1.The Applicants’ moved this court by way of the substantive Notice of Motion Application dated March 3, 2023 seeking the following orders:a.…….spent.b.…….spent.
The Preliminary Objection:
2.The 1st Interested Party opposed the Notice of Motion vide a Notice of Preliminary Objection filed on the 16th day of March, 2023 on grounds that the Applicants have no authority and/or locus to seek judicial review orders on behalf of their client who are legal personalities.
3.The Court directed that the Notice of Preliminary objection shall be dealt with alongside the substantive Notice of Motion Application.
The Applicants’ Case:
4.The application is supported by the grounds on its face, a supporting affidavit sworn by Charles Wambugu Wamae on March 3, 2023 and a further affidavit dated March 16, 2023 and written the written submissions dated March 23, 2023.
5.It is the Applicants case that on July 8, 2022, the Applicants discovered that on diverse dates between June 2021 to July 2022, the 1st Interested Party shared with the 2nd Interested Party confidential information pertaining the personal and sensitive data of the 3rd Applicant’s clients.
6.Upon the discovery of the unauthorized and unlawful sharing of the Data, which also included the intellectual property of the 3rd Applicant, the Applicants lodged a complaint with the Office of the Data Protection Commission (hereinafter referred to as (ODPC) vide a complaint dated July 20, 2022.
7.Upon receipt of the aforementioned complaint, the Respondent assigned the complaint reference Odpc/conf/1/5/v01 1(112), And Odpc Complaint No677 Of 2022 Allen Waivaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge And Ambrose Waigwa in line with its mandate under Section 56 of the Data Protection Act.
8.The Respondent rendered its determination dated January 6, 2023 wherein it dismissed the complaint.
9.The Applicants were aggrieved by the above impugned determination on the following counts, that;-
10.According to the Applicants Section 56 (5) of the Data Protection Act, is couched in mandatory terms that the Respondent shall investigate and conclude its investigations ninety (90) days.
11.The complaint herein was lodged with the Respondent on July 20, 2022. It took the Respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the Applicants the Respondent ought to have concluded investigation and render it’s determination by October 19, 2022.
The Respondents And The Interested Parties’ Case:
13.In response to the motion the Respondent filed a Replying Affidavit dated March 15, 2023 and written submission dated March 29, 2023.On her part, the 1st interested party filed a Replying Affidavit dated March 16, 2023 and written submissions dated March 31, 2023 while the 2nd Interested Party filed a Replying Affidavit dated March 15, 2023 and written submissions dated March 29, 2023.
14.The ODPC is a regulatory office established pursuant to Section 5 of the Act. The ODPC is mandated with regulating personal data processing, ensuring that the processing of a data subject’s personal data is guided by the principles set forth in Section 25 of the Act, protecting individuals’ privacy, establishing a legal and institutional mechanism to protect personal data, and providing data subjects with rights and remedies to protect their personal data from processing that is not in accordance with the Act.
15.In July 2022, the ODPC received a complaint from the Applicants against its the interested parties who were its ex-employees. The basis of the complaint is that the 1st interested party allegedly sent confidential information from the 3rd Applicant to her personal email as well as to a third party, without consent from the data subjects and the Applicants.
16.It was alleged that some of the documents shared between the Interested parties included court documents such as pleadings and supporting documents, applications, affidavits, submissions, and legal opinions, bank statements, correspondences, invoices, and subscription emails.
17.The Respondent at the inception of the matter noted that a large majority of the complaint did not contain any personal data of the Applicants but instead were documents relating to the 3rd Applicants corporate (not natural persons) clients who on the face of it were not aware that the 3rd Applicant was acting on their behalf.
18.The ODPC upon satisfaction that the Applicants had adequately ventilated their complaint and the Interested Parties given a chance to defend the allegations and by virtue of considering the complaint and documents presented it dismissed the complaint on the grounds that the documents provided formed part of the public record, and the parties referred to in some of the documents were companies and not natural persons who are the data subjects specifically protected under the Act.
19.The Respondent also found that the Complainants did not demonstrate that their own personal data had been infringed and did not show that they had the authority to represent any other data subjects referred to in the complaint.
20.The Respondent went a step further and informed the Applicants herein at paragraph 87(ii) of the determination of their right to Appeal the determination as provided for in Section 64 of the Act.
21.On the effluxion of time the Respondent submitted that it is highly probable that the Applicants jointly, severally and deliberately designed that the Respondent would be time constrained having caused delay on their part by deliberately leaving out facts that would be necessary to determine the complaint.
22.In addition, the Respondent stated that the Applicants participated in causing a necessary extension of time by taking long periods to lay out their claim and by supplying documents outside the mandate of the Respondent.
1st Interested Party:
25.The 1st Interested party further submitted that the delay was reasonable because the Respondent is a fairly new public office, stating that the financial and human resources required to investigate and make a decision within the statutory timelines are strained and the parties to the investigation have to respond to the investigative authorities within shorter timelines.
26.The 2nd Interested party urged this court to adopt a purposive interpretation of Section 56 of the Act. Indicating that the key point should be to ascertain when the elements of a pleadable claim came to existence, to warrant an investigation and a decision from the Respondent.
Analysis and Determination:
28.I have carefully considered the application, the Affidavits on record and after a careful consideration of the respective submissions, case law and the relevant law, I have identified the following issues for determination:-
A.Whether the Preliminary Objection is sustainable in law.
B.Whether the ODPC acted in excess of jurisdiction or power conferred under the Data Protection Act.
C.Whether the other reliefs sought have been proven.
Whether the Preliminary Objection is sustainable in law:
29.In Civil Suit No 85 of 1992, Oraro vs Mbaja  1 KLR 141, Ojwang J (as he then was), cited with approval the position in Mukisa Biscuit Manufacturing Co Ltd vs West End Distributors Ltd [1969)EA and stated as follows on the operation of preliminary objection: -
30.The issue of locus standi raises a point of law that touches on the capacity to institute this suit, and it should be resolved at the earliest opportunity. Locus standi is defined in Black’s Law Dictionary, 9th Edition (page 1026) as “the right to bring an action or to be heard in a given forum”.
32.In the case of Law Society of Kenya Vs Commissioner of Lands & Others, Nakuru High Court Civil Case No 464 of 2000, the Court held that;-“Locus Standi signifies a right to be heard, a person must have sufficiency of interest to sustain his standing to sue in Court of Law”.
33.Further in the case of Alfred Njau and Others Vs City Council of Nairobi (1982) KAR 229, the Court also held that; - “The term Locus Standi means a right to appear in Court and conversely to say that a person has no Locus Standi means that he has no right to appear or be heard in such and such proceedings”.
34.It is therefore evident that locus standi is the right to appear and be heard in Court or other proceedings. Therefore if a party is found to have no locus standi, then it means he/she cannot be heard even on whether or not he has a case worth listening to. It is further evident that if this Court was to find that the Applicant has no locus standi, then the Applicant cannot be heard and that point alone may dispose of the suit.
35.In the case of Quick Enterprises Ltd Vs Kenya Railways Corporation, Kisumu High Court Civil Case No22 of 1999, the Court held that:-
36.In the instant case I find that the Applicants certainly had the necessary locus to lodge and sufficient interest in these proceedings given that they were intertwined in such an intricate manner as a result of the nature and form of a law firm and the client advocate fiduciary relationship. They owed a duty of care towards one another when it came to the issue of data privacy.
37.Consequently, the notice of preliminary objection falls by the wayside in the same is here by dismissed.
Whether the Odpc Acted In Excess Of Jurisdiction Or Power Conferred Under The Data Protection Act.
38.It is not contested that the complaint herein was lodged on July 20, 2022. Pursuant to the provisions of Section 56(5), the Respondent was bound to investigate and conclude within ninety (90) days from July 20, 2022 that is to say by October 18, 2022.
39.Jurisdiction is everything, it is what gives a court or a tribunal the power, authority and legitimacy to entertain a matter before it. A decision made by a court of law without jurisdiction is a nullity ab initio, and such a decision is amenable to setting aside ex debito justitiae.
40.The locus classicus case on jurisdiction is the celebrated case of Owners of the Motor Vessel ‘Lillian S’ v Caltex Oil (Kenya) Ltd  KLR 1 in which Nyarangi, JA., (as he then was), relying, inter alia, on a treatise by John Beecroft Saunders titled “Words and Phrases Legally Defined” held as follows: -
42.The Applicants contend that the Respondent lacked jurisdiction to make a determination of the complaint under Section 56(5) of the Data protection Act that expressly provides that:-
44.Further, the Court of Appeal overturned the High Court decision delivered 185 days outside the 45 days stipulated in Section 175 of the Public Procurement and Asset Disposal Act. It described the High Court judgment as a nullity holding the court’s jurisdiction is time bound, so it lapsed with the effluxion of the 45 days.
45.So, what is the effect of the exceeded timelines? As held by this Court in Kenya Power & Lighting Co v Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020)  KEHC 496 (KLR), the effect of this matter having surpassed the timelines within which this court is obligated by law to conclude the same is that the court is divested of jurisdiction to entertain the matter any further.
50.Accordingly, it therefore follows that, as at the time of determination, January 6, 2022, the period within which the Respondent had to investigate and determine the complaint had already lapsed.
51.I am in agree with Applicants that pursuant to the provisions of Section 56(5) of the Act the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days’ period ended, the Respondent jurisdiction also came to an end by way effluxion of time.
52.Courts and tribunals cannot flout the timelines expressly provided for in law.
53.The moment the 90 days ended, the Respondents jurisdiction also lapsed. The finding that was rendered outside time was without jurisdiction and therefore a nullity, bereft of any force of law.
54.Guided by the Supreme Court Judgment in the case SC Petitions 39 & 40 of 2019 Praxidis Namoni Saisi & 7 Others V DPP & 2 Others unlike the traditional Kenyan dispute resolution mechanisms like the court, the ODPC does not rely on the evidence produced by parties in making its decision. The ODPC has investigatory powers call for or collect and use more evidence before arriving at a finding.
55.Through Oscar Onyango Otieno the Deputy Data Commissioner’s in Paragraph 15 to 20 of his Affidavit dated 15.3.23 the Respondent admits that its finding was rendered out of time. He however proceeds to blames the Applicant for the delay in keeping time.
56.Two wrongs cannot make a right in law. The Respondent cannot be heard to blame the Applicant since it lacked the legal authority enlarge time.
57.In paragraph 17 of the said Affidavit, the Respondent is inviting the court to consider the intention of the statutes by applying a purposive interpretation to the issue of timelines.
58.The court is of the firm view that where the Constitution or a statute has provided or set a strict time for the delivery of a judgment or a finding then the High Court cannot be called upon to apply a purposive interpretation of the law to enlarge time. Such an approach would be an affront of Article 10 of the Constitution and in particular the rule of law.
59.Enlarging time in such a terrain would most certainly prejudice and or disadvantaged one or the other parties in the dispute. The Respondents jurisdiction lapsed on the ninetieth day from the day the complaint is lodged.
60.This court lacks the Constitutional power to breathe life into a finding that has been arrived at ultra vires under Article 165 of the Constitution and I so hold.
61.From the record it can be gleaned that the ODPC acted procedurally within the principles of fair hearing in granting the parties patience and latitude to file documents out of time which promoted the right to fair hearing under Article 50 of the Constitution.
62.This court further notes that at paragraph 20 of the Replying affidavit the Respondent is urging the court to consider the compelling circumstances that existed at the time when it considered the complaint out of time. It is this court’s finding that no amount of compulsion, pressure or threats should be brought to bear on the ODPC to the extent of rendering a finding out of time.
63.Having arrived at the foregoing finding, then the other grounds that have been raised by the Applicants will not affect this courts’ finding on this issue of jurisdiction.
64.Informed by the orders that this court will give, the court will not delve into the other issues raised by the parties in their Affidavits or their submissions. To do so will compromise the parties’ respective cases.
Who Can Lodge A Complaint Before The ODPC?
65.Article 31 (c) & (d) of the Constitution provides that every person has the right to privacy, which includes the right not to have information relating to their family or private affairs unnecessarily required or revealed; and the privacy of their communications infringed.
66.The Data Protection Act is an Act of Parliament that gives effect to Article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner to make provision for the regulation of the processing of personal data and to provide for the rights of data subjects and obligations of data controllers and processors and for connected purposes.
67.The Act then defines a “data subject” as an identified or identifiable natural person who is the subject of personal data. It further defines an “identifiable natural person” as a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity.
68.Article 260 of the Constitution defines a person “person” includes a company, association or other body of persons whether incorporated or unincorporated.
69.From the Act it is evident that companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner.
70.According to Section 3 of the Act, the object and purpose of this Act is—
71.The Applicants are partners in the 3rd Applicants law firm. I am satisfied that the Applicants had the capacity to lodge a complaint with the ODPC under the Data Protection Act.
72.The decision of the Data Protection Commission dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the Respondents’ jurisdiction lapsed. This court cannot countenance nor flout mandatory timelines that have been expressly provided for in law.
73.No matter how logical, sound, reasonable or persuasive the Respondents’ finding is, the same is standing on quick sand. No amount of policy, wisdom or practicality can invest a decision made without jurisdiction with any legal authority nor generate any enforceable outcomes. It remains a still birth at law.
74.This court’s power and authority flows from the Constitution and the Fair Administrative Action Act. Section 11(1) (h) of the Fair Administrative Action Act provides that in proceedings for judicial review under Section 8, the court may grant any order that is just and equitable, including an order remitting the matter for reconsideration by the administrator.
75.An order of mandamus compelling the Respondent to readmit for fresh investigations the complaint dated July 20, 2022 by the Applicants within 30 days from the date of readmission will promote the right to access to justice and uphold the rule of law as guaranteed under Article 10 of the Constitution commends itself.
76.In Prayer D of the Application, the Applicants sought for a declaration that the decision by the Respondent made on January 6, 2023, violated the Applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under Articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider the Applicants evidence that had been submitted.
77.This relief can only be conclusively determined after an in-depth analysis of the merits of the case. This court will not delve into that arena since doing so would amount to the usurpation of the role of the Office of the Data Protection Commission and the Court of Appeal.
78.I am of the considered view and I so hold that the right to fair administrative Action under Article 47 of the Constitution will be promoted if the complaint is reconsidered.
1.An order of certiorari is hereby issued to remove to this Court for of quashing the decision of the office of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 Of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge And Ambrose Waigwa.
2.Prayer D is disallowed.
3.Prayer E,F and G are granted as prayed.
4.An order of Mandamus is hereby issued compelling the Respondent to readmit for fresh investigations the Applicants complaint dated July 20, 2022.
5.The Respondent shall complete the fresh investigations within 30 days from the date of readmission.
6.Costs to the Applicants.