REPUBLIC OF KENYA

IN THE HIGH COURT OF KENYA AT NAIROBI

JUDICIAL REVIEW DIVISION
JUDICIAL REVIEW NO. E028 OF 2023
ALLEN WAIYAKI GICHUHI S.C. …….………….…………………..….. 1ST APPLICANT
CHARLES WAMBUGU WAMAE …………………………………………2ND APPLICANT
WAMAE & ALLEN ADVOCATES …………………………..…..……… 3RD APPLICANT
-VERSUS-
DATA PROTECTION COMMISSIONER ……………………..………… RESPONDENT
AND
FLORENCE WAMUYU MATHENGE…………………...…. 1ST INTERESTED PARTY
AMBROSE NDUNGU WAIGWA ………………………….… 2ND INTERESTED PARTY

JUDGMENT

Brief background:

1. The Applicants’ moved this court by way of the substantive Notice of Motion
Application dated 3rd March 2023 seeking the following orders:
a) …….spent.
b) …….spent.
c) An order of certiorari be and is hereby issued to remove to this Court
for of quashing the decision of the Data Protection Commission dated
6th January 2023,in respect of the Reference No. ODPC/CONF/1/5/V01
1(112), ODPC COMPLAINT NO.677 OF 2022 ALLEN WAIYAKI
GICHUHI & CHARLES WAMBUGU WAMAE VS FLORENCE MATHENGE
AND AMBROSE WAIGWA.

809127132.docx Page 1 of 22
d) A declaration do issue that the decision by the Respondent made on
6th January 2023, violated the Applicants right to a fair hearing and
the principles of Fair Administrative Action as provided for under
Articles 47 and 50 of the Constitution of Kenya, 2010 by failing to
consider the Applicants evidence that had been submitted.
e) A declaration do issue that the Respondent lacked the jurisdiction to
make the final determination dated 6th January 2023 as its jurisdiction
came to an end by way of effluxion of time.
f) A declaration do issue that the decision that a person as described
under Section 56(2) of the Data Protection Act, be read together with
the schedule of the Constitution as envisaged in Rule 2 as per the
Constitution of Kenya (Protection of Rights and Fundamental
Freedoms) Practice and Procedure Rules, 2013, to include individuals,
organisations, company, association or any other body of persons
whether incorporated or unincorporated.
g) A declaration do issue that the decision of the Respondent dated 6 th
January 2023, violated the principles of procedural fairness.
h) An order of mandamus be and is hereby issued to the Respondent to
readmit for fresh investigations the complaint by the Applicants dated
2001 July 2022, and investigate the including the numerous
documentations provided to the Respondent within 90 days from the
date of readmission.
i) Costs be provided for.

809127132.docx Page 2 of 22
 The Preliminary Objection:

2. The 1st Interested Party opposed the Notice of Motion vide a Notice of
Preliminary Objection filed on the 16th day of March, 2023 on grounds that
the Applicants have no authority and/or locus to seek judicial review orders
on behalf of their client who are legal personalities.
3. The Court directed that the Notice of Preliminary objection shall be dealt
with alongside the substantive Notice of Motion Application.

The Applicants’ case:

4. The application is supported by the grounds on its face, a supporting affidavit

sworn by Charles Wambugu Wamae on 3rd March, 2023 and a further
affidavit dated 16th March 2023 and written the written submissions dated
23rd March 2023.
5. It is the Applicants case that on 8 th July 2022, the Applicants discovered that
on diverse dates between June 2021 to July 2022, the 1 st Interested Party
shared with the 2nd Interested Party confidential information pertaining
the personal and sensitive data of the 3rd Applicant’s clients.
6. Upon the discovery of the unauthorized and unlawful sharing of the Data,
which also included the intellectual property of the 3rd Applicant, the
Applicants lodged a complaint with the Office of the Data Protection
Commission (hereinafter referred to as (ODPC) vide a complaint dated
20th July 2022.
7. Upon receipt of the aforementioned complaint, the Respondent assigned
the complaint reference ODPC/CONF/1/5/V01 1(112), and ODPC
COMPLAINT NO.677 OF 2022 ALLEN WAIVAKI GICHUHI & CHARLES

809127132.docx Page 3 of 22
 WAMBUGU WAMAE VS FLORENCE MATHENGE AND AMBROSE WAIGWA
in line with its mandate under Section 56 of the Data Protection Act.
8. The Respondent rendered its determination dated 6th January 2023
wherein it dismissed the complaint.
9. The Applicants were aggrieved by the above impugned determination on
the following counts, that;-
i. The decision was made by a body lacking jurisdiction
by virtue of effluxion of time.

ii. The decision of the Respondent expressly excluded

evidence placed before it therefore violating the
Applicants right to a fair hearing as envisaged under
Article 50 of the Constitution of Kenya, and thus
condemned the Applicants unheard and in manner
that is procedurally unfair.

iii. The decision of the Respondent expressly

misrepresented that the Applicant had not placed
evidence before its, despite having responded to all
additional queries of the Respondent and providing all
documentation sought.

iv. The decision of the Respondent expressly

misrepresented that the Applicants advocates lacked
the authority to act despite the same being provided,
thus, challenging the Applicant’s right to be
represented by Counsel.

v. The decision of the Respondent demonstrates an

apparent bias as against the Applicants as it failed to
rely on the evidence presented by the Complainants in
favour of the Respondent.

809127132.docx Page 4 of 22
 vi. The decision of the Respondent violates the principle
of natural justice and the principles of Fair
Administrative Action.

vii. The decision failed to deliver substantive justice as the

same relied technicalities intended to deny the
Applicants a fair and just hearing.

viii. The Respondent determined extraneous issues that

were not before the Commission for determination,
thus, arriving that a decision that was improper in law
and fact.

10. According to the Applicants Section 56 (5) of the Data Protection Act, is
couched in mandatory terms that the Respondent shall investigate and
conclude its investigations ninety (90) days.
11. The complaint herein was lodged with the Respondent on 20th July 2022. It
took the Respondent about 6 months to investigate and conclude the
complaint which was outside its statutory timelines. According to the
Applicants the Respondent ought to have concluded investigation and
render it’s determination by 19th October 2022.
12. The Applicants further submitted that the Respondent’s jurisdiction came
to an end by way of effluxion of time citing the case of Joint Venture of
Lex Oilfield Solutions Ltd & CFAO Kenya Ltd V. Public Procurement
Administrative Review Board & 4 others (Civil Appeal 022 of2022)
[2022] KECA 424 (KLR).

The Respondents and the interested parties’ case:

13. In response to the motion the Respondent filed a Replying Affidavit

dated 15th March, 2023 and written submission dated 29 th March,

809127132.docx Page 5 of 22
 2023.On her part, the 1st interested party filed a Replying Affidavit dated
16th March, 2023 and written submissions dated 31 st March, 2023 while
the 2nd Interested Party filed a Replying Affidavit dated 15th March, 2023
and written submissions dated 29th March, 2023.

The Respondent:

14. The ODPC is a regulatory office established pursuant to Section 5 of the

Act. The ODPC is mandated with regulating personal data processing,
ensuring that the processing of a data subject’s personal data is guided
by the principles set forth in Section 25 of the Act, protecting individuals’
privacy, establishing a legal and institutional mechanism to protect
personal data, and providing data subjects with rights and remedies to
protect their personal data from processing that is not in accordance
with the Act.
15. In July 2022, the ODPC received a complaint from the Applicants against
its the interested parties who were its ex-employees. The basis of the
complaint is that the 1st interested party allegedly sent confidential
information from the 3rd Applicant to her personal email as well as to a
third party, without consent from the data subjects and the Applicants.
16. It was alleged that some of the documents shared between the Interested
parties included court documents such as pleadings and supporting
documents, applications, affidavits, submissions, and legal opinions,
bank statements, correspondences, invoices, and subscription emails.
17. The Respondent at the inception of the matter noted that a large
majority of the complaint did not contain any personal data of the
Applicants but instead were documents relating to the 3rd Applicants

809127132.docx Page 6 of 22
 corporate (not natural persons) clients who on the face of it were not
aware that the 3rd Applicant was acting on their behalf.
18. The ODPC upon satisfaction that the Applicants had adequately
ventilated their complaint and the Interested Parties given a chance to
defend the allegations and by virtue of considering the complaint and
documents presented it dismissed the complaint on the grounds that the
documents provided formed part of the public record, and the parties
referred to in some of the documents were companies and not natural
persons who are the data subjects specifically protected under the Act.
19. The Respondent also found that the Complainants did not demonstrate
that their own personal data had been infringed and did not show that
they had the authority to represent any other data subjects referred to in
the complaint.
20. The Respondent went a step further and informed the Applicants herein
at paragraph 87(ii) of the determination of their right to Appeal the
determination as provided for in Section 64 of the Act.
21. On the effluxion of time the Respondent submitted that it is highly
probable that the Applicants jointly, severally and deliberately designed
that the Respondent would be time constrained having caused delay on
their part by deliberately leaving out facts that would be necessary to
determine the complaint.
22. In addition, the Respondent stated that the Applicants participated in
causing a necessary extension of time by taking long periods to lay out
their claim and by supplying documents outside the mandate of the
Respondent.

809127132.docx Page 7 of 22
 23. The Respondent further stated that whereas statutes provide for express
timelines for action to be taken, the Courts have previously dealt with
effluxion of time and taken a purposive approach to it citing the
Supreme Court case of India in Reserve Bank of India v. Peerless
General Finance and Investment Co. Ltd. 1987 SCR (2)1 and Republic
V. Public Procurement Administrative Review Board & Another Ex
parte Selex Sistemi Intergrati [2008]eKLR in Republic V. Public
Procurement Administrative Review Board & Another Ex parte Kleen
Homes Security Services Limited [2017] Eklr.

1st Interested Party:

24. The 1st Interested Party submitted that the question of time taken by an
administrator to investigate and reach a decision has to take into
consideration all factors as set out in Telecommunications Research &
Action Center vs. FCC as cited with approval in Judicial Service
Commission v Davis Gitonga Karani [2020] eKLR

“In the context of a claim of unreasonable delay, the first stage of judicial
inquiry is to consider whether the agency’s delay is so egregious as to
warrant mandamus.” The court then enumerated several factors, to consider
when answering this question. These are-

i. The time agencies take to make decisions must be

governed by a rule of reasons.

ii. Where Parliament has provided a timetable or other

indication of the speed with which it expects the agency
to proceed in the enabling statute, that statutory scheme
may supply content for his rule of reason.

809127132.docx Page 8 of 22
 iii. Delays that might be reasonable in the sphere of
economic regulation are less tolerable when human
health and welfare are at stake.

iv. The court should consider the effect of expediting delayed

action of agency activities of a higher or competing
priority.

v. The Court should also take into account the nature and
extent of the interests prejudiced by delay; and

vi. The Court need not find any impropriety lurking behind
agency lassitude in order to hold that agency action is
unreasonably delayed.”

25. The 1st Interested party further submitted that the delay was reasonable
because the Respondent is a fairly new public office, stating that the
financial and human resources required to investigate and make a decision
within the statutory timelines are strained and the parties to the
investigation have to respond to the investigative authorities within
shorter timelines.

2nd Interested Party:

26. The 2nd Interested party urged this court to adopt a purposive
interpretation of Section 56 of the Act. Indicating that the key point should
be to ascertain when the elements of a pleadable claim came to existence,
to warrant an investigation and a decision from the Respondent.

27. The 2nd Interested party cited the cases of Central Electrical Board V.
Halifax Corporation [1963] AC 785 and Elijah Sikona & George Pariken
Narok on behalf of Trusted Society of Human Rights Alliance V. Mara
Conservancy & 5 others [2014] Eklr.

809127132.docx Page 9 of 22
 Analysis and Determination:

28. I have carefully considered the application, the Affidavits on record and
after a careful consideration of the respective submissions, case law and
the relevant law, I have identified the following issues for determination:-
A. Whether the Preliminary Objection is sustainable in law.
B. Whether the ODPC acted in excess of jurisdiction or power conferred
under the Data Protection Act.
C. Whether the other reliefs sought have been proven.

Whether the Preliminary Objection is sustainable in law:

29. In Civil Suit No. 85 of 1992, Oraro vs. Mbaja [2005] 1 KLR 141, Ojwang J (as
he then was), cited with approval the position in Mukisa
Biscuit Manufacturing Co. Ltd vs West End Distributors Ltd [1969)EA
and stated as follows on the operation of preliminary objection: -
“…. I think the principle is abundantly clear. A “preliminary objection”,
correctly understood, is now well identified as, and declared to be a point
of law which must not be blurred with factual details liable to be
contested and in any event, to be proved through the processes of
evidence. Any assertion which claims to be a preliminary objection, and
yet it bears factual aspects calling for proof, or seeks to adduce evidence
for its authentication, is not, as a matter of legal principle, a true
preliminary objection which the Court should allow to proceed.”
30. The issue of locus standi raises a point of law that touches on the capacity
to institute this suit, and it should be resolved at the earliest opportunity.
Locus standi is defined in Black’s Law Dictionary, 9th Edition (page 1026)
as “the right to bring an action or to be heard in a given forum”.
809127132.docx Page 10 of 22
31. In the case of Mumo Matemu Vs Trusted Society of Human Rights
Alliances & 5 Others (2014)eKLR, where the Court held that;
“It is proper to note that the evaluation of locus ought to be based upon the
constitutional consideration of capacity (Articles 3, 22 and 258, the nature
of the suit and the enforceability of the orders sought. These considerations
inform the enforcement mechanisms and coherent clarity of the following
inquiries. Who will the orders be enforced against? Who bears the costs of
litigation if at all? Who represent the parties in Court?”
32. In the case of Law Society of Kenya Vs Commissioner of Lands &
Others, Nakuru High Court Civil Case No.464 of 2000, the Court held
that;-“Locus Standi signifies a right to be heard, a person must have
sufficiency of interest to sustain his standing to sue in Court of Law”.
33. Further in the case of Alfred Njau and Others Vs City Council of
Nairobi (1982) KAR 229, the Court also held that; - “The term Locus
Standi means a right to appear in Court and conversely to say that a
person has no Locus Standi means that he has no right to appear or
be heard in such and such proceedings”.
34. It is therefore evident that locus standi is the right to appear and be
heard in Court or other proceedings. Therefore if a party is found to have
no locus standi, then it means he/she cannot be heard even on whether
or not he has a case worth listening to. It is further evident that if this
Court was to find that the Applicant has no locus standi, then the
Applicant cannot be heard and that point alone may dispose of the suit.
35. In the case of Quick Enterprises Ltd Vs Kenya Railways Corporation,
Kisumu High Court Civil Case No.22 of 1999, the Court held that:-
“When preliminary points are raised, they should be
capable of disposing the matter preliminarily without the
809127132.docx Page 11 of 22
 court having to resort to ascertaining the facts from
elsewhere apart from looking at the pleadings alone”.

36. In the instant case I find that the Applicants certainly had the necessary
locus to lodge and sufficient interest in these proceedings given that they
were intertwined in such an intricate manner as a result of the nature
and form of a law firm and the client advocate fiduciary relationship.
They owed a duty of care towards one another when it came to the issue
of data privacy.
37. Consequently, the notice of preliminary objection falls by the wayside in
the same is here by dismissed.

Whether the ODPC acted in excess of jurisdiction or power conferred

under the Data Protection Act.

38. It is not contested that the complaint herein was lodged on 20 th July
2022. Pursuant to the provisions of Section 56(5), the Respondent was
bound to investigate and conclude within ninety (90) days from 20 th July
2022 that is to say by 18th October 2022.
39. Jurisdiction is everything, it is what gives a court or a tribunal the power,
authority and legitimacy to entertain a matter before it. A decision made
by a court of law without jurisdiction is a nullity ab initio, and such a
decision is amenable to setting aside ex debito justitiae.
40. The locus classicus case on jurisdiction is the celebrated case of Owners
of the Motor Vessel ‘Lillian S’ v. Caltex Oil (Kenya) Ltd [1989] KLR 1 in
which Nyarangi, J.A., (as he then was), relying, inter alia, on a treatise by
John Beecroft Saunders titled “Words and Phrases Legally Defined” held
as follows: -

809127132.docx Page 12 of 22
 “…Jurisdiction is everything. Without it, a court has no
power to make one more step. Where a court has no
jurisdiction, there would be no basis for a continuation of
proceedings pending other evidence. A court of law downs
tools in respect of the matter before it the moment it holds
the opinion that it is without jurisdiction.”

41. In Samuel Kamau Macharia and Another v. Kenya Commercial Bank

Limited & 2 others [2012] eKLR, Application No. 2 of 2011, the
Supreme Court held as follows on jurisdiction:
“[68]. A Court’s jurisdiction flows from either the Constitution or
legislation or both. Thus, a Court of law can only exercise jurisdiction
as conferred by the Constitution or other written law. It cannot
arrogate itself jurisdiction exceeding that which is conferred upon it
by law.”
42. The Applicants contend that the Respondent lacked jurisdiction to make
a determination of the complaint under Section 56(5) of the Data
protection Act that expressly provides that:-
“(5) A complaint made to the Data Commissioner shall be investigated and
concluded within ninety days.”
43. This Court in its decision in JR No. E1155 OF 2020, Republic vs. Public
Procurement Administrative Review Board & 2 Others Ex parte
Express Automation Limited (unreported) while addressing its mind
on the issue of timelines cited the Court of Appeal decision in Civil
Appeal No. E039 OF 2021, Aprim Consultants vs. Parliamentary
Service Commission & Another where the court held as follows;
“Our reading of the Act is that the High Court was under
an express duty to make its determination within the time
prescribed. During such time did its jurisdiction exist, but
it was a time bound jurisdiction that ran out and ceased by
809127132.docx Page 13 of 22
 effluxion of time. The moment the 45 days ended, the
jurisdiction also ended. Thus any judgement returned
outside time would be without jurisdiction and therefore a
nullity, bereft of any force of law.
That legal conclusion remains irrespective of the avowed
reasons, no matter how logical, sound, reasonable or
persuasive they may be. No amount of policy, wisdom or
practicality can invest a decision made without
jurisdiction with any legal authority.’’

44. Further, the Court of Appeal overturned the High Court decision
delivered 185 days outside the 45 days stipulated in Section 175 of the
Public Procurement and Asset Disposal Act. It described the High Court
judgment as a nullity holding the court’s jurisdiction is time bound, so it
lapsed with the effluxion of the 45 days.
45. So, what is the effect of the exceeded timelines? As held by this Court in
Kenya Power & Lighting Co v Public Procurement Administrative
Review Board (Judicial Review Application 46 of 2020) [2022] KEHC
496 (KLR), the effect of this matter having surpassed the timelines
within which this court is obligated by law to conclude the same is that
the court is divested of jurisdiction to entertain the matter any further.
46. This has also been emphasized in the case of Harun Meitamei Lempaka
v Lemanken Aramat vs. Lempaka & 2 Others [2014] eKLR where the
Supreme Court rendered itself thus:-
“We have to note that the electoral process, and the
electoral dispute-resolution mechanism in Kenya, is
marked by certain special features. A condition set in
respect of electoral disputes, is the strict adherence to the
timelines prescribed by the Constitution and the electoral
law. The jurisdiction of the Court to hear and determine
electoral disputes is inherently tied to the issue of time,

809127132.docx Page 14 of 22
 and a breach of this strict scheme of time removes the
dispute from the jurisdiction of the Court”.

47. I associate myself with the decision of the Court of Appeal (Kiage, JA)
in Nicholas Kiptoo Arap Korir Salat vs. Independent Electoral and
Boundaries Commission & 6 Others [2013] eKLR that:
“I am not in the least persuaded that Article 159 of the
Constitution and the oxygen principles which both
command courts to seek to do substantial justice in an
efficient, proportionate and cost-effective manner and to
eschew defeatist technicalities were ever meant to aid in
the overthrow or destruction of rules of procedure and to
create an anarchical free-for-all in the administration of
justice. This Court, indeed all courts, must never provide
succour and cover to parties who exhibit scant respect for
rules and timelines. Those rules and timelines serve to
make the process of judicial adjudication and
determination fair, just, certain and even-handed. Courts
cannot aid in the bending or circumventing of rules and a
shifting of goal posts for, while it may seem to aid one
side, it unfairly harms the innocent party who strives to
abide by the rules. I apprehend that it is in the even-
handed and dispassionate application of rules that courts
give assurance that there is clear method in the manner
in which things are done so that outcomes can be
anticipated with a measure of confidence, certainty and
clarity where issues of rules and their application are
concerned.”

48. In the case of Hassan Ali Joho & another v Suleiman Said Shahbal & 2
others [2014]eKLR where the Supreme Court of Kenya observed in
dealing with the question of timelines dictated by the Constitution and
the Elections Act citing the Court of Appeal case, of Ferdinand Waititu
vs. Independent Electoral and Boundaries Commission, (IEBC) & 8
Others, Civil Appeal No. 137 of 2013 which provided as follows:

809127132.docx Page 15 of 22
 “These timelines set by the Constitution and the Elections
Act are neither negotiable nor can they be extended by
any Court for whatever reason. It is indeed the tyranny of
time, if we may call it so. That means a trial Court must
manage the allocated time very well so as to complete a
hearing and determine an election petition timeously.”

49. The need to adhere to the constitutional timeframes was also

emphasized in the cases of Martha Wangari Karua v Independent
Electoral and Boundaries Commission & 3 others [2019] eKLR
and Evans Odhiambo Kidero & 4 others v. Ferdinard Ndungu Waititu
& 4 others, S.C Pet. No. 20 of 2014; [2014] eKLR.
50. Accordingly, it therefore follows that, as at the time of determination, 6th
January 2022, the period within which the Respondent had to investigate
and determine the complaint had already lapsed.
51. I am in agree with Applicants that pursuant to the provisions of Section
56(5) of the Act the ODPC had a time-bound jurisdiction to investigate
and determine the complaint. When the 90 days’ period ended, the
Respondent jurisdiction also came to an end by way effluxion of time.
52. Courts and tribunals cannot flout the timelines expressly provided for in
law.
53. The moment the 90 days ended, the Respondents jurisdiction also
lapsed. The finding that was rendered outside time was without
jurisdiction and therefore a nullity, bereft of any force of law.
54. Guided by the Supreme Court Judgment in the case SC Petitions 39 & 40
of 2019 Praxidis Namoni Saisi & 7 Others V DPP & 2 Others unlike the
traditional Kenyan dispute resolution mechanisms like the court, the
ODPC does not rely on the evidence produced by parties in making its

809127132.docx Page 16 of 22
 decision. The ODPC has investigatory powers call for or collect and use
more evidence before arriving at a finding.
55. Through Oscar Onyango Otieno the Deputy Data Commissioner’s in
Paragraph 15 to 20 of his Affidavit dated 15.3.23 the Respondent admits
that its finding was rendered out of time. He however proceeds to
blames the Applicant for the delay in keeping time.
56. Two wrongs cannot make a right in law. The Respondent cannot be
heard to blame the Applicant since it lacked the legal authority enlarge
time.
57. In paragraph 17 of the said Affidavit, the Respondent is inviting the court
to consider the intention of the statutes by applying a purposive
interpretation to the issue of timelines.
58. The court is of the firm view that where the Constitution or a statute has
provided or set a strict time for the delivery of a judgment or a finding
then the High Court cannot be called upon to apply a purposive
interpretation of the law to enlarge time. Such an approach would be an
affront of Article 10 of the Constitution and in particular the rule of law.
59. Enlarging time in such a terrain would most certainly prejudice and or
disadvantaged one or the other parties in the dispute. The Respondents
jurisdiction lapsed on the ninetieth day from the day the complaint is
lodged.
60. This court lacks the Constitutional power to breathe life into a finding
that has been arrived at ultra vires under Article 165 of the Constitution
and I so hold.
61. From the record it can be gleaned that the ODPC acted procedurally
within the principles of fair hearing in granting the parties patience and

809127132.docx Page 17 of 22
 latitude to file documents out of time which promoted the right to fair
hearing under Article 50 of the Constitution.
62. This court further notes that at paragraph 20 of the Replying affidavit the
Respondent is urging the court to consider the compelling circumstances
that existed at the time when it considered the complaint out of time. It is
this court’s finding that no amount of compulsion, pressure or threats
should be brought to bear on the ODPC to the extent of rendering a
finding out of time.
63. Having arrived at the foregoing finding, then the other grounds that have
been raised by the Applicants will not affect this courts’ finding on this
issue of jurisdiction.
64. Informed by the orders that this court will give, the court will not delve
into the other issues raised by the parties in their Affidavits or their
submissions. To do so will compromise the parties’ respective cases.

Who can lodge a complaint before the ODPC?

65. Article 31 (c) & (d) of the Constitution provides that every person has
the right to privacy, which includes the right not to have information
relating to their family or private affairs unnecessarily required or
revealed; and the privacy of their communications infringed.
66. The Data Protection Act is an Act of Parliament that gives effect to Article
31(c) and (d) of the Constitution. It establishes the Office of the Data
Protection Commissioner to make provision for the regulation of the
processing of personal data and to provide for the rights of data subjects
and obligations of data controllers and processors and for connected
purposes.

809127132.docx Page 18 of 22
67. The Act then defines a “data subject” as an identified or identifiable
natural person who is the subject of personal data. It further defines an
“identifiable natural person” as a person who can be identified directly
or indirectly, by reference to an identifier such as a name, an
identification number, location data, and an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental,
economic, cultural or social or social identity.
68. Article 260 of the Constitution defines a person “person” includes a
company, association or other body of persons whether incorporated or
unincorporated.
69. From the Act it is evident that companies, limited liability partnerships,
and other legal entities are not considered data subjects. As such, legal
entities cannot bring complaints to the Commissioner.
70. According to Section 3 of the Act, the object and purpose of this Act is—
(a) To regulate the processing of personal data;
(b) To ensure that the processing of personal data of a data subject is
guided by the principles set out in section 25;
(c) To protect the privacy of individuals;
(d) To establish the legal and institutional mechanism to protect personal
data; and
(e) To provide data subjects with rights and remedies to protect their
personal data from processing that is not in accordance with this Act.
71. The Applicants are partners in the 3rd Applicants law firm. I am satisfied
that the Applicants had the capacity to lodge a complaint with the ODPC
under the Data Protection Act.

DISPOSITION:
809127132.docx Page 19 of 22
72. The decision of the Data Protection Commission dated 6th January
2023 was rendered outside time without jurisdiction and therefore a
nullity. The moment the 90 days ended, the Respondents’ jurisdiction
lapsed. This court cannot countenance nor flout mandatory timelines
that have been expressly provided for in law.
73. No matter how logical, sound, reasonable or persuasive the
Respondents’ finding is, the same is standing on quick sand. No amount
of policy, wisdom or practicality can invest a decision made without
jurisdiction with any legal authority nor generate any enforceable
outcomes. It remains a still birth at law.
74. This court’s power and authority flows from the Constitution and the
Fair Administrative Action Act. Section 11(1) (h) of the Fair
Administrative Action Act provides that in proceedings for judicial
review under Section 8, the court may grant any order that is just and
equitable, including an order remitting the matter for reconsideration by
the administrator.
75. An order of mandamus compelling the Respondent to readmit for fresh
investigations the complaint dated 20th July 2022 by the Applicants
within 30 days from the date of readmission will promote the right to
access to justice and uphold the rule of law as guaranteed under Article
10 of the Constitution commends itself.
76. In Prayer D of the Application, the Applicants sought for a declaration
that the decision by the Respondent made on 6th January 2023, violated
the Applicants right to a fair hearing and the principles of Fair
Administrative Action as provided for under Articles 47 and 50 of the

809127132.docx Page 20 of 22
 Constitution of Kenya, 2010 by failing to consider the Applicants
evidence that had been submitted.
77. This relief can only be conclusively determined after an in-depth analysis
of the merits of the case. This court will not delve into that arena since
doing so would amount to the usurpation of the role of the Office of the
Data Protection Commission and the Court of Appeal.
78. I am of the considered view and I so hold that the right to fair
administrative Action under Article 47 of the Constitution will be
promoted if the complaint is reconsidered.

ORDERS:

1.An order of certiorari is hereby issued to remove to this Court for of quashing
the

decision of the office of the Data Protection Commission dated 6th January
2023,in respect of the Reference No. ODPC/CONF/1/5/V01 1(112), ODPC
COMPLAINT NO.677 OF 2022 ALLEN WAIYAKI GICHUHI & CHARLES
WAMBUGU WAMAE VS FLORENCE MATHENGE AND AMBROSE WAIGWA.

2. Prayer D is disallowed.

3.Prayer E,F and G are granted as prayed.

4.An order of Mandamus is hereby issued compelling the Respondent to readmit

for fresh investigations the Applicants complaint dated 20th July 2022.

5. The Respondent shall complete the fresh investigations within 30 days from
the date of readmission.

6. Costs to the Applicants.

809127132.docx Page 21 of 22
Dated, signed and delivered at Nairobi this 12th Day of May 2023

……………………………………

J. CHIGITI (SC)

JUDGE

809127132.docx Page 22 of 22