

page 7 of 15

45. On the fifth issue, Counsel submitted that a right without remedy is not a right at all and thus a right should be accompanied by a remedy for its breach as in this case. Counsel urged the Court not to let the outright disregard and contravention of the Petitioner’s right to privacy by the Respondents go unchecked especially since the Interested Party’s determination did not sufficiently punish and deter the Respondents from engaging in similar actions. 46. Reliance was placed in Peter Ndegwa Kiai t/a Pema Wines & Spirits v Attorney General & 2 others (Civil Appeal 243 of 2017) [2021] KECA 328 (KLR), where the Court held that: “ … Punitive damages primarily serve penal and deterrent functions in cases of gross constitutional violations, as well as vindicatory function.” 47. Like dependence was placed in Google Inc v Vidal-Hall [2015] EWCA Civ 311. 1st Respondent’s Submissions 48. The CR Advocates LLP on behalf of the 1st Respondent filled submissions dated 6th May 2024 and underscored the issues for determination as: whether this Court is clothed with the jurisdiction to hear and determine the issues raised in the instant petition and whether the Petitioner is entitled to compensation for the alleged violations. 49. To commence with Counsel relying in Speaker of National Assembly v Karume [1992] KLR 21 submitted that where there is a clear procedure for redress of any particular grievance prescribed by the Constitution or an Act of Parliament that procedure should be strictly followed. In this matter, Counsel recapping the procedure set out in the Data Protection Act when a complaint is lodged, submitted that Section 64 of the Act grants an aggrieved party the right to appeal against the decision of the Interested Party. Counsel noted that the Interested Party had informed the parties concerning this right during her determination however the Petitioner failed to pursue it. 50. Counsel pointed out that a constitutional petition should only focus on constitutional issues. Reliance was placed in Kweri v Beehive Media Limited; Capwel Industries Limited (Interested Party) [2023] KEHC 2684 (KLR) where it was held that: “ A Constitutional and Human Rights Court is supposed to exclusively deal with constitutional issues. Courts have defined what constitutional issues are. In Fredricks & other v MEC for Education and Training, Eastern Cape & others (2002) 23 ILJ 81 (CC), the Constitutional Court of South Africa rightly so, delimited what a constitutional issue entails and the jurisdiction of a constitutional court as follows: The Constitution provides no definition of ‘constitutional matter’. What is a constitutional matter must be gleaned from a reading of the Constitution itself: if regard is had to the provisions of… Constitution, constitutional matters must include disputes as to whether any law or conduct is inconsistent with the Constitution, as well as issues concerning the status, powers and functions of an organ of State…. the interpretation, application and upholding of the Constitution are also constitutional issues. So too…is the question of the interpretation of any legislation or the development of the common law promotes the spirit, purport and object of the Bill of Rights. If regard is had to this and to the wide scope and application of the Bill of Rights, and to the other detailed provisions of the Constitution, such as the allocation of powers to various legislatures and structures of government, the https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 8

page 8 of 15

jurisdiction vested in the constitutional court to determine constitutional matters and issues connected with decisions on constitutional matters is clearly on extensive jurisdiction…” 51. Counsel contended that instead of raising constitutional issues, the instant Petition solely focuses on the Petitioner’s dissatisfaction with the Interested Party’s decision on what he considers punitive damages. This in and of itself is argued not to be a valid ground for judicial review. As a consequence, it is argued that the Petition offends the doctrine of constitutional avoidance as the Petitioner failed to utilize his right to appeal the decision. 52. Reliance was placed in Mwanzia v Rhodes (Constitutional Petition E115 of 2022) [2023] KEHC 2688 (KLR) where it was held that: “ The data commissioner has the jurisdiction to determine whether the petitioner’s privacy rights in the Bill of Rights were denied, violated, infringed or threatened. The Commissioner has further powers to order appropriate compensation in the event of proof of the infringement.” 53. Taking this into consideration, Counsel submitted in the second point that the Petitioner was not entitled to the compensation sought. This is since the same is a preserve of the Interested Party as per Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, who may in her discretionary power issue remedies that are proportionate and appropriate. Moreover, Counsel submitted that the 1st Respondent had in its affidavit demonstrated that it complied with the orders issued by the Interested Party. 2nd Respondent’s Submissions 54. On 5th June 2024, the 2nd Respondent filed submissions through Mbugua Ng’ang’a and Company Advocates. Counsel sought to discuss: whether the Petition is competent and whether this Court has jurisdiction to entertain the suit. 55. On the first issue, Counsel submitted that the Petition is fatally defective in both substance and form as offends the mandatory requirements spelt out under Rule 10 (2) of Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules and the principle in the case of Anarita Karimi Njeru (supra). v The Republic (1976-1980) KLR 1272. Like dependence was placed in Mumo Matemu v Trusted Society of Human Rights Alliance & 5 others [2013] eKLR. 56. Counsel stressed that the instant Petition neither discloses the constitutional provisions violated nor the nature of injury caused to the Petitioner by the Respondents and so the Petition falls short of the requirement for reasonable precision. 57. On the second issue, Counsel submitted that, Section 64 of the Data Protection Act provides for the right to appeal from the Interested Party’s decision before the High Court. Counsel submitted that the Petitioner is guilty of abusing the Court process as the instant Petition is a disguised attempt at appealing the Interested Party's determination. Counsel contended that the Petitioner can only approach this Court sitting on appeal. 58. Furthermore, it was submitted that by invoking this Court's original over a matter already determined by the Interested Party, the Petition negates the principle of Res Judicata. In light of this, Counsel stated that this Court does not have jurisdiction to entertain this suit. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 9

page 9 of 15

59. Reliance was placed in Orange Democratic Movement v Yusuf Ali Mohamed & 5 others (2018]eKLR where it was held that: “ A party cannot through its pleadings confer jurisdiction to a court when none exists. In this context, a party cannot through draftsmanship and legal craftsmanship couch and convert an election petition into a constitutional petition and confer jurisdiction upon the High Court. Jurisdiction is conferred by law not through pleading and legal draftsmanship. It is both the substance of the claim and relief sought that determines the jurisdictional competence of a Court...” 60. Additional reliance was placed in Nicholus v Attorney General & 7 others; National Environmental Complaints Committee & 5 others (Interested Parties) (2023] KESC 113 (KLR). 3rd Respondents’ Submissions 61. The 3rd Respondent filed submissions dated 4th June 2024 through Senteu and Ndung’u Advocates and further submissions dated 3rd July 2024. Counsel discussed the jurisdiction of this Court to entertain this matter andwhether the Petitioner's claim is legally justiciable and whether it should be dismissed. 62. Counsel stated that the Data Protection Act empowers and mandates the Interested Party to receive complaints lodged by data subjects, investigate them and issue the necessary remedial measures and punishment. Counsel noted that in this matter, the Petitioner had lodged his complaint in line with the provisions of the Act. In the end, a decision was made in his favour and an Enforcement Notice issued to the 3rd Respondent. 63. It was contended that the Petitioner being aggrieved by the Interested Party’s failure to impose specific measures, he was required to appeal the same as per Section 64 of the Data Protection Act which he did not do. Likewise, it was argued that the order of compensation sought is a preserve of the Interested Party according to Rule 14(3) (e) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulation. 64. On this basis, Counsel submitted that the Petition is a non-starter and an abuse of the Court process as the Petitioner failed to follow the set procedure. Moreover, that the Petition is only meant to oust the discretionary power of the Interested Party. Counsel stressed thus that this Court can only sit as an appellate Court which the Petitioner ignored to pursue. This Court is adjudged to lack jurisdiction to entertain the matter as filed. 65. Reliance was placed in Anthony Miano & others vs. A.G & Others [2021] eKLR where it was held that: “ If no restriction or limit is imposed, the jurisdiction is said to be unlimited. A limitation mat/ be either as to the kind and nature of the actions and matters of which the particular Court has cognizance or as to the area over which the jurisdiction shall extend, or it may partake both these characteristics .... Where a Court takes upon itself to exercise a jurisdiction which it does not possess, its decision amounts to nothing. Jurisdiction must be acquired before judgment is given.” 66. Counsel added that the Petitioner in his submissions had relied in the European Union General Data Protection Regulations which are not applicable in Kenya since we are not a party to the Regulations. 67. Counsel in the second issue argued that the Petition is not justiciable on the basis of the doctrine of constitutional avoidance. Reliance was placed in Communications Commission of Kenya & 5 Other https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 10

page 10 of 15

v Royal Media Services Ltd & 5 Others Pet. 14A, 14B & 14C of 2014 of [2014] eKLR where it was held that: “ We shall now turn to the Constitutional-Avoidance Doctrine. The doctrine is at times referred to as the Constitutional-Avoidance Rule. Black's Law Dictionary, 10th Edition at page 377 defines it as: “ The doctrine that a case should not be resolved by deciding a constitutional question if it can be resolved in some other fashion" … The doctrine of constitutional avoidance, therefore, deals with instances where a Constitutional Court will decline to deal with a matter because there exists another remedy provided in law which the aggrieved party is yet to utilize. That is also referred to as the doctrine of exhaustion." 68. Comparable dependence was placed in Anthony Miano(supra) and Geoffrey Muthiga Kabiru & 2 others - vs- Samuel Munga Henry & 1756 others [2015] eKLR. Interested Party’s Submissions 69. The Interested Party filed submissions dated 30th April 2024 and highlighted the issue for determination as whether the Petition merits the remedy of compensation for violation of personal data. 70. The Interested Party answering in the negative submitted that although this Court under Article 23 of the Constitution can issue a remedy of compensation the same can only be granted in appropriate circumstances. Reliance was placed in Gitobu Imanyara & 2 others v Attorney General [2016] KECA 557 (KLR) where it was held that: “ Consistent with the above judicial experience and philosophy, it seems to us that the award of damages for constitutional violations of an individual's right by state or the government are reliefs under public law remedies within the discretion of a trial court, however, the court's discretion for award of damages in Constitutional violation cases though is limited by what is “appropriate and just” according to the facts and circumstances of a particular case. As stated above the primary purpose of a constitutional remedy is not compensatory or punitive but is to vindicate the rights violated and to prevent or deter any future infringements. The appropriate determination is an exercise in rationality and proportionality. In some cases, a declaration only will be appropriate to meet the justice of the case, being itself a powerful statement which can go a long way in effecting reparation of the breach, if not doing so altogether. In others, an award of reasonable damages may be called for in addition to the declaration. Public policy considerations is also important because it is not only the petitioner's interest, but the interests of society as a whole that ought as far as possible to be served when considering an appropriate remedy.” 71. Comparable dependence was placed in Monica Wangu Wamwere vs Attorney General (2019) eKLR. 72. The Interested Party submitted that in this matter it was determined that the Respondents were in breach for unlawfully processing the complainant’s personal data and so an Enforcement Notice was issued. It was argued that this determination was proportionate and rational to the issue in dispute. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 11

page 11 of 15

73. Nonetheless, it was argued that Section 65 of the Data Protection Act as read with Regulation 14(3) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 empower the Interested Party to, in appropriate circumstances, issue compensation as one of the remedies. It was however noted that this remedy was not sought by the Petitioner in the original complaint. 74. The Interested Party stressed that there had been a conclusive evaluation on the merit and circumstances of the subject matter, and in her discretion decided not award compensation. Owing to this, it was argued that the Court ought not to exercise its discretion to grant the orders as the same would be offensive to the doctrine of res judicata. Additionally, Counsel stated that the Petitioner had invoked this Court’s original jurisdiction while the same is vested in the Interested Party under the Data Protection Act. 75. Besides, the Petitioner is accused of forum shopping since he is inviting the Interested Party and this Court to consider and address the same issues. This is said to be abuse of the Court process which was defined in Hassan N.Charo v Khatib Mwashetani & Others(2014)eKLR as: “ Improper and tortious use of a legitimately issued court process to obtain a result that is either unlawful or beyond the process or scope.” 76. Furthermore, the Interested Party is concerned that if this Petition is allowed and determined in the Petitioner’s favour, the effect will open up a floodgate of Petitions on ground of the remedy of compensation contrary to the discretionary powers of the Interested Party thus defeating the purposes of the Data Protection Act. To buttress this point reliance was placed in John Florence Maritime Services Limited & another v Cabinet Secretary Transport & Infrastructure & 3 others [2021] KESC 39 (KLR) where it was held that: “ The rationale behind res judicata is based on the public interest that there should be an end to litigation coupled with the interest to protect a party from facing repetitive litigation over the same matter. Res judicata ensures the economic use of court’s limited resources and timely termination of cases. Courts are already clogged and overwhelmed. They can hardly spare time to repeat themselves on issues already decided upon. It promotes stability of Judgments by reducing the possibility of inconsistency in Judgments of concurrent courts. It promotes confidence in the courts and predictability which is one of the essential ingredients in maintaining respect for justice and the rule of law. Without res judicata, the very essence of the rule of law would be in danger of unraveling uncontrollably. In a nutshell, res judicata being a fundamental principle of law may be raised as a valid defence. It is a doctrine of general application and it matters not whether the proceedings in which it is raised are constitutional in nature.” 77. Like dependence was placed in Geoffrey Muthinja & 4 others (supra) Analysis and Determination 78. After a careful examination of the pleadings and submissions of the parties; the Court finds that there are three key issues for determination in this Petition, namely: i. Whether this Court has jurisdiction to determine this Petition. ii. Whether the Petitioner’s right to privacy under Article 31 of the Constitution was violated by the Respondents; and iii. Whether the Petitioner is entitled to the reliefs sought. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 12

page 12 of 15

Whether this Court has jurisdiction to determine this Petition. 79. Jurisdiction is a time-honoured principle in litigation. It is the one that determines if the Court can entertain a dispute or not. The Supreme Court in Macharia & another v Kenya Commercial Bank Limited & 2 others [2012] KESC 8 (KLR) explained the concept of jurisdiction as follows: “ A Court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a court of law can only exercise jurisdiction as conferred by the Constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law. We agree with counsels for the first and second respondents in his submission that the issue as to whether a Court of law has jurisdiction to entertain a matter before it, is not one of mere procedural technicality, it goes to the very heart of the matter, for without jurisdiction, the Court cannot entertain any proceedings … where the Constitution exhaustively provides for the jurisdiction of a Court of law, the Court must operate within the constitutional limits. It cannot expand its jurisdiction through judicial craft or innovation. Nor can Parliament confer jurisdiction upon a Court of law beyond the scope defined by the Constitution. Where the Constitution confers power upon Parliament to set the jurisdiction of a Court of law or tribunal, the legislature would be within its authority to prescribe the jurisdiction of such a court or tribunal by statute law.” 80. In the present case, the Respondents challenged the jurisdiction of this Court on account that the Petitioner is breach of the doctrine of exhaustion of remedies for having first lodged his complaint before the Data Protection Commissioner in which he sought a remedy for breach of his right to privacy in line with the procedure under the Data Protection Act, it was upon the Petitioner who is now expressing dissatisfaction with the remedies granted under that procedure to pursue an appeal as specified under the said Act instead of filing a Constitutional Petition against the decision of the Data Protection Commissioner under the Act. 81. The Petitioner’s reaction to this submission was that an appeal is not the only way to seek further redress from the Court following a determination by the Interested Party (Data Protection Commissioner). 82. The Petitioner’s main original grievance as I understand it is that his right to privacy under Article 31 of the Constitution was violated which prompted him to file a complaint with the Data Protection Commissioner for redress. Article 31 of the Constitution stipulates thus: “ 31. 83. Every person has the right to privacy, which includes the right not to have— a. their person, home or property searched; b. their possessions seized; c. information relating to their family or private affairs unnecessarily required or revealed; or d. the privacy of their communications infringed” Parliament enacted the Data Protection Act whose primary purpose is stated in the preamble to be: “ An act of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 13

page 13 of 15

the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.” 84. The Act provides for the appointment of the Data Commissioner under Section 6 of the Act and proceeds to outline the functions and powers under Section 8 and 9 of the Act. 85. In relation to complaints, the Act under Section 56 provides as follows: Complaints to the Data Commissioner 86. a. A data subject who is aggrieved by a decision of any person under this Act may lodge a complaint with the Data Commissioner in accordance with this Act. b. A person who intends to lodge a complaint under this Act shall do so orally or in writing. c. Where a complaint made under subclause (1) is made orally, the Data Commissioner shall cause the complaint to be recorded in writing and the complaint shall be dealt with in accordance with such procedures as the Data Commissioner may prescribe. d. A complaint lodged under subclause (1) shall contain such particulars as the Data Commissioner may prescribe. e. A complaint made to the Data Commissioner shall be investigated and concluded within ninety days. Section 58 (1) of the Act provides that: Where the Data Commissioner is satisfied that a person has failed, or is failing, to comply with any provision of this Act, the Data Commissioner may serve an enforcement notice on that person requiring that person to take such steps and within such period as may be specified in the notice. 87. Section 64 of the Act provides for an appeal: Right of appeal A person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court. 88. It is not in dispute that the Petitioner took the primary statutory sanctioned route to redress the injury he deemed was caused to him for the breach of his right to privacy under Article 31 of the Constitution which in my view was correct legal step. 89. However, it would appear that along the way, the Petitioner was not satisfied with the nature of reliefs obtained from the interested party under the Statutory framework hence chose to come to this Court where he now seeks to obtain an effective relief as he was not happy with what was granted by the Interested Party (Data Protection Commissioner). 90. The right to appeal the ruling was available to the Petitioner under Section 64 of the Act but he chose not to exercise it. He had an opportunity to challenge the decision that granted him the insufficient relief if he was dissatisfied with but he instead chose to file a Constitutional Petition. The question thus becomes, is this legally tenable? https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 14

page 14 of 15

91. It is important to take cognizance of the fact that the decision of the Data Protection Commissioner is a decision made by an administrative body. Under Section 9 (2) of the Fair Administrative Actions Act, the Act states: “ The High Court or a subordinate court under subsection (1) shall not review an administrative action or decision under this Act unless the mechanisms including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted.” 92. Although the existence of an alternative remedy may not divest the High Court its jurisdiction to entertain a constitutional petition; It is a now a settled principle of law that when a statute creates a remedy or procedure for enforcing a right; that procedure must be fully exhausted including the right of appeal it provided. The Indian Supreme Court in the case of Seth Ratan Chand v Pandit Durga Prasad AIR 2003 SC 2736: (2003)5 SCC 399 faced with a similar case held thus: “ … When a party has had statutory remedy of assailing the order passed by the District Court by filing an appeal to the High Court itself, he could not bypass the said remedy and take recourse to proceedings under Article 226 and 227 of the Constitution. Such a course may enable a litigant to defeat the provision of the statute which may provide certain conditions for filing the appeal, like limitation or…. other conditions for entertaining the appeal. For the reasons stated, the High Court committed manifest error of law in entertaining and allowing the writ petition….” 93. Having lodged the complaint with the Data Protection Commissioner, the Petitioner ought to have stuck to the statutory framework and if dissatisfied with the outcome, approach the High Court by way of an appeal as provided in Section 64 of the said Act and not abandoning the process mid-way to file a Constitutional Petition. 94. The appropriate remedy under the circumstances of this case was to lodge an appeal as provided for under Section 64 of the Act. 95. The Petitioner is seeking to relitigate in the same complaint that was before the Data Protection Commissioner in its original form based same facts instead of invoking the appellate mechanism as provided by the Act. Entertaining the matter would be an affront to doctrine of exhaustion of remedies. 96. Having reached the above finding, this Court does not see any value in dealing with any other issue in this Petition as the jurisdictional issue goes to the root of the entire Petition. 97. The instant Petition is thus dismissed with costs to the Respondents and the Interested Party. DATED, SIGNED AND DELIVERED VIRTUALLY AT NAIROBI THIS 13TH DAY OF NOVEMBER, 2025. ………………………………………… L N MUGAMBI JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/19351/eng@2025-11-13 15

page 15 of 15