Gichuhi & 2 others v Data Protection Commissioner; Mathenge & another (Interested Parties) (Judicial Review E028 of 2023) [2023] KEHC 17321 (KLR) (Judicial Review) (12 May 2023) (Judgment)
Neutral citation:
[2023] KEHC 17321 (KLR)
Republic of Kenya
Judicial Review E028 of 2023
JM Chigiti, J
May 12, 2023
Between
Allen Waiyaki Gichuhi SC
1st Applicant
Charles Wambugu Wamae
2nd Applicant
Wamae & Allen Advocates
3rd Applicant
and
Data Protection Commissioner
Respondent
and
Florence Wamuyu Mathenge
Interested Party
Ambrose Ndungu Waigwa
Interested Party
(Originating from the decision of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 Of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge And Ambrose Waigwa)
Jurisdiction of the Office of the Data Protection Commission in rendering a decision is time bound
The applicants sought to review a decision by the Office of the Data Protection Commission (ODPC) that was made outside the 90 day timeline set upon the ODPC by section 56(5) of the Data Protection Act. The applicants contended that the ODPC had no jurisdiction to render a decision outside the 90-day timeline. The High Court held that the decision of the ODPC dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the respondents’ jurisdiction lapsed. The High Court issued an order of mandamus compelling the respondent to readmit for fresh investigations the applicants’ complaint.
Jurisdiction – jurisdiction of the Office of the Data Protection Commission (ODPC) – where the Data Protection Act granted the ODPC 90 days to make a determination on a complaint – where the ODPC rendered a decision outside the 90 day timeframe - whether the Office of the Data Protection Commission (ODPC) acted in excess of its jurisdiction by rendering a decision on a complaint outside the 90-day timeframe - whether a purposive interpretation of legislation could excuse a tribunal that had rendered a decision outside its statutory timeframe - whether the delay of a tribunal of making a decision outside its statutory timeframe on account of the delay of the applicants in providing evidence could be excused - Data Protection Act, section 56(5)Administrative Law – reliefs – where an administrative body acted outside its jurisdiction by rendering a decision outside of statutory timelines – reliefs available to parties before such an administrative body – remitting of the dispute to the administrative body - whether the High Court could remit a matter decided by a tribunal out of the statutory timeframe back to the tribunal for reconsideration – Fair Administrative Action Act sections 8 and 11(1)(h)Civil Practice and Procedure – locus standi – locus standi to institute judicial review proceedings – locus standi of a law firm to file judicial review proceedings against the Office of the Data Protection Commission for a decision rendered out of time – where the respondent before the ODPC was the former employee of the law firm who had shared client information with third parties - whether a law firm that was appealing a decision against the Office of the Data Protection Commission which held that the act of its former employee sharing court documents to their personal email and third parties had locus standi to file a judicial review application contesting the legality of the decision. Words and Phrases - locus standi – definition - the right to bring an action or to be heard in a given forum - Black’s Law Dictionary, 9th Edition, page 1026.
Brief facts
On July 8, 2022, the applicants discovered that on diverse dates between June 2021 to July 2022, the 1st interested party shared with the 2nd interested party confidential information pertaining the personal and sensitive data of the 3rd applicant’s clients. Upon the discovery of the unauthorized and unlawful sharing of the data, which also included the intellectual property of the 3rd applicant, the applicants lodged a complaint with the Office of the Data Protection Commission (ODPC/ the respondent) vide a complaint dated July 20, 2022.Upon receipt of the aforementioned complaint, the ODPC considered it and dismissed the complaint. Aggrieved the applicants filed the instant suit on grounds that the complaint was lodged with the respondent on July 20, 2022. It took the respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the applicants the respondent ought to have concluded investigation and rendered its determination by October 19, 2022. The applicants contended that the respondent’s jurisdiction came to an end by way of effluxion of time.On the effluxion of time the respondent contended that it was highly probable that the applicants jointly, severally and deliberately designed that the respondent would be time constrained having caused delay on their part by deliberately leaving out facts that would be necessary to determine the complaint. The respondent further stated that whereas statutes provided for express timelines for action to be taken, the courts had previously dealt with effluxion of time and taken a purposive approach to it.
Issues
- Whether the Office of the Data Protection Commission (ODPC) acted in excess of its jurisdiction by rendering a decision on a complaint outside the 90-day timeframe set by section 56(5) of the Data Protection Act.
- Whether the High Court could remit a matter decided by a tribunal out of the statutory timeframe back to the tribunal for reconsideration.
- Whether a purposive interpretation of legislation could excuse a tribunal that had rendered a decision outside its statutory timeframe.
- Whether the delay of a tribunal of making a decision outside its statutory timeframe on account of the delay of the applicants in providing evidence could be excused.
- Whether a law firm that was appealing a decision against the Office of the Data Protection Commission which held that the act of its former employee sharing court documents to their personal email and third parties had locus standi to file a judicial review application contesting the legality of the decision.
Relevant provisions of the Law
Data protection Act (Act No. 24 of 2019), section 56(5) 56. Complaints to the Data CommissionerA complaint made to the Data Commissioner shall be investigated and concluded within ninety days.
Held
- A preliminary objection was a point of law which must not be blurred with factual details liable to be contested and in any event, to be proved through the processes of evidence. Any assertion which claimed to be a preliminary objection, and yet it bore factual aspects calling for proof, or sought to adduce evidence for its authentication, was not, as a matter of legal principle, a true preliminary objection which the court should allow to proceed.
- An issue of locus standi raised a point of law that touched on the capacity to institute a suit, and it should be resolved at the earliest opportunity. Locus standi was the right to appear and be heard in court or other proceedings. If a party was found to have no locus standi, then it meant the person could not be heard even on whether or not he had a case worth listening to. If the court was to find that the applicant had no locus standi, then the applicant could not be heard and that point alone may dispose of the suit.
- The applicants had the necessary locus standi to lodge and sufficient interest in these proceedings given that they were intertwined in such an intricate manner as a result of the nature and form of a law firm and the client advocate fiduciary relationship. They owed a duty of care towards one another when it came to the issue of data privacy. The preliminary objection was dismissed.
- Jurisdiction was everything, it was what gave a court or a tribunal the power, authority and legitimacy to entertain a matter before it. A decision made by a court of law without jurisdiction was a nullity ab initio (from the beginning), and such a decision was amenable to setting aside ex debito justitiae (as a matter of right).
- As at the time of determination, January 6, 2022, the period within which the respondent had to investigate and determine the complaint had already lapsed. Pursuant to the provisions of section 56(5) of the Data Protection Act (the Act) the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days’ period ended, the respondent jurisdiction also came to an end by way effluxion of time.
- Courts and tribunals could not flout the timelines expressly provided for in law. The moment the 90 days ended, the respondent’s jurisdiction also lapsed. The finding that was rendered outside time was without jurisdiction and therefore a nullity, bereft of any force of law.
- Unlike the traditional Kenyan dispute resolution mechanisms like the court, the ODPC did not rely on the evidence produced by parties in making its decision. The ODPC had investigatory powers call for or collect and use more evidence before arriving at a finding.
- The respondent admitted that its finding was rendered out of time. The respondent however blamed the applicant for the delay in keeping time. Two wrongs could not make a right in law. The respondent could not be heard to blame the applicant since it lacked the legal authority enlarge time.
- Where the Constitution or a statute had provided or set a strict time for the delivery of a judgment or a finding then the High Court could not be called upon to apply a purposive interpretation of the law to enlarge time. Such an approach would be an affront of article 10 of the Constitution; an affront to the rule of law.
- Enlarging time in such a terrain would most prejudice and or disadvantage one or the other parties in the dispute. The respondent’s jurisdiction lapsed on the ninetieth day from the day the complaint was lodged. The High Court lacked the Constitutional power to breathe life into a finding that had been arrived at ultra vires under article 165 of the Constitution.
- The ODPC acted procedurally within the principles of fair hearing in granting the parties patience and latitude to file documents out of time which promoted the right to fair hearing under article 50 of the Constitution. No amount of compulsion, pressure or threats should be brought to bear on the ODPC to the extent of rendering a finding out of time.
- The Data Protection Act defined a data subject as an identified or identifiable natural person who was the subject of personal data. It defined an identifiable natural person as a person who could be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity. Article 260 of the Constitution defined a person to include a company, association or other body of persons whether incorporated or unincorporated. From the Data Protection Act, it was evident that companies, limited liability partnerships, and other legal entities were not considered data subjects. As such, legal entities could not bring complaints to the Data Protection Commissioner. The applicants were partners in the 3rd applicants law firm. The applicants had the capacity to lodge a complaint with the ODPC under the Data Protection Act.
- The High Court’s power and authority flows from the Constitution and the Fair Administrative Action Act. Section 11(1) (h) of the Fair Administrative Action Act provided that in proceedings for judicial review under section 8, the court may grant any order that was just and equitable, including an order remitting the matter for reconsideration by the administrator.
Application allowed
Orders
- An order of certiorari was issued to remove to the High Court for of quashing the decision of the office of the Data Protection Commission dated January 6, 2023 in respect of the Reference No Odpc/conf/1/5/v01 1(112), ODPC Complaint No 677 Of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge and Ambrose Waigwa.
- Declaration issued that the respondent lacked the jurisdiction to make the final determination dated January 6, 2023 as its jurisdiction came to an end by way of effluxion of time.
- Declaration issued that the decision that a person as described under section 56(2) of the Data Protection Act, be read together with the schedule of the Constitution as envisaged in rule 2 as per the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, to include individuals, organisations, company, association or any other body of persons whether incorporated or unincorporated.
- Declaration issued that the decision of the respondent dated January 6, 2023, violated the principles of procedural fairness.
- An order of mandamus was issued compelling the respondent to readmit for fresh investigations the applicants’ complaint dated July 20, 2022.
- The respondent shall complete the fresh investigations within 30 days from the date of readmission.
- Costs awarded to the applicants.
Citations
Cases
- Alfred Njau and Others v City Council of Nairobi (Civil Appeal 74 of 1982; [1983] KECA 56 (KLR); (1982) KAR 229) — Explained
- Allen Waivaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge And Ambrose Waigwa (Odpc/conf/1/5/v01 1(112), And Odpc Complaint No 677) — Explained
- Aprim Consultants v Parliamentary Service Commission & Another (Civil Appeal No E039 OF 2021) — Explained
- Elijah Sikona & George Pariken Narok on behalf of Trusted Society of Human Rights Alliance V Mara Conservancy & 5 others (Civil Case 37 of 2013; [2014] KEHC 4420 (KLR)) — Mentioned
- Joho & another v Shahbal & 2 others (Petition10 of 2013; [2014]eKLR; [2014] 1 KLR 111) — Explained
- Joint Venture of Lex Oilfield Solutions Ltd & CFAO Kenya Ltd v Public Procurement Administrative Review Board & 4 others (Civil Appeal 022 of 2022; [2022] KECA 424 (KLR)) — Mentioned
- Judicial Service Commission v Davis Gitonga Karani (Civil Appeal 305 of 2019; [2020] KECA 16 (KLR)) — Explained
- Karua, Martha Wangari v Independent Electoral and Boundaries Commission, Seki Lempaka, Anne Waiguru & Peter Ndambiri (Petition 3 of 2019; [2019] KESC 26 (KLR)) — Mentioned
- Kenya Power & Lighting Co v Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020; [2022] KEHC 496 (KLR)) — Explained
- Kidero, Evans Odhiambo & 4 others v Ferdinand Ndungu Waititu & 4 others (Petition 18 & 20 of 2014; [2014] KESC 11 (KLR)) — Mentioned
- Law Society of Kenya v Commissioner of Lands & 2 others (Civil Case 464 of 2000; [2001] eKLR) — Explained
- Lempaka, Harun Meitamei v Lemanken Aramat vs Lempaka & 2 Others (Petition 5 of 2014; [2014] eKLR) — Explained
- Macharia and Another v Kenya Commercial Bank Limited & 2 others (Application 2 of 2011; [2012] eKLR; [2012] 3 KLR 199) — Explained
- Matemu, Mumo v Trusted Society of Human Rights Alliance, Attorney-General, Minister for Justice and Constitutional Affairs, Director of Public Prosecutions, Kenya Section of International Commission of Jurists & Kenya Human Rights Commission (Civil Application 29 of 2014; [2014] KESC 6 (KLR)) — Explained
- Motor Vessel ‘Lillian S’ v Caltex Oil (Kenya) Ltd (Civil Appeal 50 of 1989; [1989] eKLR; [1989] KLR 1) — Explained
- Oraro v Mbaja (Civil Suit 85 of 1992; [2005] KEHC 731 (KLR); [2005] 1 KLR 141) — Explained
- Quick Enterprises Ltd v Kenya Railways Corporation (Civil Case No22 of 1999) — Explained
- Republic v Public Procurement Administrative Review Board & Another Ex parte Selex Sistemi Intergrati (? 1260 of 2007; [2008] KEHC 138 (KLR)) — Mentioned
- Republic v Public Procurement Administrative Review Board & another; XRX Technologies Limited (Interested Party); Express Automation Limited Ex Parte (Judicial Review Application E1155 of 2020; [2020] KEHC 530 (KLR)) — Explained
- Republic v Public Procurement Administrative Review Board & Kenya Power & Lighting Company Limited Ex-Parte Kleen Homes Security Services Limited (Judicial Review 503 & 502 of 2016; [2017] KEHC 7805 (KLR)) — Mentioned
- Saisi , Praxidis Namoniv Director of Public Prosecutions & 2 others (Petition 39 of 2019; [2020] KESC 18 (KLR)) — Explained
- Salat, Nicholas Kiptoo Arap Korir v Independent Electoral and Boundaries Commission & 7 others (Civil Appeal 228 of 2013; [2014] KECA 782 (KLR)) — Explained
- Reserve Bank of India v Peerless General Finance and Investment Co Ltd (1987 AIR 1023, 1987 SCR (2) 1) — Mentioned
- Mukisa Biscuit Manufacturing Co Ltd v West End Distributors Ltd ([1969)EA) — Explained
- Central Electrical Board v Halifax Corporation ([1963] AC 785) — Mentioned
- Constitution of Kenya, 2010 (Const2010) — article 10, 31(c)(d), 47, 50, 159, 165, 260 — Interpreted
- Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013 (Constitution of Kenya, 2010 Sub Leg) — rule 2 — Interpreted
- Data Protection Act, 2019 (Act No 24 of 2019) — section 3, 5, 25, 56(2), 64 — Interpreted
- Elections Act, 2011 (Act No 24 of 2011) — In general — Cited
- Fair Administrative Action Act, 2015 (Act No 4 of 2015) — section 8, 11(1)(h) — Interpreted
- Public Procurement And Asset Disposal Act, 2015 (Act No 33 of 2015) — section 175 — Interpreted
- Garner, BA., (Ed) (2009), Black’s Law Dictionary (St Paul Minnesota: West Group 9th Edn p 1026)
Judgment
1.The applicants’ moved this court by way of the substantive notice of motion application dated March 3, 2023 seeking the following orders:a.…….spent.b.…….spent.
The Preliminary Objection:
2.The 1st interested party opposed the notice of motion vide a notice of preliminary objection filed on the 16th day of March, 2023 on grounds that the applicants have no authority and/or locus to seek judicial review orders on behalf of their client who are legal personalities.
3.The court directed that the notice of preliminary objection shall be dealt with alongside the substantive notice of motion application.
The Applicants’ Case:
4.The application is supported by the grounds on its face, a supporting affidavit sworn by Charles Wambugu Wamae on March 3, 2023 and a further affidavit dated March 16, 2023 and written the written submissions dated March 23, 2023.
5.It is the applicants case that on July 8, 2022, the Applicants discovered that on diverse dates between June 2021 to July 2022, the 1st interested party shared with the 2nd interested party confidential information pertaining the personal and sensitive data of the 3rd applicant’s clients.
6.Upon the discovery of the unauthorized and unlawful sharing of the data, which also included the intellectual property of the 3rd applicant, the applicants lodged a complaint with the office of the Data Protection Commission (hereinafter referred to as (ODPC) vide a complaint dated July 20, 2022.
7.Upon receipt of the aforementioned complaint, the Respondent assigned the complaint reference Odpc/conf/1/5/v01 1(112), And Odpc Complaint No677 Of 2022 {{> Allen Waivaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge and Ambrose Waigwa}} in line with its mandate under section 56 of the Data Protection Act.
8.The respondent rendered its determination dated January 6, 2023 wherein it dismissed the complaint.
9.The applicants were aggrieved by the above impugned determination on the following counts, that;-
10.According to the applicants section 56(5) of the Data Protection Act, is couched in mandatory terms that the respondent shall investigate and conclude its investigations ninety (90) days.
11.The complaint herein was lodged with the respondent on July 20, 2022. It took the respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the applicants the respondent ought to have concluded investigation and render it’s determination by October 19, 2022.
12.The applicants further submitted that the respondent’s jurisdiction came to an end by way of effluxion of time citing the case of Joint Venture of Lex Oilfield Solutions Ltd & CFAO Kenya Ltd v Public Procurement Administrative Review Board & 4 others (Civil Appeal 022 of2022) [2022] KECA 424 (KLR).
The Respondents and the Interested Parties’ Case:
13.In response to the motion the respondent filed a replying affidavit dated March 15, 2023 and written submission dated March 29, 2023.On her part, the 1st interested party filed a replying affidavit dated March 16, 2023 and written submissions dated March 31, 2023 while the 2nd interested party filed a replying affidavit dated March 15, 2023 and written submissions dated March 29, 2023.
The Respondent:
14.The ODPC is a regulatory office established pursuant to section 5 of the Act. The ODPC is mandated with regulating personal data processing, ensuring that the processing of a data subject’s personal data is guided by the principles set forth in section 25 of the Act, protecting individuals’ privacy, establishing a legal and institutional mechanism to protect personal data, and providing data subjects with rights and remedies to protect their personal data from processing that is not in accordance with the Act.
15.In July 2022, the ODPC received a complaint from the applicants against its the interested parties who were its ex-employees. The basis of the complaint is that the 1st interested party allegedly sent confidential information from the 3rd applicant to her personal email as well as to a third party, without consent from the data subjects and the applicants.
16.It was alleged that some of the documents shared between the Interested parties included court documents such as pleadings and supporting documents, applications, affidavits, submissions, and legal opinions, bank statements, correspondences, invoices, and subscription emails.
17.The respondent at the inception of the matter noted that a large majority of the complaint did not contain any personal data of the applicants but instead were documents relating to the 3rd applicants corporate (not natural persons) clients who on the face of it were not aware that the 3rd applicant was acting on their behalf.
18.The ODPC upon satisfaction that the applicants had adequately ventilated their complaint and the interested parties given a chance to defend the allegations and by virtue of considering the complaint and documents presented it dismissed the complaint on the grounds that the documents provided formed part of the public record, and the parties referred to in some of the documents were companies and not natural persons who are the data subjects specifically protected under the Act.
19.The respondent also found that the complainants did not demonstrate that their own personal data had been infringed and did not show that they had the authority to represent any other data subjects referred to in the complaint.
20.The respondent went a step further and informed the applicants herein at paragraph 87(ii) of the determination of their right to appeal the determination as provided for in section 64 of the Act.
21.On the effluxion of time the respondent submitted that it is highly probable that the applicants jointly, severally and deliberately designed that the respondent would be time constrained having caused delay on their part by deliberately leaving out facts that would be necessary to determine the complaint.
22.In addition, the respondent stated that the applicants participated in causing a necessary extension of time by taking long periods to lay out their claim and by supplying documents outside the mandate of the respondent.
23.The respondent further stated that whereas statutes provide for express timelines for action to be taken, the courts have previously dealt with effluxion of time and taken a purposive approach to it citing the Supreme Court case of India in Reserve Bank of India v Peerless General Finance and Investment Co Ltd 1987 SCR (2)1 and Republic v Public Procurement Administrative Review Board & another ex parte Selex Sistemi Intergrati [2008]eKLR in Republic v Public Procurement Administrative Review Board & another ex parte Kleen Homes Security Services Limited [2017] eKLR.
1st Interested Party:
24.The 1st interested party submitted that the question of time taken by an administrator to investigate and reach a decision has to take into consideration all factors as set out in Telecommunications Research & Action Center vs FCC as cited with approval in Judicial Service Commission v Davis Gitonga Karani [2020] eKLR
25.The 1st interested party further submitted that the delay was reasonable because the respondent is a fairly new public office, stating that the financial and human resources required to investigate and make a decision within the statutory timelines are strained and the parties to the investigation have to respond to the investigative authorities within shorter timelines.
2ndInterested Party:
26.The 2nd interested party urged this court to adopt a purposive interpretation of section 56 of the Act. Indicating that the key point should be to ascertain when the elements of a pleadable claim came to existence, to warrant an investigation and a decision from the respondent.
27.The 2nd interested party cited the cases of Central Electrical Board v Halifax Corporation [1963] AC 785 and Elijah Sikona & George Pariken Narok on behalf of Trusted Society of Human Rights Alliance v Mara Conservancy & 5 others [2014] eKLR.
Analysis and Determination:
28.I have carefully considered the application, the affidavits on record and after a careful consideration of the respective submissions, case law and the relevant law, I have identified the following issues for determination:-
A.Whether the preliminary objection is sustainable in law.
B.Whether the ODPC acted in excess of jurisdiction or power conferred under the Data Protection Act.
C.Whether the other reliefs sought have been proven.
Whether the Preliminary Objection is Sustainable in Law:
29.In Civil Suit No 85 of 1992, Oraro v Mbaja [2005] 1 KLR 141, Ojwang J (as he then was), cited with approval the position in Mukisa Biscuit Manufacturing Co Ltd v West End Distributors Ltd [1969)EA and stated as follows on the operation of preliminary objection: -
30.The issue of locus standi raises a point of law that touches on the capacity to institute this suit, and it should be resolved at the earliest opportunity. Locus standi is defined in Black’s Law Dictionary, 9th Edition (page 1026) as “the right to bring an action or to be heard in a given forum”.
31.In the case of Mumo Matemu v Trusted Society of Human Rights Alliances & 5 others (2014)eKLR, where the Court held that;
32.In the case of Law Society of Kenya v Commissioner of Lands & Others, Nakuru High Court Civil Case No 464 of 2000, the court held that;-“locus standi signifies a right to be heard, a person must have sufficiency of interest to sustain his standing to sue in court of law”.
33.Further in the case of Alfred Njau & others v City Council of Nairobi (1982) KAR 229, the court also held that; - “The term locus standi means a right to appear in court and conversely to say that a person has no locus standi means that he has no right to appear or be heard in such and such proceedings”.
34.It is therefore evident that locus standi is the right to appear and be heard in court or other proceedings. Therefore if a party is found to have no locus standi, then it means he/she cannot be heard even on whether or not he has a case worth listening to. It is further evident that if this court was to find that the applicant has no locus standi, then the applicant cannot be heard and that point alone may dispose of the suit.
35.In the case of Quick Enterprises Ltd v Kenya Railways Corporation, Kisumu High Court Civil Case No 22 of 1999, the court held that:-
36.In the instant case I find that the applicants certainly had the necessary locus to lodge and sufficient interest in these proceedings given that they were intertwined in such an intricate manner as a result of the nature and form of a law firm and the client advocate fiduciary relationship. They owed a duty of care towards one another when it came to the issue of data privacy.
37.Consequently, the notice of preliminary objection falls by the wayside in the same is here by dismissed.
Whether the Odpc Acted In Excess of Jurisdiction or Power Conferred under the Data Protection Act.
38.It is not contested that the complaint herein was lodged on July 20, 2022. Pursuant to the provisions of section 56(5), the respondent was bound to investigate and conclude within ninety (90) days from July 20, 2022 that is to say by October 18, 2022.
39.Jurisdiction is everything, it is what gives a court or a tribunal the power, authority and legitimacy to entertain a matter before it. A decision made by a court of law without jurisdiction is a nullity ab initio, and such a decision is amenable to setting aside ex debito justitiae.
40.The locus classicus case on jurisdiction is the celebrated case of Owners of the Motor Vessel ‘Lillian S’ v Caltex Oil (Kenya) Ltd [1989] KLR 1 in which Nyarangi, JA, (as he then was), relying, inter alia, on a treatise by John Beecroft Saunders titled “Words and Phrases Legally Defined” held as follows: -
41.In Samuel Kamau Macharia & another v Kenya Commercial Bank Limited & 2 others [2012] eKLR, Application No 2 of 2011, the Supreme Court held as follows on jurisdiction:
42.The applicants contend that the respondent lacked jurisdiction to make a determination of the complaint under section 56(5) of the Data protection Act that expressly provides that:-
43.This court in its decision in JR No E1155 of 2020, Republic v Public Procurement Administrative Review Board & 2 others ex parte Express Automation Limited (unreported) while addressing its mind on the issue of timelines cited the Court of Appeal decision in Civil Appeal No E039 of 2021, Aprim Consultants v Parliamentary Service Commission & another where the court held as follows;
44.Further, the Court of Appeal overturned the High Court decision delivered 185 days outside the 45 days stipulated in section 175 of the Public Procurement and Asset Disposal Act. It described the High Court judgment as a nullity holding the court’s jurisdiction is time bound, so it lapsed with the effluxion of the 45 days.
45.So, what is the effect of the exceeded timelines? As held by this court in Kenya Power & Lighting Co v Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020) [2022] KEHC 496 (KLR), the effect of this matter having surpassed the timelines within which this court is obligated by law to conclude the same is that the court is divested of jurisdiction to entertain the matter any further.
46.This has also been emphasized in the case of Harun Meitamei Lempaka v Lemanken Aramat v Lempaka & 2 others [2014] eKLR where the Supreme Court rendered itself thus:-
47.I associate myself with the decision of the Court of Appeal (Kiage, JA) in Nicholas Kiptoo Arap Korir Salat v Independent Electoral and Boundaries Commission & 6 others [2013] eKLR that:
48.In the case of Hassan Ali Joho & another v Suleiman Said Shahbal & 2 others [2014]eKLR where the Supreme Court of Kenya observed in dealing with the question of timelines dictated by the Constitution and the Elections Act citing the Court of Appeal case, of Ferdinand Waititu v Independent Electoral and Boundaries Commission, (IEBC) & 8 others, Civil Appeal No 137 of 2013 which provided as follows:
49.The need to adhere to the constitutional timeframes was also emphasized in the cases of Martha Wangari Karua v Independent Electoral and Boundaries Commission & 3 others [2019] eKLR and Evans Odhiambo Kidero & 4 others v Ferdinard Ndungu Waititu & 4 others, SC Pet No 20 of 2014; [2014] eKLR.
50.Accordingly, it therefore follows that, as at the time of determination, January 6, 2022, the period within which the respondent had to investigate and determine the complaint had already lapsed.
51.I am in agree with applicants that pursuant to the provisions of section 56(5) of the Act the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days’ period ended, the respondent jurisdiction also came to an end by way effluxion of time.
52.Courts and tribunals cannot flout the timelines expressly provided for in law.
53.The moment the 90 days ended, the respondents jurisdiction also lapsed. The finding that was rendered outside time was without jurisdiction and therefore a nullity, bereft of any force of law.
54.Guided by the Supreme Court Judgment in the case SC Petitions 39 & 40 of 2019 Praxidis Namoni Saisi & 7 Others V DPP & 2 Others unlike the traditional Kenyan dispute resolution mechanisms like the court, the ODPC does not rely on the evidence produced by parties in making its decision. The ODPC has investigatory powers call for or collect and use more evidence before arriving at a finding.
55.Through Oscar Onyango Otieno the Deputy Data Commissioner’s in Paragraph 15 to 20 of his affidavit dated 15.3.23 the Respondent admits that its finding was rendered out of time. He however proceeds to blames the Applicant for the delay in keeping time.
56.Two wrongs cannot make a right in law. The respondent cannot be heard to blame the applicant since it lacked the legal authority enlarge time.
57.In paragraph 17 of the said affidavit, the respondent is inviting the court to consider the intention of the statutes by applying a purposive interpretation to the issue of timelines.
58.The court is of the firm view that where the Constitution or a statute has provided or set a strict time for the delivery of a judgment or a finding then the High Court cannot be called upon to apply a purposive interpretation of the law to enlarge time. Such an approach would be an affront of article 10 of the Constitution and in particular the rule of law.
59.Enlarging time in such a terrain would most certainly prejudice and or disadvantaged one or the other parties in the dispute. The respondents jurisdiction lapsed on the ninetieth day from the day the complaint is lodged.
60.This court lacks the constitutional power to breathe life into a finding that has been arrived at ultra vires under article 165 of the Constitution and I so hold.
61.From the record it can be gleaned that the ODPC acted procedurally within the principles of fair hearing in granting the parties patience and latitude to file documents out of time which promoted the right to fair hearing under article 50 of the Constitution.
62.This court further notes that at paragraph 20 of the replying affidavit the respondent is urging the court to consider the compelling circumstances that existed at the time when it considered the complaint out of time. It is this court’s finding that no amount of compulsion, pressure or threats should be brought to bear on the ODPC to the extent of rendering a finding out of time.
63.Having arrived at the foregoing finding, then the other grounds that have been raised by the Applicants will not affect this courts’ finding on this issue of jurisdiction.
64.Informed by the orders that this court will give, the court will not delve into the other issues raised by the parties in their affidavits or their submissions. To do so will compromise the parties’ respective cases.
Who Can Lodge A Complaint Before The ODPC?
65.Article 31(c) & (d) of the Constitution provides that every person has the right to privacy, which includes the right not to have information relating to their family or private affairs unnecessarily required or revealed; and the privacy of their communications infringed.
66.The Data Protection Act is an Act of Parliament that gives effect to article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner to make provision for the regulation of the processing of personal data and to provide for the rights of data subjects and obligations of data controllers and processors and for connected purposes.
67.The Act then defines a “data subject” as an identified or identifiable natural person who is the subject of personal data. It further defines an “identifiable natural person” as a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity.
68.Article 260 of the Constitution defines a person “person” includes a company, association or other body of persons whether incorporated or unincorporated.
69.From the Act it is evident that companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner.
70.According to section 3 of the Act, the object and purpose of this Act is—
71.The applicants are partners in the 3rd applicants law firm. i am satisfied that the applicants had the capacity to lodge a complaint with the ODPC under the Data Protection Act.
Disposition:
72.The decision of the Data Protection Commission dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the respondents’ jurisdiction lapsed. This court cannot countenance nor flout mandatory timelines that have been expressly provided for in law.
73.No matter how logical, sound, reasonable or persuasive the respondents’ finding is, the same is standing on quick sand. No amount of policy, wisdom or practicality can invest a decision made without jurisdiction with any legal authority nor generate any enforceable outcomes. It remains a still birth at law.
74.This court’s power and authority flows from the Constitution and the Fair Administrative Action Act. Section 11(1)(h) of the Fair Administrative Action Act provides that in proceedings for judicial review under section 8, the court may grant any order that is just and equitable, including an order remitting the matter for reconsideration by the administrator.
75.An order of mandamus compelling the respondent to readmit for fresh investigations the complaint dated July 20, 2022 by the applicants within 30 days from the date of readmission will promote the right to access to justice and uphold the rule of law as guaranteed under article 10 of the Constitution commends itself.
76.In prayer D of the application, the applicants sought for a declaration that the decision by the respondent made on January 6, 2023, violated the applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider the applicants evidence that had been submitted.
77.This relief can only be conclusively determined after an in-depth analysis of the merits of the case. This court will not delve into that arena since doing so would amount to the usurpation of the role of the Office of the Data Protection Commission and the Court of Appeal.
78.I am of the considered view and I so hold that the right to fair administrative Action under article 47 of the Constitution will be promoted if the complaint is reconsidered.
Orders:
1.An order of certiorari is hereby issued to remove to this court for of quashing the decision of the office of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge and Ambrose Waigwa.
2.Prayer D is disallowed.
3.Prayer E,F and G are granted as prayed.
4.An order of mandamus is hereby issued compelling the respondent to readmit for fresh investigations the applicants complaint dated July 20, 2022.
5.The respondent shall complete the fresh investigations within 30 days from the date of readmission.
6.Costs to the applicants.
DATED, SIGNED AND DELIVERED AT NAIROBI THIS 12TH DAY OF MAY 2023J. CHIGITI (SC)JUDGE