Investigations and findings made by the Office of the Data Protection Commissioner (ODPC) on privacy violations do not amount to usurpation of the High Court’s jurisdiction, a judge has ruled.
High Court judge Bahati Mwamuye said the ODPC does not issue final declarations of constitutional violations or enforce court-like judgments.
Instead, he noted, the ODPC operates as a quasi-judicial regulator performing a complementary role within the wider legal framework.
“Consequently, this Court is not persuaded by the Petitioner’s argument that the ODPC unlawfully usurps the High Court’s jurisdiction under Articles 23(1) and 165(3)(b),” Justice Mwamuye said.
City lawyer Henry Stephen Arunda had challenged the powers of the ODPC, arguing it had unconstitutionally grabbed the jurisdiction of the High Court to hear matters of fundamental rights and freedoms.
The lawyer questioned the ODPC’s authority to hear and determine cases on personal data and privacy rights violations.
Personal data and privacy rights
However, Justice Mwamuye said the ODPC acts within the statutory framework of the Data Protection Act and that its determinations are administrative in nature, subject to judicial review.
“There exists a clear distinction between the adjudicative role of the High Court in constitutional enforcement and the administrative redress mechanisms facilitated by the ODPC,” he said.
The judge added that while the ODPC may recommend compensation or issue directions to data controllers or processors, such directions are not declarations of constitutional rights.
He explained that ODPC decisions constitute administrative remedies under statute, with a clear right of appeal provided.
“In conclusion, the Court finds that the ODPC does not usurp the jurisdiction of the High Court. Rather, it provides an important, constitutionally permissible mechanism for the realisation of the right to privacy under Article 31, subject to the supervisory jurisdiction of the High Court as preserved under Section 64 of the DPA,” Justice Mwamuye ruled.
Mr Arunda had argued that the ODPC was acting unlawfully by determining disputes on personal data and privacy rights. He cited Regulation 14(5) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, which states that decisions of the Data Protection Commissioner are binding and enforceable as court orders.
He said this provision wrongly placed the ODPC on the same level as the High Court, contrary to Article 23(1) of the Constitution.
The court, however, rejected this argument, saying not all binding determinations amount to the exercise of judicial authority.
“The powers of the ODPC under Section 56 and Regulation 14(5) do not meet this threshold. They are investigatory and regulatory in nature, directed at ensuring compliance with the DPA,” the judge said.
Justice Mwamuye also dismissed the claim that the ODPC was usurping the mandate of the Kenya National Commission on Human Rights (KNCHR), noting the two institutions’ roles are distinct in both origin and scope.
He said while both may engage with the same constitutional right, in this case, the right to privacy under Article 31, their mandates are not in conflict.
“The KNCHR operates as an umbrella constitutional body responsible for general oversight, advocacy, and investigation of human rights violations. The ODPC, by contrast, is a specialised statutory regulator with technical oversight over data protection and digital privacy matters,” the judge stated.
Justice Mwamuye further faulted Mr Arunda for moving to court prematurely before lodging a complaint with the ODPC or seeking exemption from the requirement under Section 9(4) of the Fair Administrative Action Act.
“Accordingly, this Court finds that the Petitioner prematurely approached the High Court in contravention of the doctrine of exhaustion. He neither utilised the ODPC’s mechanisms nor sought exemption from the statutory obligation to do so,” Justice Mwamuye ruled.
