REPUBLIC OF KENYA IN THE HIGH COURT OF KENYA AT NAIROBI MILIMANI LAW COURTS JUDICIAL REVIEW NO. E137 OF 2026 WILSON JULIUS ODEK……………………………………………………...……. APPLICANT VERSUS DATA PROTECTION COMMISSIONER …………….……………….……RESPONDENT AND EQUITY BANK (KENYA) LIMITED…………………………..…..INTERESTED PARTY JUDGEMENT 1. The applicant moved this court by way of an originating motion, dated 7 th May, 2026, seeking an order of mandamus, to compel the respondent to admit and determine his complaint, No. ODPC/COMP/1221/2025, dated 20th August 2025, in accordance with the provisions of the Data Protection Act, 2019. The application is supported by the grounds on its face, and the supporting affidavit of the applicant, dated 7 th May 2026. The applicant contends that he filed a complaint with the respondent, who failed to make a determination within 90 days, as prescribed under section 56(5) of the Data Protection Act. 2. The application is opposed by the interested party, vide the replying affidavit of Mr. Samuel Wamaitha, the Manager Legal Services, Equity Bank, sworn on 16th June 2026. He avers that the complaint by the applicant fell outside of the jurisdiction of the respondent, as per the provisions of section 56(5) of the Data Protection Act. 3. The application is canvassed by way of written submissions. 4. The applicant has filed submissions, dated 10th June, 2026, contending that on 20th August, 2025, he lodged a complaint with the respondent, against the interested party, alleging violations of the Data Protection Act, 2019. He
page 1 of 4
avers that the complaint was acknowledged, on the same day, and that the respondent was under a statutory obligation to conclude the investigations, and make a determination within 90 days. 5. The written submissions, by the interested party, are dated 16th June, 2026. It is submitted that the applicant was aware of the statutory timeline, which he acknowledged, and elected to institute a fresh complaint with the respondent, which was allowed, and determined within the 90 days. It is further submitted that, having been dissatisfied with the decision of the respondent, that was rendered on 17th February 2026, the applicant proceeded and filed Civil Appeal No. E175 of 2026. 6. The respondent relies on William Odhiambo Ramogi & 3 Others vs. Attorney General & 4 Others; Muslim for Human Rights & 2 others (Interested Parties) [2020] eKLR, in which the court held that the exhaustion doctrine serves the purpose of ensuring that there is a postponement of judicial consideration of matters to ensure that a party is, first of all, diligent in the protection of his own interest within the mechanisms in place for resolution outside courts. 7. Based on the above arguments, the respondent urges that the application be dismissed with costs. 8. I have considered the application, as filed, together with the parties’ pleadings and filings, and the rival submissions. The main issue is whether the application is merited 9. The applicant lodged a complaint on 20th August 2025. Section 56 of the Data Protection Act gives the respondent 90 days, to determine a complaint. 90 days lapsed on 18th November, 2025, before determination of the said complaint. The time having lapsed, the respondent did not have jurisdiction to determine the complaint. This court cannot order the respondent to determine a complaint that does not exist. The applicant had opportunity to lodge a fresh complaint, which he, in fact lodged, and
page 2 of 4
included in it all issues, including those that were in the initial complaint. The fresh complaint was heard and determined by the respondent. The applicant has lodged an appeal, against that determination, in which he will have his grievances addressed. 10. It is trite that jurisdiction is everything, and, without it, a court cannot act or move one more step, as it was held in Owners of the Motor Vessel ‘Lilian S’’ Vs Caltex Oil (Kenya) Ltd [1989]) KLR 1. In Samuel Kamau Macharia & Another vs. Kenya Commercial Bank Ltd & 2 others [2012]) eKLR where it was stated that; “A court’s jurisdiction flows from either the constitution or legislation or both. Thus, a court of law can only exercise jurisdiction as conferred by the Constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which is conferred upon it by law.” 11. On the issue as to whether the court can make an order of mandamus to re-admit jurisdiction, I shall refer to Gichuhi & 2 others vs. Data Protection Commissioner; Mathenge & Another (interested parties) (2023) KEHC 17321(KLR), where the court said: “50. Accordingly, it therefore follows that, as at the time of determination, January 6, 2022, the period within which the respondent had to investigate and determine the complaint had already lapsed. 51. I am in agreement with applicants that pursuant to the provisions of section 56(5) of the Act the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days period ended, the respondent jurisdiction also came to an end by way of effluxion of time.” 12. Section 56(5) of the Data Protection Act imposes a mandatory 90-day timeline. The applicant was aware that his complaint, No. ODPC/COMP/1221/2025, failed to meet the 90-day threshold, and the jurisdiction of the 1st respondent, as provided by statute cannot be revived by the court.
page 3 of 4
13. The application, herein, dated 7th May, 2026, is, therefore, misconceived, and amounts to an abuse of the court process, for the reasons emerging from the above discussion, hence it is hereby dismissed, with costs to the interested party. Orders accordingly. DELIVERED, VIA CTS, DATED AND SIGNED IN CHAMBERS, AT MILIMANI, NAIROBI, ON THIS 24TH DAY OF JULY 2026. W MUSYOKA JUDGE Mr. Abdirahman, Court Assistant. Ms. L Wafula, Legal Researcher. Mr. Wilson Odek, the applicant, in person. Advocates Ms. Kiage, instructed by Chepkuto Advocates LLP, for the respondent. Mr. Okello, instructed by Kiptiness & Odhiambo Associates LLP, Advocates for the interested party.
page 4 of 4