Republic v The Office of Data Protection Commissioner

AND THE OFFICE OF DATA PROTECTION COMMISSIONER .......... RESPONDENT AND HS ............................................................................................... INTERESTED PARTY NATION MEDIA GROUP PLC ............................................. INTERESTED PARTY THE BOM, THE SH MG SCHOOL ....................................... INTERESTED PARTY AND GEI ......................................................................................... EX PARTE APPLICANT FKM ....................................................................................... EX PARTE APPLICANT JUDGMENT (The Court has anonymized names of the applicants and the 1st and 3rd interested party to protect their right to privacy) 1. The substantive Notice of Motion dated 2nd December 2025 and filed pursuant to leave granted by Chigiti J. SC on 18th November 2025 in HC MISCJR/E177/2025 is brought under the provisions of Articles 22 (1), 23 (3) (f), 31, 47, 48 and 50 (1) of the Constitution of Kenya; Sections 3(c), 4(3), 6, 7 (1) (a), 7(3)(b), 8, 9 (1), 10 (1) and 11 (f) of the Fair Administrative Action Act, Sections 56 (1), 56 (5), and 65 (1) of the Data Protection Act Rule 6 of the Data Protection (Complaints Handling Procedure and Enforcement Regulations) 2021, Order 53 Rule 3 of the Civil Procedure Rules, Section 1A, 1B and 3 of the Civil Procedure Act and all enabling provisions of the law. 2. The ex-parte Applicants seek the following Orders: 1. That An order of Mandamus do issue compelling the Respondent to admit ODPC Complaint No. E0285 of 2025: GEI vs. HS, Nation Media Group PLC, and The BOM, The HS of MGSI. 2. That an order of Mandamus do issue compelling the Respondent, that upon admission of ODPC Complaint No. E0285 of 2025: GGEI vs. HS, Nation Media Group PLC, and The BOM of Management, The SH of MGS to carry our investigations and issue a determination within sixty (60) days from the date of admission of the complaint. 3. That the costs of and incidental to this suit to be borne by the Respondent 3. The grounds of the Application are enlisted on face of it and it is also supported by the Verifying Affidavit of GEI dated 24th June 2025 and filed in HCJR/E177/2025 and the Further Affidavit of GEI dated 2nd December 2025. 4. From the grounds of the Application the ex-parte Applicants aver that the 1st and the 2nd Interested Parties published the name and the photograph of the 1st ex-parte Applicant (a minor) in the Saturday Nation issue on 27th March 2023 indicating that she had died then issued an apology on 28th May 2023 for juxtaposing her image in the publication on 27th May 2023 amongst the persons who had died in the MGS tragedy. The ex-parte Applicants aver that the said publication by the 1st and 2nd interested parties was done without the express consent of the 2nd ex-parte Applicant who is the minor’s legal guardian. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 2

page 2 of 9

5. The ex-parte Applicants state that in a bid to enforce their Rights to privacy as provided for and guaranteed by Article 31 of the Constitution, they filed ODPC Complaint No. E0285 of 2025: GEI vs. HS, Nation Media Group PLC, and The BOM, The HS of MGS, and got a response from the Respondent on 5th March 2025 informing their advocates on record to reduce their complaint to FORM DPCI Complaint submission form within the next five (5) days. That this was done and submitted on 8th of March 2025. 6. The ex-parte Applicants aver that they received no further response from the Respondent prompting them to present physical copies of the ODPC Complaint No. E0285 of 2025 to the Respondent which were received on 1st of April 2025. That on 9th April 2025, the ex-parte Applicants through their advocates on record wrote to the Respondent’s Data Protection Commissioner reminding her of the need to conduct an expeditious review of the complaint in line with the provisions of Rule 6 (1) of the Data Protection (Complaint’s handling Procedure and Enforcement) Rules. 7. It is averred that on 10th April 2025, an officer from the Respondent verbally intimated that the Respondent did not have jurisdiction to handle the complaint which led to the ex-parte Applicants sending another letter dated 10th March 2025 seeking clarity on the issue and requesting the Respondent to conduct a preliminary review of the Complaint. 8. The ex-parte Applicants contend that the Respondent has ignored their letters and its statutory duties under Section 56 of the Data Protection Act by acting unreasonably and violating their legitimate expectation and their right to a fair administrative action. It is also a ground of the Application that there has been unreasonable delay and failure by the Respondent to discharge its statutory duty by failing to admit, investigate and determine ODPC Complaint No. E0285 of 2025: GEI vs. HS, Nation Media Group PLC, and The BOM, The HS of MGS Further, that the statutory timeline of ninety (90) days under Section 56 (5) of the Data Protection Act has since lapsed for determining the complaint and the ex-parte Applicants have no right of appeal under Section 64 of the Data Protection Act as a result of the Respondent’s breach of its public duty. 9. In their further Affidavit, the 1st ex-parte Applicant reiterates the contents of her Verifying Affidavit dated 24th June 2025 and deposes that the subject matter of these Judicial Review proceedings arises from the Respondent’s violation of its public duty by failing to investigate and determine ODPC Complaint No. E0285 of 2025: GEI vs. HS, Nation Media Group PLC, and The BOM, The HS of MGS within the ninety (90) days statutory timelines provided under Section 56 (5) of the Data Protection Act which lapsed on 26th May 2025. She reiterates that the failure by the Respondents to hear and determine the complainant amounted to a violation of their right to a fair administrative action and right to fair hearing. That since the remedy of appeal is not available to them and the Respondent is subject to the supervisory jurisdiction of the Honourable Court, it is just and equitable that the reliefs sought are granted. 10. I note that there was neither appearance from the Respondents and the Interested Parties nor responses to the Application. This Court issued directions on 3rd December 2025 for the parties to canvass the Application by written submissions. Further, only the ex-parte Applicants have filed their submissions dated 23rd January 2026, which are on Record. The ex-parte Applicants’ Submissions 11. Counsel for the ex-parte Applicants submitted on three issues being: i. whether the Respondents had a legal duty to investigate and determine the complaint filed by the ex-parte Applicants; https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 3

page 3 of 9

ii. whether the Respondent’s failure to investigate and determine the ex-parte Applicants’ complaint violated the ex-parte Applicants’ legitimate expectation and right to a fair administrative action enshrined under Article 47 (1) of the Constitution of Kenya; and iii. whether the ex-parte Applicants are entitled to the reliefs sought. 12. On the first issue, Counsel submits that the Respondent is a statutory body established under Section 5 of the Data Protection Act, 2019 and has a mandatory legal duty to investigate and determine complaints relating to violation of data protection rights within the jurisdictional timeline of ninety (90) days. That the wordings of Section 56 (5) of Act posit the Respondent’s obligation to investigate and determine complaints as a mandatory rather than a discretionary duty and that Section 8 of the Act further outlines the core functions of the Respondent to include the role of investigating complaints and overseeing the enforcement of data protection rights. 13. It is their submission that since the ODPC received the ex-parte Applicants’ complaint in FORM DPCI on 8th March 2023, and assigned it a Complaint No. 0285 of 2025, they were under a statutory obligation to investigate it and determine it in accordance with the provisions of the Data Protection Act but failed to do so despite the persistent follow-ups by the ex-parte Applicants. Counsel submits that letters were addressed to the Respondent on 9th April 2025 and 10th April 2025, addressing issues of journalistic exemption as well as the Respondent’s jurisdiction but despite acknowledging receipt of the same, the Respondent still failed to provide any updates to the ex-parte Applicants or make a determination in contravention of the law. 14. Counsel cites the case of Gichuhi & 2 others vs. Data Protection Commissioner; Mathenge & Another (Interested Parties) (Judicial Review E028 of 2023) [2023] KEHC 17321 (KLR) (Judicial Review), and Kenya Power & Lighting Co. vs. Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020) [2022] KEHC 496 (KLR) to advance the fact of the Respondent’s time-bound jurisdiction to investigate and determine the complaint. 15. On the second issue, it is submitted that the Respondent’s failure to perform its statutory and public duty by not investigating and determining complaint No. E0285 of 2025, or providing a written cause for their inaction was illegal, unreasonable and in breach of the ex-parte Applicants right to legitimate expectation and right to fair Administrative Action as provided for under Article 47 of the Constitution and Section 4 of the Fair Administrative Action Act. That under Section 4 (2) of the Fair Administrative Action Act, the Respondent also has a duty to give persons affected by their administrative decisions written reasons for such decisions. 16. Counsel makes reference to the doctrine of legitimate expectation as central to administrative fairness and states that it arises when a public authority has induced in a person a reasonable expectation of receiving a benefit or advantage while procedural legitimate expectation arises when a public authority is reasonably expected to follow a particular procedure before taking a decision. The cases of Republic vs. Nairobi City County Government & 4 others; KTK Advocates (Ex-parte Applicant) (Application E173 of 2024) [2025] KEHC 4235 (KLR) and the Supreme Court in Communications Commission of Kenya & 5 Others vs. Royal Media Services & 5 Others SC Petition Nos. 14, 14A, 14B & 14C of 2014 were cited in support. 17. Counsel submits that the ex-parte Applicants had a legitimate expectation that their ODPC Complaint No. 0285of 2025 would be investigated and determined within ninety (90) days and relied on the case of Republic vs. Principal Secretary, Ministry of Transport, Housing and Urban Development Ex-parte Soweto Residents Forum CBO (Miscellaneous Civil Application 461 of 2016) [2019] KEHC 10312 (KLR), where the court outlined how to determine whether there https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 4

page 4 of 9

was a legitimate expectation from a public body. That because the Respondent issued directions to the ex-parte Applicants to lodge the complaint in Form DPCI, assigned a reference number and acknowledged the statutory timeline under Section 56 of the Data Protection Act, they created both a reasonable and legitimate expectation on the ex-parte Applicants that the complaint would be investigated and determined within ninety (90) days. The Court of Appeal decision in Kivuku Agencies vs. Kenya Airport Authorities Accounting Office & another [2020] KECA 283 (KLR) was further cited and it is submitted that the ex-parte Applicants’ right to a fair administrative action that is expeditious, lawful and procedurally fair as set out under Article 47 (1) of the Constitution of Kenya was violated by the Respondent when it ignored their correspondences and failed to adduce written reasons for their conduct. 18. On the third issue, Counsel submits that the Respondent’s inaction for a public duty was a violation of Section 56 of the Data Protection Act and the only remedy available in law for the ex-parte Applicants is for the Court to issue an order of Mandamus against the Respondent. Counsel cites the case of Mutitu Water & Sanitation Co. Ltd vs. Attorney General & 4 others (Judicial Review 1 of 2023) [2025] KEHC 1353 (KLR) where the purpose of an Order of Mandamus was outlined and Mathu vs. Principal Secretary, Ministry of Interior and Coordination of National Government & Another (Judicial Review E133 of 2022) [2023] KEHC 22804 (KLR), where the court in citing Shah vs. Attorney General (No.3) (Kampala HCMC No. 31 of 1969 (1970) EA 543 held that an Order of Mandamus lies where the injured party has a right to have something done but has no alternative means of compelling its performance by a public officer to perform duties imposed upon them by common law or statute. 19. Counsel further cites the case of Kenya National Examination Council vs. Republic Ex-Parte Geoffrey Gathenji Njoroge & 9 others [1997] KECA 58 (KLR), where the Court addressed the scope and efficacy of orders of Mandamus and submits that the ex-parte Applicants have no other legal recourse under the law other than to seek Judicial Review Orders to compel the Respondent to admit the complaint, investigate and issue a determination in line with the provisions of the Data Protection Act. He urges the Court to allow the Application. Analysis and Determination 20. 21. From the pleadings and affidavit as well as the submissions, the main issue for determination is whether the Application is merited as ought to be allowed. To determine this, this court will answer the following questions: i. Whether there exists a legal public duty vested on the Respondent in this case. ii. Whether the Respondent failed to act. iii. Whether the remedy sought by the ex-parte Applicants can issue. iv. Who bears the costs of this Application? The Office of the Data Protection Commissioner is established under Section 5 of the Data Protection Act, 2019. Section 8 sets out the functions of the office as follows: 8. Functions of the Office (1) The Office shall— (a) oversee the implementation of and be responsible for the enforcement of this Act;….. https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 5

page 5 of 9

22. (c) exercise oversight on data processing operations, either of own motion or at the request of a data subject, and verify whether the processing of data is done in accordance with this Act;….. (f) receive and investigate any complaint by any person on infringements of the rights under this Act; The powers of the Data Commissioner are further encapsulated in Section 9 as follows: 9. Powers of the Office (1) The Data Commissioner shall have power to— a. conduct investigations on own initiative, or on the basis of a complaint made by a data subject or a third party; b. obtain professional assistance, consultancy or advice from such persons or organizations whether within or outside public service as considered appropriate; c. facilitate conciliation, mediation and negotiation on disputes arising from this Act; d. issue summons to a witness for the purposes of investigation; e. require any person that is subject to this Act to provide explanations, information and assistance in person and in writing; f. impose administrative fines for failures to comply with this Act; g. undertake any activity necessary for the fulfilment of any of the functions of the Office; and h. exercise any powers prescribed by any other legislation. 23. Accordingly, there is no doubt that Respondent has a duty to receive and investigate complaints as outlined above in the Act. 24. On the second issue, it is not in contention that the ex-parte Applicants lodged their complaint with the Respondent on 25th February 2025 upon which they were directed via e-Mail correspondence dated 5th March 2025 to reduce their complaint to the DPC1 Complaint Form attached therein. The next correspondence is dated 8th March 2025 in which Counsel for the ex-parte Applicants complied with the request and forwarded the requested Form. This was again received and acknowledged by the Respondent vide e-mail correspondence of 7th April 2025. The Respondent further acknowledged receipt of a letter dated 10th April 2025 written by the applicant, seeking to have the Respondent conduct an expeditious preliminary review of their complaint, bearing in mind the statutory timelines. 25. From the various correspondence on record, I observe that there was always an acknowledgement by the Respondent either by stamping a counterpart copy of the ex-parte Applicants’ letters or through an email response sent by its Data Protection Officer. I reproduce the said acknowledgement which states in part as follows: “ …Your complaint is being processed in line with the Act and the Regulations…” https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 6

page 6 of 9

26. It is this response that created some sort of undertaking premised on the above response and equally creates a legitimate expectation on the ex-parte Applicants that the complaint was being investigated and that results of those investigations would be communicated to them. 27. The Respondent vide e-mail dated 23rd June 2025 wrote to the ex-parte Applicants’ Counsel informing counsel that the Respondent had received a response from the 1st and 2nd Interested Parties and asked them to provide a response on the same for further consideration, should they wish to. I note that there were no further correspondences on record between the Respondent and the ex-parte Applicants. 28. From the responses given by the Respondent and the chronology of events, the question for the Court is whether there is a legitimate expectation on the part of the Respondent to act in a certain manner upon receipt of the applicants’ Complaint and response from the ex-parte Applicants and the Interested Parties respectively. 29. Legitimate expectation was aptly explained by the Supreme Court in the case of Petition No. 14 of 2014, Communications Commission of Kenya & 5 others vs. Royal Media Services Limited & 5 others [2014] eKLR thus: – “ (265) An instance of legitimate expectation would arise when a body, by representation or by past practice, has aroused an expectation that is within its power to fulfil.” 30. A legitimate expectation is a principle in administrative and constitutional law, it is intended to protect citizens from arbitrary changes in government policy or conduct and arises when a public authority creates an expectation that a citizen will receive some benefit, redress or be subjected to a procedure arising from law or set down procedures. It may arise from representation, promise, or consistent historical practice by the said public authority and aims to create fairness and trust in public administration. In other words, authorities like the Respondent in these proceedings would be estopped from acting on a whim or backtracking on their undertakings and from performing their statutory mandate of not only receiving but also investigating complaints received from individuals without justification. 31. In this case, not only was the Respondent, a public office mandated by the law to investigate and provide an outcome of complaints lodged at its office, the fact that the respondent responded to and acknowledged receipt of the ex-parte Applicants’ complaint and issued a Complaint Number, created a corresponding legitimate expectation on the part of the ex-parte Applicants that the respondent would act on that complaint. 32. However, there are no further correspondences between the Respondent and the ex-parte Applicants, post the e-mail of 23rd June 2025 in which the Respondents forwarded the 1st and 2nd Interested Parties’ response to the complaint. The trail in this case darkens at this point to mean that it is not clear what further steps are to be taken. 33. At the core of the dispute is the alleged erroneous use of data by the 1st and 2nd Interested parties, who published wrong information and failed to obtain consent from the 1st ex-parte Applicant’s legal guardian. 34. Although the 1st and 2nd Interested Parties, in their response dated 19th June 2025 contend that the matter fell within the ambit of the Media Council, this court is of the view that the crux of the case entailed an alleged breach of the use of a minor’s personal data, warranting a complaint by the ex-parte https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 7

page 7 of 9

Applicants and therefore falling within the scope of the Respondent’s mandate under Sections 8 and 9 of the Act. 35. To fail to investigate the complaint or to provide the outcome of its investigations before determining whether or not such a matter fell within the mandate of the Media council amounts to the respondent neglecting its statutory duty as a Data Commissioner. 36. I find that failure to follow through with the matter and to determine the same on its merit thereby giving a conclusive outcome of its findings to the ex-parte Applicants was a breach of the Respondent’s mandate and a dereliction of its statutory duty. 37. Turning onto the third issue of whether the remedies sought ought to issue, in Republic vs. Principal Secretary, Ministry of Internal Security & Another, Ex-Parte Schon Noorani & Another [2018] KEHC 9433 (KLR), the court set out the threshold for Mandamus as follows: “ 29. 38. Mandamus is an equitable remedy that serves to compel a public authority to perform its public legal duty, and it is a remedy that controls procedural delays. The test for mandamus is set out in Apotex Inc. vs. Canada (Attorney General), [23] and, was also discussed in Dragan vs. Canada (Minister of Citizenship and Immigration).[24] The eight factors that must be present for the writ to issue are:(i) There must be a public legal duty to act; (ii) The duty must be owed to the Applicants; (iii) There must be a clear right to the performance of that duty, meaning that: (a) The Applicants have satisfied all conditions precedent; and (b) There must have been: 1. A prior demand for performance 2. A reasonable time to comply with the demand unless there was outright refusal; and 3. An express refusal, or an implied refusal through unreasonable delay. (iv) No other adequate remedy is available to the Applicants (v) The Order sought must be of some practical value or effect; (vi) There is no equitable bar to the relief sought; (vii) On a balance of convenience, mandamus should lie.” In this case, the Respondent is a public body established under the Data Protection Act, 2019. It is vested with the statutory obligation to receive c and investigate complaints lodged by persons under the Act. This function entails issuance of a determination on the outcome of a complaint upon the respondent concluding its investigations. This has not yet been done in this case and therefore, the only https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 8

page 8 of 9

recourse is to this court to compel the respondent to perform its statutory duty. I find and hold that the ex-parte Applicants’ case meets the threshold for granting of the orders sought. 39. In the end, I find merit in this Application and issue the following orders: a. An order of mandamus be and is hereby issued compelling the Respondent herein to admit ODPC Complaint No. E0285 of 2025: GEI VS HS, Nation Media Group PLC, and The BOM, The HS of MGS b. An order of mandamus be and is hereby issued compelling the Respondent, that upon admission of ODPC Complaint No. E0285 of 2025: GEI VS HS, Nation Media Group PLC, and The BOM, The HS of MGS, to carry out investigations and issue a determination within sixty (60) days from the date of admission of the complaint. c. The respondent is granted 10 days of date of being served with this judgment to admit the complaint and commence investigations into the said complaint ODPC Complaint No. E0285 of 2025: GEI VS HS, Nation Media Group PLC, and The BOM, The HS of MGS d. to Each party shall bear their own costs of these proceedings Except where there is noncompliance with this judgment, this file is closed. 40. Orders accordingly. DATED, SIGNED AND DELIVERED VIRTUALLY AT NAIROBI THIS 26TH DAY OF MARCH, 2026 R.E. ABURILI JUDGE https://new.kenyalaw.org/akn/ke/judgment/kehc/2026/3987/eng@2026-03-26 9

page 9 of 9