Bramwel Barasa v Csi Energy Group Limited & 1 other

i. ii. A declaration that the continued use of the Petitioner's image, name, and personal data by the Respondent without his consent violates his right to privacy under Article 31 of the Constitution and is unlawful. A mandatory injunction compelling the Respondent to immediately remove the Petitioner's image and personal data from its website, promotional materials, and all other platforms within 7 days of the Order. iii. A permanent injunction restraining the Respondent from using the Petitioner's image, name, or personal data without his express written consent. iv. An order of apology, to be published on the Respondent's website and communicated to the Petitioner in writing, acknowledging the violation. v. General damages for violation of constitutional rights and emotional distress suffered. vi. Exemplary damages for the unlawful commercial use of the Petitioner's image and data without consent. vii. Costs of this Petition and interest thereon. viii. Any other or further orders the Court deems fit and just to grant. Petitioner’s case 4. The Petitioner depones that he is a former employee of the Respondent. He resigned from the company on 11 th April 2025. Constitutional Petition E501 of 2025 – Judgment Page 2 of 21

page 2 of 21

5. He contends that as at 30th June 2025, the Respondent was still utilizing his image and name on its website as QAQC Manager, without his knowledge and consent. 6. He alleges thus that the Respondent unlawfully retained his personal data without his consent even after his resignation. 7. As a result, through his advocate on 1 st July 2025, he demanded that the Respondent should remove and stop using his image. 8. He avers that the Respondent has failed and/or refused to comply with this demand causing him emotional distress, reputational harm and violation of his right to privacy. 9. He asserts that the Respondent’s action is also in breach of the Data Protection Act, 2019. He thus urges this Honourable Court to restrain the Respondent from the continued violation of his constitutional and statutory rights. Respondent’s Case 10. The Respondent in reply filed its Replying Affidavit sworn 12 th September 2025 by its Project Director, on Simon Doughlas England. 11. On the onset, he described the Petition as devoid of merit, misconceived, ill-founded and meant harass, oppress and exploit the Respondent Constitutional Petition E501 of 2025 – Judgment for monetary compensation Page 3 of 21

page 3 of 21

through misrepresentation of facts and unfounded allegations. 12. He stated that contrary to the Petitioner’s assertion, the Petitioner’s name and image does not appear on the Respondent’s website as upon being notified of the same, they expeditiously removed them and that any continued display of the same was not malicious but an inadvertent oversight on their part. 13. He stresses that throughout their engagement, the Petitioner’s name and photograph were displayed on their website and other platforms with his consent. He avers thus that at the time; use of the Petitioner’s name and image was in compliance with the requirements of the Data Protection Act. 14. He contends that the Petitioner has failed to demonstrate the injury suffered and proof of commercial use of his image. He argues that these allegations are unsubstantiated. 15. He, therefore, urged this Court to dismiss the Petition considering that the Respondent ceased to use of the Petitioner’s name and image on its website and other platforms. Petitioners’ Submissions 16. On 10th October 2025, K.K. Muchangi and Company Advocates filed submissions where they set out the issues Constitutional Petition E501 of 2025 – Judgment Page 4 of 21

page 4 of 21

for consideration as: whether the Respondent's actions violated the Petitioner's constitutional right to privacy under Article 31 of the Constitution and whether the Petitioner is entitled to compensatory and exemplary damages for the violation. 17. Recapping the Petitioner’s averments, Counsel submitted that the Respondent maintained the use of the name and image on its website and other platforms. Counsel asserted that the Respondent only took down the photo after issuance of the demand letter. 18. Counsel contended that this indicates that the Respondent’s compliance was not voluntary but reactive thus admission of wrongful conduct. Counsel submitted therefore that the Respondent prior conduct was in breach of Section 26 of the Data Protection Act. 19. Additionally, Counsel submitted that while the name and image were later on removed, violation of the Petitioner’s constitutional right had already occurred being his right to privacy, dignity and personal autonomy. On this premise, Counsel argued that the Petitioner is entitled to damages to vindicate his rights and deter similar conduct by data controllers and employers. 20. To buttress this point reliance was placed in Rukia Idris Barri v Mada Hotels Ltd [2013] eKLR where it was held that: Constitutional Petition E501 of 2025 – Judgment Page 5 of 21

page 5 of 21

“The appropriation of a person's image or likeness for the commercial benefit or advantage of another may well call for legal intervention in order to protect the individuals concerned. That may not apply to the kinds of photographs or television images of crowd scenes which contain images of individuals therein. However, when the photograph is employed, as incase, for the benefit of a magazine sold to make profit, it constitutes an unjustifiable invasion of the person's rights of the individual, including the person's dignity and privacy. In this dispute, no care was exercised in respecting these core rights." 21. On the second issue, Counsel affirmed that indeed the Petitioner was entitled to compensation and exemplary damages. This is since it is clear that the Respondent violated his right under Article 31 of the Constitution, by using his image and name without lawful consent. 22. Further to this, Counsel argued that the Respondent had not demonstrated any lawful basis for processing or retaining the Petitioner's data after the end of the employment relationship. Counsel added that the continued display of the Petitioner's image at that time was misleading to the public and any future employer who would require the outstanding services of the Petitioner. 23. Reliance was placed in Ann Nioki Kumena -v- KTDA Agency Ltd [2019] eKLR where the Court held that: “The plaintiff has proved that the defendant took a photograph of herself, without her consent and that the defendant used her photographs for commercial purposes that is, advertisement of its products. No Constitutional Petition E501 of 2025 – Judgment Page 6 of 21

page 6 of 21

compensation was paid...The right is also guaranteed under Article 31 of the Constitution which provides that every person has a right to privacy which includes the right not to have their person home or property searched and, their possession seized.” 24. Further reliance was placed on Jessicar Clarise Wanjiru v Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR. Respondent’s Submissions 25. The Respondent filed submissions dated 30 th October 2025 through its Counsel, Mirugi Kariuki and Company Advocates. Counsel highlighted the following issues: whether the Petition discloses a justiciable constitutional question and whether the evidence tendered is admissible, Whether the Respondent's conduct constituted an unlawful invasion of privacy under Article 31 of the Constitution and the Data Protection Act and whether the remedies sought by the Petitioner are appropriate, proportionate, and justified in the circumstances. 26. Counsel relying on the test in Anarita Karimi Njeru v Republic [19791 KLR 154 submitted that the Petitioner must show, with reasonable precision, the constitutional provisions relied upon, the facts said to engage that provision and demonstrate how those facts amount to a violation. Counsel submitted that the Petition fails to particularize the precise constitutional breach purported Constitutional Petition E501 of 2025 – Judgment Page 7 of 21

page 7 of 21

under Article 31 of the Constitution as read with Sections 26, 30, 31 and 32 of Data Protection Act. 27. Counsel submitted that the Petitioner’s averments that the Respondent continued to display his image after resignation, without adducing evidence such as a record showing precise dates, platform locations, or instances of republication, leave the Court to speculate on a matter which the very facts must be established. Counsel submitted that the Petitioner must demonstrate that the Respondent processed or published the personal data without lawful basis and that the processing caused harm, which the Petitioner failed to establish. According to Counsel, the Petition fails to disclose a justiciable constitutional question fit for adjudication. 28. Furthermore, Counsel submitted that the Petitioner’s attached screenshot of the purported image is not supported by any certified evidence to the effect that the screenshot he relies on was taken on that date, that it was produced by the Respondent's systems and that it was not doctored or derived from an external archive. Counsel argued that this breaches Section 65B and 106B of the Evidence Act which concerns electronic evidence. Reliance was placed in Republic v Barisa Wayu Matuguda [2011] KEHC 1481 (KLR) where it was held that: "This provision makes it abundantly clear that for electronic evidence to be deemed admissible it must be accompanied by a certificate in terms of S. Constitutional Petition E501 of 2025 – Judgment Page 8 of 21

page 8 of 21

1068(4) ... Such a certificate must ... be signed by a person holding a responsible position with respect to the management of the device... Without the required certificate this CO is inadmissible as evidence and I so rule." 29. What’s more, Counsel argued that the Petitioner in filing this suit had by passed the statutory remedies, which provide an administrative avenue for complaints such as this, under the Data Protection Act. Consequently, Counsel argued that the Petitioner ought to have invoked this mechanism first before approaching this Court. 30. Moving to the next issue, Counsel submitted that the Petitioner’s claim is unfounded. Counsel noted that the Petitioner's image was captured and displayed exclusively within the context of employment and in line with Section 26 and 30 of the Data Protection Act. Counsel underscored that there was no evidence that this use transgressed any statutory boundary resignation, in or any that manner it continued amounting to after the unlawful processing. 31. Counsel stressed that the Respondent acted in good faith throughout and acted reasonably as soon as they were notified of the same. Counsel as such maintained that the Respondent did not infringe on the Petitioner’s right under Article 31 of the Constitution as alleged. Reliance was placed in Monicah Wambui Ng'ang'a v Royal Media Constitutional Petition E501 of 2025 – Judgment Page 9 of 21

page 9 of 21

Services Ltd [2023] eKLR, where the Court observed that: “Mere continued display of a photograph on archival media, without evidence of profit or malice, does not amount to infringement of privacy." 32. Further reliance was placed on Google Kenya Ltd v M W K & Another [2019] eKLR, Ndirangu v Standard Group PLC [2025] KEHC 291, L W M v Attorney General & 3 Others (2016] eKLR and Coalition for Reform and Democracy (CORD) & 2 Others v Republic [2015] eKLR. 33. On the final issue, Counsel submitted that the Court in Emmah Muthoni Njeri v The Nairobi Women's Hospital (2018] KEHC held that: “An award for constitutional violation is not confined to traditional compensatory damages but serves primarily to vindicate the constitutional right infringed. Lord Nicholls observed that a declaration may sometimes suffice, and that any monetary award must be discretionary, proportionate, and directed toward vindication rather than enrichment. He cautioned that while an additional award may occasionally be justified to reflect public concern or deter future breaches, its object is not punishment; the terms "punitive" or "exemplary" are better avoided in describing such redress. Thus, constitutional damages are a scalpel for restoration, not a sword for retribution.” 34. Counsel argued that in this matter the sought relief is unmerited as the Petitioner neither demonstrated actual Constitutional Petition E501 of 2025 – Judgment Page 10 of 21

page 10 of 21

loss nor demonstrated deliberate or reckless violation to warrant a vindicatory award. Counsel reiterated that the Respondent acted promptly, transparently, and in good faith upon notification. Counsel postulated that to impose general and exemplary damages on the facts of this case would convert the vindicatory purpose of constitutional redress into unwarranted enrichment, contrary to the guidance for issuance of such awards. Considering this, Counsel urged the Court to exercise restraint by ensuring that compensation remains a vehicle of vindication rather than a windfall. Analysis and Determination 35. It is my considered view that the issues that arise for determination in this matter are: i. Whether the Petitioner exhausted the available mechanism in the Data Protection Act. ii. Whether the Petitioner’s right under Articles 31 of the Constitution was violated by the Respondent. iii. Whether the Petitioner is entitled to the relief sought. Whether the Petitioner exhausted the available mechanism in the Data Protection Act. 36. The Supreme Court in Waity v Independent Electoral & Boundaries Commission & 3 others [2019] KESC 54 (KLR) guided as follows: Constitutional Petition E501 of 2025 – Judgment Page 11 of 21

page 11 of 21

“[63] Where the Constitution or the law, consciously confers jurisdiction to resolve a dispute, on an organ other than a court of law, it is imperative that such dispute resolution mechanism, be exhausted before approaching the latter. Were it not so, parties would bide their time, overlooking the recognized forums, and later springing a complaint at the courts. Such a scenario would be a clear recipe for forum shopping, an undertaking that must never be allowed to fester in the administration of justice. We are fortified in this regard, by the persuasive authority by the Court of Appeal, in Geoffrey Muthinja Kabiru & 2 Others; [2015] eKLR; wherein the Appellate Court observed: “It is imperative that where a dispute resolution mechanism exists outside the Courts, the same be exhausted before the jurisdiction of the Courts be invoked. Courts ought to be fora of last resort and not the first port of call the moment a storm brews…The exhaustion doctrine is a sound one and serves the purpose of ensuring that there is a postponement of judicial consideration of matters to ensure that a party is first of all diligent in the protection of his own interest within the mechanisms in place for resolution outside the Courts.” 37. Equally, the Supreme Court in Mumba & 7 others (Sued on their own behalf and on behalf of predecessors and or successors in title in their capacities as the Registered Trustees of Kenya Ports Authority Pensions Scheme) v Munyao & 148 others (Suing on their own behalf and on behalf of the Plaintiffs and other Members/Beneficiaries of the Kenya Ports Constitutional Petition E501 of 2025 – Judgment Page 12 of 21

page 12 of 21

Authority Pensions Scheme) [2019] KESC 83 (KLR) stated as follows: “…We hold that if indeed the appellant had any dispute with the RBA, he ought to have followed the route prescribed by the RBA, before proceeding to the High Court. We hold like the court below, and for the reasons we have given, that the appellant’s petition lacked merit and was for dismissal.” [118] In the pursuit of such sound legal principles, it is our disposition that disputes disguised and pleaded with the erroneous intention of attracting the jurisdiction of superior courts is not a substitute for known legal procedures. Even where superior courts had jurisdiction to determine profound questions of law, first opportunity had to be given to relevant persons, bodies, tribunals or any other quasi-judicial authorities and organs to deal with the dispute as provided for in the relevant parent statute. [119] Such a deferred jurisdiction and the postponement of judicial intervention and reliefs until the mandated statutory or constitutional bodies take action rests, not alone on the disinclination of the judiciary to interfere with the exercise of the statutory or any administrative powers, but on the fact of a legal presumption that no harm can result if the decision maker acts upon a claim or grievance. Such formulation underlies the analogous cases, frequently cited for the exhaustion doctrine, in which the court refuses to enjoin an administrative official from performing his statutory duties on the ground that until he has acted the Constitutional Petition E501 of 2025 – Judgment Page 13 of 21

page 13 of 21

complainant can show no more than an apprehension that he will perform his duty wrongly, a fear that courts will not allay. Such cases may be expressed in the formula that judicial intervention is premature in the absence of administrative action.” 38. The law that governs personal data in Kenya is the Data Protection Act, Cap 411 C which gives effect to Article 31(c) and (d) of the Constitution. The preamble to the Act states as follows: ‘AN ACT of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.’ 39. Section 2 of the Act defines “personal data” as ‘any information relating to an identified or identifiable natural person’ "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed; "Identifiable natural person" means a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity; "data subject" means an identified or identifiable natural person who is the subject of personal data; Constitutional Petition E501 of 2025 – Judgment Page 14 of 21

page 14 of 21

"data controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data; "data processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller; 40. In dealing with personal data the Act under Section 25 provides the following principles: Principles of data protection Every data controller or data processor shall ensure that personal data is— a) processed in accordance with the right to privacy of the data subject; b) processed lawfully, fairly and in a transparent manner in relation to any data subject; c) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; e) collected only where a valid explanation is provided whenever information relating to family or private affairs is required; f) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; Constitutional Petition E501 of 2025 – Judgment Page 15 of 21

page 15 of 21

g) kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and h) not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject. 41. Correspondingly the Act outlines the rights of a person referred to as a data subject as follows under Section 26: A data subject has a right— a) to be informed of the use to which their personal data is to be put; b) to access their personal data in custody of data controller or data processor; c) to object to the processing of all or part of their personal data; d) to correction of false or misleading data; and e) to deletion of false or misleading data about them. 42. The core of this Petition is the claim by the Petitioner that the Respondent continued to maintain the Petitioner’s image on its website and other platforms after the Petitioner’s resignation employment. The from Petitioner thus the Respondent’s alleges that the Respondent’s action violates his rights under Article 31 of the Constitution as read with Data Protection Act, Cap 411 C. Constitutional Petition E501 of 2025 – Judgment Page 16 of 21

page 16 of 21

43. The Respondent contended that the Petitioner’s name and image no longer appear on the Respondent’s website because upon being notified of the same, they immediately removed them as the continued display was not malicious but an inadvertent oversight on their part. Previously, the Respondent stated that during the engagement of the Petitioner in its employment, his name and photograph were displayed on their website and other platforms with his consent hence the use of the Petitioner’s name and image was in compliance with the requirements of the Data Protection Act. The Respondent further contended that the Petitioner has failed to demonstrate the injury suffered and proof of commercial use of his image. 44. From the facts, it is manifest that the Petitioner does not complain about the publication which occurred while he was still in the employment of the Respondent but the complaint in this Petition relates to the display of his name and image after resignation from the Respondent’s employment. Further, the Petitioner does not claim that his image was used for commercial exploitation, only that, after he left employment, the Respondent did not remove the information that it had listed in its website about him. The question thus becomes, is this a matter that this Court should entertain or should the Court defer to the jurisdiction of the Data Protection Commissioner? Constitutional Petition E501 of 2025 – Judgment Page 17 of 21

page 17 of 21

45. This form of breach is what in my view Section 25 (g) of the Data Protection Act aptly addresses by placing an obligation on the data controller or processor to ensure that that personal data is kept for ‘no longer than is necessary for the purposes which it was collected.’ 46. This is basically what the Petitioner is complaining about, that the Respondent has breached personal data rights for continuing to display his name and image on its website well aware that he already resigned from the Respondent. 47. Section 56 of the of Data Protection Act provides that complaints against anything covered under the Act be made to the Data Commissioner. It states: ‘A data subject who is aggrieved by a decision of any person under this Act may lodge a complaint with the Data Commissioner in accordance with this Act.’ 48. Section 65 Protection addresses Commissioner instances is where entitled the to Data consider compensation of the data subject. It states: (1) A person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor. (2) Subject to subsection (1)— (a) a data controller involved in processing of personal data is liable for any damage caused by the processing; and Constitutional Petition E501 of 2025 – Judgment Page 18 of 21

page 18 of 21

(b) a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor— (i) has not complied with an obligation under the Act specifically directed at data processors; or (ii) has acted outside, or contrary to, the data controller's lawful instructions. (3) A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage. (4) In this section, "damage" includes financial loss and damage not involving financial loss, including distress. 49. Section 64 provides for the Right of appeal against the decision of the Data Protection Commissioner as follows: ‘A person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court.’ 50. It is the finding of this Court that the matter that the Petitioner is complaining about ‘that his name and image continued to be published in the Respondent website even after he had resigned’ was a matter that squarely fell under the Data Protection Act, in particular Section 25 (g) which provides that personal data be retained in identifiable form for only as long as necessary for purposes for which it was collected. The right forum to address the complaint was, as directed by Section 56, the Constitutional Petition E501 of 2025 – Judgment Page 19 of 21

page 19 of 21

office of the Data Protection Commissioner, which is given the mandate under Section 57 to investigate and if necessary, grant the remedies appropriate remedies under the Act, which include compensation. The High Court jurisdiction was thus invoked prematurely as it could only come at the appellate stage. This is because the nature complaint is the breach of privacy through publication of personal data and did not include any other allegation of breach of fundamental right beyond the competence of the Data Protection Commissioner. Petitioner was mechanism supposed provided for to exhaust in under the the The statutory Act before approaching this Court for a remedy. 51. This Court thus declines to entertain the Petition as it offends the doctrine of exhaustion. The Petitioner has not demonstrated that the statutory remedy is ineffective so as to dissuade this Court from deferring to the statutory mechanism provided for adjudication of such claims. This being a jurisdictional issue, I find it unnecessary to consider any other issue in the Petition. 52. I find merit in the Preliminary Objection, which I uphold. I strike out this Petition. I make no orders as to costs. Dated, signed and delivered virtually at Nairobi this 12 th day of March, 2026. ……………………………………….. L N MUGAMBI Constitutional Petition E501 of 2025 – Judgment Page 20 of 21

page 20 of 21

JUDGE Constitutional Petition E501 of 2025 – Judgment Page 21 of 21

page 21 of 21