Elizabeth Waithira Chege v Angela Chemeli Shollei & 1 other

an infringement of her constitutional rights to dignity and privacy. ii. A Declaration that the Petitioner is entitled to damages for violation of her constitutional rights to dignity and privacy. iii. General damages for breach Petitioner's right to privacy. iv. An order prohibiting the Respondent from using any further, or such information obtained on account of the breach of the Petitioner's privacy. v. Any other, further relief that this Court will deem fit and just to give in the circumstances of this case. vi. The Costs of this Petition be provided for. of the Petitioner’s case 4. The Petitioner a Kenyan citizen who resides and works in Namibia. She is the registered user of Safaricom mobile number 0722XXX713. She states that she has been engaged in a family succession dispute with the Respondent who is her niece. 5. By way of background, she stated her sister lived in their parents’ house in Buruburu with her two children. One of her sister’s children is the Respondent herein. Upon her demise, the siblings resolved to address their family issues, including retrieval of documents from the house where now the Respondent remained with her younger Constitutional Petition No. E382 of 2023 – Judgment Page 2 of 25

page 2 of 25

sister. Consequently, they resolved that the Petitioner would come to Kenya to handle the matter. 6. She depones that during her visit to Kenya in June and July 2021, the Respondent refused to grant her access into the house. In fact, she alleges that when she tried to access the house, the Respondent insulted and assaulted her. 7. Additionally, during the same period, she realized that her mobile phone started behaving unusually. To be precise, her phone would reboot occasionally without a prompt and while on a call, she would hear an echo, as if a third party was listening to their conversation. 8. Further to this, she depones that the Respondent and other people close to her had confidential information concerning her yet she had not shared that information with them. She notes that this information was only existing in her phone. Apprehensive that she may have been hacked, she switched off her phone and registered a new phone number. 9. She depones that thereafter on 16th March 2022, she was served with Succession Cause No. E1346 of 2021, wherein she and the Respondent are parties. She decries that to her utter shock, the Respondent in her affidavit dated 9th September 2021 attached screenshots of her private conversations for the month on June and July 2021.The Respondent as Constitutional Petition No. E382 of 2023 – Judgment well shared conversations Page 3 of 25

page 3 of 25

between her and her advocate, which is privileged information. 10. The Petitioner maintains that at no point did she provide this information to the Respondent and thus it is apparent that the Respondent unlawfully intercepted, interfered with and hacked her phone. 11. The Petitioner argues that the Respondent’s act of procuring her private information without her authorization is in violation of her right to dignity and privacy under Article 31 of the Constitution. 12. She as well takes issue with the Respondent’s reliance on illegally obtained evidence, which action constitutes an offence under Section 14 of the Computer Misuse and Cyber Crimes Act and is in breach of Article 50(4) of the Constitution. The Petitioner states that she lodged a complaint with the Directorate of Criminal Investigations (DCI) through a letter dated 21st April 2022. 13. The Petitioner thus seeks this Court’s intervention. Respondent’s Case 14. The Respondent in reply filed her Replying Affidavit sworn on 25th October 2024. 15. On the onset, she argues that the Petition, offends the doctrine of constitutional avoidance since the issues raised Constitutional Petition No. E382 of 2023 – Judgment Page 4 of 25

page 4 of 25

are not constitutional in nature. Furthermore, she contends that the Petition is incompetent, bad in law and an abuse of the Court process as the issues raised herein are res judicata owing to Succession Cause No. E1346 of 2021. She stresses that the Petitioner should have raised these issues before the said Court before it rendered its Judgment and issued the orders dated 2nd February 2023. 16. The Respondent also asserts that the Petition has not been pleaded with precision as set out in Annarita Karimi Nieru vs Republic (No. J) 119791 KLR 154. She claims that the Petitioner has not particularized the specific violations of the Constitution. 17. Denying the Petitioner’s assertions, she depones that it is the Petitioner who granted her access to her WhatsApp when they visited her at Namibia. She informs that the Petitioner linked her WhatsApp with her laptop through WhatsApp Web. She claims that the Petitioner failed to log out of the WhatsApp Web on the laptop. 18. She avers that contrary to the Petitioner’s allegation, she welcomed her with open arms when she came to Kenya. She depones that during the visit, her sister informed her that the Petitioner, their uncle, George Gachoka and their housekeeper broke the lock to their mother’s bedroom and started removing documents. She states that their intention was to burn the documents within the compound. As a result, she rushed to the house where she alleges that Constitutional Petition No. E382 of 2023 – Judgment Page 5 of 25

page 5 of 25

she and her sister were assaulted and pushed towards the fire. She reported this matter to the police. 19. Further to this, she claims that during the same period, the Petitioner’s messages popped up on her laptop, where she discovered that her name was being mentioned. She asserts that when she went through the messages, she discovered the Petitioner’s alleged malicious plans to disinherit her and her sister of their mother’s estate including her car. On this basis, she resolved to present the same in Court as evidence. 20. She claims that her actions coupled with the Petitioner’s carelessness in failing to log out of the WhatsApp Web cannot be construed to be an illegality and offensive to Article 31 of the Constitution. 21. Additionally, she contends that the Petition is riddled with false allegations and thus the Petitioner has not come to Court with clean hands. In sum, she adjudges the Petition as malicious and an attempt to defeat justice. For this reason, she asserts that the Petition lacks merit and so should be dismissed. Petitioner’s Submissions 22. The Petitioner through Ikua and Nyambane Advocates LLP filed two sets of submissions dated 30 th September 2024 and 12th February 2025. Constitutional Petition No. E382 of 2023 – Judgment Page 6 of 25

page 6 of 25

23. To commence with, Counsel argued that the Petition should be allowed on the account that the Respondent illegally accessed the Petitioner’s phone records and utilized the same as her evidence in the succession suit. This included the Petitioner’s communication with her advocate which is privileged and concerned the succession case. As a result, Counsel argued that this violated the Petitioner’s right to a fair hearing and offensive to the rules of natural justice. 24. Counsel further submitted that the Respondent’s action was in gross violation of her constitutional right to dignity and privacy in violation of Article 31 of the Constitution. To buttress this point, reliance was placed in Kenya Human Rights Commission v Communications Authority of Kenya & 4 others [2018] eKLR where it was held that: “Privacy is a fundamental human right, enshrined in numerous international human rights instruments. It is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information, and association. The right to privacy embodies the presumption that individuals should have an area of autonomous development, interaction, and liberty, a “private sphere” with or without interaction with others, free from arbitrary state intervention and from excessive unsolicited intervention by other uninvited individuals. Activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.” Constitutional Petition No. E382 of 2023 – Judgment Page 7 of 25

page 7 of 25

25. Reliance was placed on Catherine Njeri Wanjiru v Machakos University KEHC 10599 (KLR). 26. Further to this, Counsel argued that the Respondent’s actions are in breach of Section 26 of the Data Protection Act as well as Section 14 of the Computer Misuse and Cyber Crimes Act. 27. On constitutional avoidance, Counsel submitted that this principle does not apply in this case as the Petition solely focusses on violation of Article 31 of the Constitution. Counsel argued that the Court in Mutyaene v. KCB Bank Ltd & Another [2023] KEHC 2205 (KLR), recognized that constitutional avoidance does not apply in instances where a claim is based on the direct breach of a constitutional right. As such, the Court emphasized that where a Petitioner seeks the enforcement of fundamental rights, the High Court's jurisdiction under Article 165(3) (b) of the Constitution is properly invoked. 28. Comparable reliance was placed in Ondleki v. Maeda (Petition E153 of 2022) (2023) KEHC 18290 (KLR), and Okiya Omtatah Okoiti v. Communications Authority of Kenya & 14 Others (2015) eKLR. 29. Furthermore, Counsel argued that the Data Protection Act does not divest the High Court of its constitutional mandate. Equally that, the constitutional framework does not subordinate fundamental Constitutional Petition No. E382 of 2023 – Judgment rights to statutory Page 8 of 25

page 8 of 25

mechanisms as advanced by the Respondent. As such, Counsel argued that the right to privacy is a fundamental right and its breach cannot be relegated to mere administrative procedures when it raises serious constitutional questions. 30. Reliance was placed in Southlake Panorama Limited v Kenya Electricity Transmission Company Limited & 3 others [2021] eKLR where it was held that: “The constitutional jurisdiction of the court is a very specific jurisdiction which is not open to general claims. It is invoked pursuant to Articles 22 (1) and 23 of the Constitution by filing a petition. The reliefs that a court exercising the constitutional jurisdiction can grant are clearly spelt out by Article 23 (3). The "compensation" contemplated by Article 23 is in regard to denial, violation or infringement, or threat to a right or fundamental freedom in the Bill of Rights under Article 22 and not compensation in respect of wayleave. So as to ensure that constitutional jurisdiction of the court is not misused, the doctrine of constitutional avoidance comes in handy. It frowns upon the practice of bringing ordinary disputes to the constitutional court.” 31. Tying to this, Counsel affirmed that this Court has jurisdiction to entertain this matter by virtue of Article 165(3)(b) of the Constitution. In Counsel’s view, the Respondent’s argument that the matter should have been addressed by the Data Protection Commissioner fails to appreciate the fundamental distinction between statutory remedies and constitutional enforcement. Constitutional Petition No. E382 of 2023 – Judgment Page 9 of 25

page 9 of 25

32. Counsel asserted thus that the Respondent's reliance on the Data Protection Act is misplaced, as it does not override the supremacy of the Constitution or the enforcement mechanisms provided under Article 165 of the Constitution. To buttress this point, reliance was placed in the Matter of Interim Independent Electoral Commission [2011] KESC 1 (KLR), where it was held that any statutory provision or administrative mechanism that purports to limit the enforcement of constitutional rights must be read in a manner that conforms with the Constitution. 33. Counsel on the claim of res judicata submitted that it is also misplaced as the key issue in the Petition is the violation of the Petitioner’s right to privacy. Counsel asserted that the right to privacy is a distinct constitutional claim that could not have been, fully adjudicated in the succession proceedings. Additionally, Counsel argued that succession proceedings exercise a limited and specialized jurisdiction as conferred by the Law of Succession Act, focusing primarily on the administration and distribution of estates. Considering this, Counsel argued that the Court does not have the mandate to adjudicate constitutional violations. 34. Counsel relied in John Florence Maritime Services Limited & Another v. Cabinet Secretary for Transport & Infrastructure & 3 Others [2015] eKLR where it was held that for res judicata to apply, the issue Constitutional Petition No. E382 of 2023 – Judgment Page 10 of 25

page 10 of 25

in dispute must have been properly before the former court and within its jurisdiction to determine. 35. Further reliance was placed on Independent Electoral and Boundaries Commission v. Maina Kial & 5 Others [2017] eKLR and John Njue Nyaga v. Nicholas Njiru Nyaga & Another [2013] eKLR. Respondent’s Submissions 36. The Respondent filed submissions dated 25 th October 2024 through its Counsel, Allamano and Associates Advocates. Counsel sought to discuss: whether the Petition offends the principle of constitutional avoidance, whether the Court has jurisdiction to entertain this matter and whether the issues raised are res judicata. 37. On the first issue, Counsel submitted that the principle of avoidance entails a Court to refrain from determining a constitutional issue if the matter may properly be decided on another basis. Counsel contended that the Petition does not raise a constitutional issue. According to Counsel, the issue falls within the purview of the Data protection Act wherein an appropriate procedure for redress has been set out under the Office of the Data Protection Commissioner. Counsel stressed thus that the Petitioner ought to have utilized this mechanism. 38. Reliance was placed in Joseph Mwangi Mbote & 2 others v Kenya Tea Constitutional Petition No. E382 of 2023 – Judgment Development Agency Page 11 of 25

page 11 of 25

(Holdings)Ltd and another;Kiru Tea Factory Limited (2020)eKLR where it was held that: “Where there is a parallel remedy, Constitutional relief should not be sought unless the circumstances of which the complaint is made include some feature which makes it appropriate to take that course. As a general rule there must be some feature, which, at least arguably indicates that the means of least redress otherwise available would not be adequate. To seek constitutional relief in the absence of such feature would be a misuse, an abuse of the Court's process." 39. Further reliance was placed on CNM v WMG (2018) eKLR and Speaker of the National Assembly v James Njenga Karume [1992] eKLR. 40. Counsel submitted as such in the second issue that this Court lacks jurisdiction to entertain this matter. To buttress this point reliance was placed in Dhow House Limited v Kenya Power and Lighting Company [2022] KEHC 11840 (KLR) where it was held that: “A reading of the issues presented in this petition leave no doubt that the petitioner’s grievance if any can effectively be addressed in the forum created by the statute and or in a civil suit. To me, this is a proper and fit case for this court to invoke the doctrine of constitutional avoidance and decline to entertain the matter.” 41. Reliance was placed on KKB v SCM & 5 Other [2022] KEHC 289 (KLR) and Isaac Makokha Okere v Mumias Outgrowers Sacco Society Limited & 9 other [2021] eKLR. Constitutional Petition No. E382 of 2023 – Judgment Page 12 of 25

page 12 of 25

42. Counsel as well submitted that this matter is res judicata in light of the succession suit. Counsel underscored that Section 7 of the Civil Procedure Act provides under explanation 4 that ‘any matter which might and ought to have been made a ground of defence or attack in such former suit shall be deemed to have been a matter directly and substantially in issue in such suit’. Counsel stressed that the issues raised in the Petition ought to have been raised in the succession matter and sought an order to prohibit use of the alleged illegal evidence however, the Petitioner failed to do so. 43. Reliance was placed in E. T. vs. Attorney General & Another (2012) eKLR where it was held that: “The courts must always be vigilant to guard litigants evading the doctrine of res judicata by introducing new causes of action so as to seek the same remedy before the court. The test is whether the plaintiff in the second suit is trying to bring before the court in another way and in a form of a new cause of action which has been resolved by a court of competent jurisdiction. In the case of Omondi Vs National Bank of Kenya Limited and Others (2001) EA 177 the court held that, 'parties cannot evade the doctrine of res judicata by merely adding other parties or causes of action in a subsequent suit." 44. Additional reliance was placed on Kenya Hotel Properties Limited v Willsden Investments Limited and 6 others (2013) eKLR. 45. To this end, Counsel argued that this suit is bad in law and lacks merit. Furthermore, that it was not pleaded with precision as dictated in the Anarita Karimi case(supra). Constitutional Petition No. E382 of 2023 – Judgment Page 13 of 25

page 13 of 25

On this premise, Counsel argued that the Petitioner is not entitled to the relief sought. Analysis and Determination 46. It is my considered view that the issues that arise for determination in this matter are: i. Whether the Petition raises constitutional questions. ii. Whether the Petition offends the doctrine of exhaustion of remedies. iii. Whether the Petition is res judicata in view of the succession suit. iv. Whether the Petitioner’s right under Articles 31 of the Constitution was violated by the Respondent. v. Whether the Petitioner is entitled to the relief sought. Whether the Petition raises constitutional questions 47. When a dispute before the Court can be fully resolved on non-constitutional grounds such as applying legislation or well-established legal principles and precedents from case law without the Court being forced to apply or interpret the Constitution for a resolution, then the matter does not truly raise constitutional question and thus should not be litigated or adjudicated as constitutional issue. Articulating this principle, the Court in Lugo v Director of Public Prosecutions [2022] KEHC 10574 (KLR) stated: Constitutional Petition No. E382 of 2023 – Judgment Page 14 of 25

page 14 of 25

“Courts will not normally consider a constitutional question unless the existence of a remedy depends on it; if a remedy is available to an applicant under some other legislative provision or on some other basis, whether legal or factual, a court will usually decline to determine whether there has been, in addition, a breach of the Declaration of rights…. It is a fact that every legal dispute is capable of either direct or indirect application of the Bill of Rights. Every dispute is essentially a constitutional issue when one looks at it. This arises necessarily because of the principle of constitutional supremacy. One needs to be aware, however, of the singleness of the legal system. This is embodied in the fact that the supremacy of the Constitution does not detract from the usefulness of the rest of the body of law. In essence, all other laws give full expression to the ideals of the Constitution until found to be inconsistent with it. …. The exceptions to the application of the doctrine of constitutional avoidance are: i. where the constitutional violation is so clear and of direct relevance to the matter, ii. in the absence of an apparent alternative form of ordinary relief and iii. where it is found that it would be a waste of effort to seek a non-constitutional resolution of the dispute.” 48. Correspondingly in C O D & another vs Nairobi City Water & Sewerage Co. Ltd [2015] KEHC 7762 (KLR) the Court held: “… To my mind therefore, not every litigant ought to come to court by way of a Constitutional Petition No. E382 of 2023 – Judgment Page 15 of 25

page 15 of 25

constitutional petition even where there are no constitutional issue arising and where there are adequate remedies provided in other laws to determine such situations. 15. The Constitution cannot be used as a general substitute for the normal procedures. The mere allegation that a human right has been contravened is not itself sufficient to entitle the applicant to invoke the jurisdiction of the High Court under Article 165 of the Constitution: See Harrikissoon v A-G [1979] 3 WLR 62. Where it is possible to decide any case or dispute, civil or criminal, without reading a constitutional issue then that is the course that should be followed. The court sitting as a constitutional court must through the doctrine of avoidance steer clear of determining such disputes as if there were constitutional questions being raised: see S v Mhlungu [1995] 3 SA 867 (CC) and also Ashwander v Tennessee 297 US 288.” 49. The Petitioner complains that the Respondent illegally accessed the Petitioner’s phone records and utilized them in the affidavit sworn on 9/9/2021 as her evidence in the Succession Cause No. E1346 of 2012. That the same included the Petitioner’s communication with her advocate yet it is privileged communication hence was gross violation of her constitutional right to dignity and privacy in violation of Article 31 of the Constitution. 50. The Respondent denied the Petitioner’s allegations and deposed that it is the Petitioner who granted her access to her WhatsApp when they visited her at Namibia after she linked her WhatsApp with Constitutional Petition No. E382 of 2023 – Judgment her laptop through the Page 16 of 25

page 16 of 25

WhatsApp Web and failed to log out of the WhatsApp Web on the laptop. She claimed that when this incident happened, the Petitioner’s messages popped up on her laptop, and she discovered that her name was being mentioned and thus went through the messages and discovered the Petitioner’s alleged malicious plans to disinherit her and her sister of their mother’s estate including her car. That is why she resolved to present the same before Court as evidence. She contended that the Petitioner was to blame for her carelessness of failing to log out of the WhatsApp Web and she should thus not be blamed for violating her right to privacy under Article 31 of the Constitution. 51. In my humble view, the issue of whether or not the evidence obtained in the manner complained of was admissible in court was a matter that the Court that handling the succession case (Succession Cause E1346/2012) was fully seized of and was the proper place to raise an objection if indeed the manner of its collection are as alleged was so that Succession Court could have an opportunity to inquire into any alleged irregularity or impropriety and rule on whether the evidence could be admitted or not. The Petition as framed is a collateral attack directed at the Succession proceedings, which if allowed, has the potential to undermine the finality of that decision yet the proper way to challenge such a decision is by of appeal or review. Constitutional Petition No. E382 of 2023 – Judgment Page 17 of 25

page 17 of 25

Whether the Petition offends the doctrine of exhaustion of remedies 52. The Supreme Court in Waity v Independent Electoral & Boundaries Commission & 3 others [2019] KESC 54 (KLR) guided as follows: “[63] Where the Constitution or the law, consciously confers jurisdiction to resolve a dispute, on an organ other than a court of law, it is imperative that such dispute resolution mechanism, be exhausted before approaching the latter. Were it not so, parties would bide their time, overlooking the recognized forums, and later springing a complaint at the courts. Such a scenario would be a clear recipe for forum shopping, an undertaking that must never be allowed to fester in the administration of justice. We are fortified in this regard, by the persuasive authority by the Court of Appeal, in Geoffrey Muthinja Kabiru & 2 Others; [2015] eKLR; wherein the Appellate Court observed: “It is imperative that where a dispute resolution mechanism exists outside the Courts, the same be exhausted before the jurisdiction of the Courts be invoked. Courts ought to be fora of last resort and not the first port of call the moment a storm brews…The exhaustion doctrine is a sound one and serves the purpose of ensuring that there is a postponement of judicial consideration of matters to ensure that a party is first of all diligent in the protection of his own interest within the mechanisms in place for resolution outside the Courts.” 53. Equally, the Supreme Court in Mumba & 7 others (Sued on their own behalf and on behalf of predecessors and or successors in title in their capacities as the Registered Trustees Constitutional Petition No. E382 of 2023 – Judgment of Kenya Ports Authority Page 18 of 25

page 18 of 25

Pensions Scheme) v Munyao & 148 others (Suing on their own behalf and on behalf of the Plaintiffs and other Members/Beneficiaries of the Kenya Ports Authority Pensions Scheme) [2019] KESC 83 (KLR) stated as follows: “…We hold that if indeed the appellant had any dispute with the RBA, he ought to have followed the route prescribed by the RBA, before proceeding to the High Court. We hold like the court below, and for the reasons we have given, that the appellant’s petition lacked merit and was for dismissal.” [118] In the pursuit of such sound legal principles, it is our disposition that disputes disguised and pleaded with the erroneous intention of attracting the jurisdiction of superior courts is not a substitute for known legal procedures. Even where superior courts had jurisdiction to determine profound questions of law, first opportunity had to be given to relevant persons, bodies, tribunals or any other quasi-judicial authorities and organs to deal with the dispute as provided for in the relevant parent statute. [119] Such a deferred jurisdiction and the postponement of judicial intervention and reliefs until the mandated statutory or constitutional bodies take action rests, not alone on the disinclination of the judiciary to interfere with the exercise of the statutory or any administrative powers, but on the fact of a legal presumption that no harm can result if the decision maker acts upon a claim or grievance. Such formulation underlies the analogous cases, frequently cited for the exhaustion Constitutional Petition No. E382 of 2023 – Judgment Page 19 of 25

page 19 of 25

doctrine, in which the court refuses to enjoin an administrative official from performing his statutory duties on the ground that until he has acted the complainant can show no more than an apprehension that he will perform his duty wrongly, a fear that courts will not allay. Such cases may be expressed in the formula that judicial intervention is premature in the absence of administrative action.” 54. The law that governs personal data in Kenya is the Data Protection Act, Cap 411 C which gives effect to Article 31(c) and (d) of the Constitution. The preamble to the Act states as follows: ‘AN ACT of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.’ 55. Section 2 of the Act defines “Personal data” as ‘any information relating to an identified or identifiable natural person’ "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed; "Identifiable natural person" means a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, Constitutional Petition No. E382 of 2023 – Judgment Page 20 of 25

page 20 of 25

genetic, mental, economic, cultural or social or social identity; "data subject" means an identified or identifiable natural person who is the subject of personal data; "data controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data; "data processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller; 56. Under Section 3 (c), (d) & (e); the objects and purpose of the Act include: (c) (d) to protect the privacy of individuals; to establish the legal and institutional mechanism to protect personal data; and (e) to provide data subjects with rights and remedies to protect their personal data from processing that is not in accordance with this Act. 57. In dealing with personal data the Act under Section 25 provides the following principles: Principles of Data Protection Every data controller or data processor shall ensure that personal data is— a) processed in accordance with the right to privacy of the data subject; b) processed lawfully, fairly and in a transparent manner in relation to any data subject; Constitutional Petition No. E382 of 2023 – Judgment Page 21 of 25

page 21 of 25

c) collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes; d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; e) collected only where a valid explanation is provided whenever information relating to family or private affairs is required; f) accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay; g) kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject. h) 58. Correspondingly the Act outlines the rights of a person referred to as a data subject as follows under Section 26: A data subject has a right— a) to be informed of the use to which their personal data is to be put; b) to access their personal data in custody of data controller or data processor; c) to object to the processing of all or part of their personal data; d) to correction of false or misleading data; and Constitutional Petition No. E382 of 2023 – Judgment Page 22 of 25

page 22 of 25

e) to deletion of false or misleading data about them 59. Section 56 (1) allows a ‘A data subject who is aggrieved by a decision of any person under the Act to lodge a complaint with the Data Commissioner in accordance with this Act’. 60. The core of this Petition is the claim by the Petitioner that the Respondent, without the consent of the Petition, illegally accessed and processed her personal data and used it for purposes not authorized or consented to by the data subject (i.e. the Petitioner). In my view, other failing to raise the matter before the Court that was seized with the matter in the first place, this was also this Statutory mechanism that was available to the Petitioner but which she overlooked. She should have lodged a complaint with the Data Protection Commissioner for investigation and determination. 61. Finally, the claim of hacking and hijacking of information from the Petitioner’s phone by the Respondent points to commission of crime under the Computer Misuse and Cyber Crimes Act hence the matter ought to have been criminally investigated to unravel the truth in view of the conflicting claims by both sides as to how the information was acquired. Without the benefit of a forensic investigation, any attempt to resolve the issue based on contested bare allegations is speculative and futile as no Constitutional Petition No. E382 of 2023 – Judgment Page 23 of 25

page 23 of 25

definitive finding can be reached based on the inconclusive nature of the evidence on record. 62. This Court thus finds that not only does this Petition not raise genuine constitutional questions, but also, the Petitioner did not exhaust the statutory mechanism that was at her disposal, she failed to Report the allegations of data breach to the Office of Data Protection Commissioner. Further, the claim could also be pursued criminally to unravel the truth about the hacking and hijacking of personal data from her phone so that further appropriate action, including but not limited to prosecution can follow. In my view, forums provided for by the Data Protection Act and Computer Misuse and Cyber Crimes Act were sufficient to resolve the complaint without invoking the Constitution. 63. I thus find that the Petition offends the principles the twinprinciples of the constitutional avoidance and exhaustion of remedies. The Petition is misconceived. The upshot is that it is hereby dismissed. 64. Costs are awarded at the discretion of the Court. The Respondent and the Petitioner are family- Niece and Aunt. Each Party shall bear its own costs. Dated, signed and delivered virtually at Nairobi this 26 th March, 2026. ……………………………………… L N MUGAMBI Constitutional Petition No. E382 of 2023 – Judgment Page 24 of 25

page 24 of 25

JUDGE Constitutional Petition No. E382 of 2023 – Judgment Page 25 of 25

page 25 of 25