Mulla Pride Limited v Office of the Data Protection Commissioner (Petition E420 of 2023) [2025] KEHC 11287 (KLR) (Constitutional and Human Rights) (31 July 2025) (Judgment)
Neutral citation:
[2025] KEHC 11287 (KLR)
Republic of Kenya
Petition E420 of 2023
EC Mwita, J
July 31, 2025
Between
Mulla Pride Limited
Petitioner
and
Office Of The Data Protection Commissioner
Respondent
Judgment
Petitioner's Case
1.The petitioner filed a petition dated 23rd October 2023 against the respondent claiming violation of its rights and fundamental freedoms by the respondent’s decision made on 26th September 2023. The petition was supported by an affidavit of Humphrey Idachi sworn on the same day, supplementary affidavit and written submissions.
2.The petitioner runs among others, a digital credit business through entities known as KeCredit and FairKash. On 4th October 2022, the petitioner received a letter from the respondent requesting it to demonstrate its level of compliance with the provisions of the Data Protection Act, 2019 (the Act) and the regulations made thereunder. The petitioner responded through letter dated 18th October 2022 and received no further communication from the respondent.
3.On 26th April 2023, the petitioner received another letter regarding investigations on its level of regulatory compliance with the provisions of the Act. The petitioner again responded promptly through letter dated 6th May 2023 and provided the information requested.
4.On 16th June 2023, the petitioner received notification of a complaints from the respondent and responded through letter dated 26th June 2023. Subsequently, the petitioner was served with an enforcement notice dated 8th August 2023 raising various issues that the petitioner was required to respond to and remedy. The petitioner responded to the enforcement notice, outlining measures it had taken and how it had implemented the respondent’s recommendations. A month later, the respondent issued the petitioner with a penalty notice dated 25th September 2023 for Kshs. 2,975,000 which the petitioner was required to settle within 3o days from the date of receipt of the notice.
5.The petitioner stated that from the penalty notice, the main reason for the penalty was that it had failed to provide evidence on the issues raised in part (c), (d), (g) and (i) of the enforcement notice.
6.The petitioner contended that it responded to all the issues raised in the enforcement notice outlining measures it had undertaken. Among the measures were that a referee verification mechanism had been proposed and developed and it was in the final rollout stage, training of staff on the requirements of the Act and their sensitization was ongoing.
7.The petitioner contended, however, that without verifying the information provided in the response to the enforcement notice, or seeking further clarification on the information, the respondent issued the penalty. In so doing, the petitioner asserted, the respondent abused its discretion and the decision was made in bad faith and ulterior motive with the intention of making the petitioner an example to the rest of the digital credit providers.
8.The petitioner claimed that the parameters the respondent relied on to determine its response to the enforcement notice is unknown and ambiguous. Further, the respondent’s procedure of arriving at the penalty issued was not in conformity with the provisions of the Fair Administrative Action Act. It was illegal, irrational and unfair. The petitioner asserted that the respondent breached the provisions of articles 25(c), 40(1) (a), 47 (1) and (2), 50(1) and (2) (d) and (q) and 73 of the Constitution.
9.According to the petitioner, the respondent denied it an opportunity to adduce evidence in support of the information it provided in response to the enforcement notice. The respondent framed the remedial actions in the enforcement notice without publicizing them or informing it on the threshold for the evidence required.
10.The petitioner stated that the respondent acted as judge, jury and prosecutor in arriving at the decision; the standards and parameters relied on to arrive at the decision are unknown; the respondent failed to satisfy itself on the veracity of the information provided by the claimants before it and failed to adhere to the provisions of section 63 of the Act. The decision was also not accompanied by any written reasons and does not promote public confidence in the integrity of the respondent’s office.
11.The petitioner asserted that the petition seeks a review of the orders issued by the respondent on grounds of violation of the right to fair administrative action and fair hearing and this court has jurisdiction to hear and determine the petition. The petitioner therefore sought the following relief:a.A declaration that the respondent’s administrative decision by way of penalty notice dated 25th September 2023 and the penalty issued therein of Kshs. 2, 975,000 is a violation of the petitioner’s fundamental rights and freedoms under article 47 and 50 (1), (2) of the Constitution of Kenya, hence void for all intents and purposes.b.A judicial review order of certiorari to bring to this court for quashing the decision of the respondent herein to issue against the petitioner a penalty notice dated 25th September 2023 for Kshs, 2,975,000.c.A judicial review order of mandamus to bring to this court for compelling the respondent herein to set aside its decision to issue against the petitioner a penalty notice dated 25th September 2023 for Kshs 2, 975,000.d.A judicial review order of prohibition to bring to this court for prohibiting the respondent, their servants and agents from executing and/or enforcing its decision by way of penalty notice dated 25th September 2023.e.Damages to be accessed by court as may be appropriate.f.Costs of and incidental to this petition.
Response
12.The respondent opposed the petition through a replying affidavit sworn by Oscar Otieno (Mr. Otieno). The respondent stated that it started engagement with the petitioner sometime in October 2022 after receiving numerous complaints and concerns regarding digital lenders, including the petitioner. The respondent did not handle the complaints because they fell outside the 90-day statutory period provided for resolving complaints.
13.The respondent again received complaints against the petitioner and on 16th June 2023, sent notification of several complaints filed against the petitioner relating to money lending products, L-Cash; FairKash and KeCredit. The complaints touched on the petitioner’s applications irregularly accessing the complainants’ mobile phones and sending unwanted and harassing text messages to the contacts; requests to make payments for unborrowed and /or settled loan facilities; requests to third parties to make loan repayments which they were not aware of and sharing the complainants’ personal data to third parties.
14.The respondent asserted that the petitioner received the notification of complaints and responded through letter dated 29th June 2023. The respondent conducted investigations and issued an enforcement notice dated 11th August 2023 on the basis that there had been or the petitioner likely violated sections 25, 26, 28, 29, 30, 40 and 41 of the Act. The notice outlined measures the petitioner was take to remedy the situation within 30 days from the date of receipt of the notice.
15.According to the respondent, the petitioner wrote a letter dated 4th September 2023 alleging that it had partially complied with the requirements contained in the enforcement notice without providing proof. The respondent issued a penalty notice dated 25th September 2023 directing the petitioner to pay Kshs. 2, 975,000 within 30 days pursuant to section 63 of the Act. The penalty notice also informed the petitioner of its right of appeal to the High Court as required under section 64 of the Act.
16.The respondent maintained that the petition offends the doctrine of exhaustion and this court lacks jurisdiction to hear and determine it. The petition also failed the specificity test set out in Anarita Karimi Njeru v Republic [1979] eKLR.
17.Respondent asserted that the petitioner was accorded a fair hearing in accordance with article 50(1) of the Constitution; the penalty notice complied with the requirements in article 47(2) of the Constitution and section 4(2) of the Fair Administrative Action Act. The respondent denied violating articles 40(1), 73, 47(1) and 50 of the Constitution.
18.The respondent maintained that section 63 of the Act gives the Commissioner discretion to impose penalty; that the petitioner did not give any undertaking for consideration.
Submissions
19.The petition was disposed of through written submissions with brief oral highlights.
Petitioner’s submissions
20.Mr. Etemesi, learned counsel for the petitioner submitted, highlighting their written submissions, that the petition is properly before this court because the respondent’s administrative process was procedurally unfair, unreasonable, illegal and an infringement of the petitioner’s constitutional right to a fair administrative action and hearing.
21.Learned counsel argued that section 63 of the Act provides recourse for persons seeking to appeal against the respondent’s decision and not those seeking to challenge the entire administrative process used to arrive at the decision which this court has jurisdiction to hear by virtue of articles 23 and 165 of the Constitution. Mr. Etemesi maintained that the petition particularized the rights violated thus, met the test of constitutional petitions set in Anarita Karimi Njeru v Republic [1979] eKLR and Julius Meme v Republic & another [2004] eKLR.
22.According to learned counsel, the respondent’s interpretation of section 63 of the Act on undertaking to mean a pledge or promise was erroneous and the award of the fine was wrong and unlawful. In counsel’s view, the word undertaking as used in section 63, refers to a registered entity engaged in an economic activity. Counsel argued that a holistic reading and interpretation of the section shows that the first part of the section refers to administrative fines against individuals while the second part refers to an undertaking by an economic entity.
23.Mr. Etemesi posited that while section 63 provides for the mode of determining and awarding administrative fines against both individuals and undertakings which the petitioner is, the respondent misconstrued the section to mean that the respondent ought to have given a promise at the point of reply in anticipation of a fine and that since none had been given, the respondent had unfettered discretion to decide the amount of penalty to impose.
24.Learned counsel maintained that it is not clear what parameters the respondent relied on when imposing fines to individuals and entities since from the replying affidavit, the respondent imposes different amounts of fines for similar offenses bringing to light the unpredictability of outcomes of administrative actions the respondent carried out. Counsel maintained that both the construction and application of the law that the respondent relied on in its investigations against the petitioner were part of administrative process which was flawed and so was the decision. The administrative process culminating in the imposition of the fine was procedurally unfair and illegal. The whole process was marred in secrecy, mystery and was unpredictable. Counsel relied on the decisions in Republic v Kenya Revenue Authority ex-parte Amsco Kenya Limited [2014] eKLR and Republic v Ethics and Anti-Corruption Commission & 2 others Ex-Parte Erastus Gatebe [2014] eKLR.
25.Mr. Etemesi cited article 73 (1) (a) (iv) and (2) (d) of the Constitution for the argument that the manner in which the administrative process was conducted does not promote public confidence. The respondent has no clear or known set standard or parameters for determining compliance which could lead to administrative decisions based on logical proof and evidentiary material.
26.Counsel relied on the decision in Baker v. Canada (Minister of Citizenship & Immigration), [1999] 2 S.C.R 817 for the argument that the process leading to the fine was everything but fair, impartial of an open process. Further reliance was placed on MacFoy v United Africa Co. Ltd [1961] 3 All E.R. 1169 and counsel urged the court to allow the petition.
Respondent’s submissions
27.Mr. Otieno, learned counsel for the respondent submitted, highlighting their written submissions, that the respondent acted lawfully in the discharge of its mandate. Counsel relied on the decisions in Harriskissoon v Attorney General of Trinidad & Tobago (1980) AC 265; Pattni & another v Republic [2001] eKLR and County Government of Kakamega & 2 others v Salaries and Remuneration Commission; County Government of Mombasa (Interested Party) [2018] eKLR.
28.Learned counsel argued that the respondent did not wrongly apply section 63 when imposing the penalty. According to counsel, section 64 is intended to facilitate a correction of any error made by the respondent, with a view to ensuring that no constitutional violation occurs.
29.Mr. Otieno argued that where the law provides for the procedure to be followed in ensuring that justice is done, that procedure should be followed or exhausted first. The alleged violation of section 63 of the Act cannot be redressed through constitutional adjudication. Counsel maintained that no other redress mechanism is contemplated by the Act than an appeal. Reliance was placed on the decisions in Mutanga Tea & Coffee Company Ltd v Shikara Limited & another [2015] eKLR; Speaker of National Assembly v James Njenga Karume [1992] eKLR; Republic v National Environmental Management Authority [2011] eKLR and Secretary, County Public Service Board & another v Hulbhai Gedi Abdille [2017] eKLR.
30.Learned counsel postulated that where the law prescribes an appellate route, it contemplates a merit-based challenge and not a process-based challenge. The petitioner should have lodged an appeal because the decision was merit based. Counsel relied on the decisions in Municipal Council of Mombasa v Republic & another [2002] eKLR and Republic v Public Procurement Administrative Review Board & another Ex Parte Intertek Testing Services (EA) Pty Ltd & Authentix Inc; Accounting Officer, Energy and Petroleum Regulatory Authority & another [2022] eKLR.
31.Mr. Otieno submitted that section 63 of the Act does not introduce the distinction the petitioner is drawing between natural and juridical persons. According to counsel, the word undertaking may mean either a solemn agreement or promise for an economic entity. Neither of the two meanings of the word undertaking would assist the petitioner as illustrated in Hofner and Elser v Macrotron GmbH [1991] ECR 1-1979. What matters is not whether the person on whom the penalty is imposed is a natural or a juridic person but whether the person on whom the respondent proposes to impose a penalty under section 63 has furnished it with proof that it is an entity engaged in an economic activity.
32.Learned counsel argued that an entity that has furnished the respondent with proof that it is an undertaking within the meaning of section 63 must then proceed to furnish it with proof of its annual turnover for the preceding financial year. Where no such proof is tendered, the respondent is entitled to proceed with imposition of a fine in accordance with the first limb of section 63, as was the case herein. The impugned fine was therefore both lawful and procedural.
33.Counsel maintained that the petitioner had no right to be given information unless the information had been sought or requested for. The allegations of secrecy, mystery and unpredictability have no merit. Learned counsel maintained that the respondent followed the law and procedure and urged the court to dismiss the petition.
Determination
34.I have considered the petition, the response and argument by counsel for the parties. I have also read the record and the documents provided. The issue for determination is whether this petition is properly before this court and, depending on the answer to this issue, whether the petition should be allowed.
Proper court
35.The petitioner argued that the petition is properly before this court because it challenges violation of rights and fundamental freedoms. According to the petitioner, the respondent’s administrative process was procedurally unfair, unreasonable, illegal and an infringement of the petitioner’s constitutional right to fair administrative action and hearing. The process adopted by the respondent was full of secrecy, mystery and was unpredictable so that the resultant decision was unlawful.
36.The respondent maintained that it acted within the law; the petitioner was given an opportunity to be heard and it did not violate any constitutional rights. According to the respondent, the law gives the petitioner the right of appeal which was pointed out in its decision and which the petitioner should have invoked as required by law. The respondent denied committing any infractions that would amount to violation of rights and fundamental freedoms.
37.The facts of this petition are not in dispute. The respondent wrote to the petitioner wanting to know how the petitioner’s processes complied with the data laws. The responses received from the petitioner were not satisfactory. The petitioner was issued with further notices to correct the shortcomings identified in the petitioner’s responses.
38.The respondent again received complaints and notified the petitioner as required by law and sought responses from the petitioner to which the petitioner responded. The respondent again informed the petitioner what the petitioner had to do to comply with the legal requirements which the petitioner notified the respondent that it had done.
39.The respondent considered the responses but was not satisfied with the answers and measures the petitioner stated it had undertaken. The respondent then issued a penalty decision of Kshs. 2, 975, 000 which the petitioner was to pay within 30 days. The petitioner was also informed of its right of appeal. That decision prompted the filing of this petition alleging violation of the petitioner’s rights and freedoms as well as misinterpretation and misapplication of the law. The responded argued that the petitioner was required to lodge an appeal but not a constitutional challenge thus, raising the issue whether these proceedings are properly before this court.
40.Section 56 of the Act on complaints, provides that a data subject who is aggrieved by a decision of any person under the Act may lodge a complaint with the Data Commissioner. A person who intends to lodge a complaint under the Act should do so orally or in writing.
41.Under subsection (3), where a complaint is made orally, the Data Commissioner should cause the complaint to be recorded in writing and the complaint be dealt with in accordance with such procedures as the Data Commissioner may prescribe- giving the Data Commissioner discretion to determine the procedure to follow. Subsection (4) requires that a complaint should contain such particulars as the Data Commissioner may prescribe while under subsection (5), the complaint to the Data Commissioner should be investigated and concluded within ninety days.
42.Section 57 which is on investigations provides that the Data Commissioner may, for the purpose of the investigation of a complaint, order any person to—(a)attend at a specified time and place for the purpose of being examined orally in relation to the complaint; (b) produce such book, document, record or article as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other enactment from disclosing; or(c)furnish a statement in writing made under oath or on affirmation setting out all information which may be required under the notice.
43.Subsection (2) states that where material to which an investigation relates consists of information stored in any mechanical or electronic device, the Data Commissioner may require the person named to produce or give access to it in a form in which it can be taken away and in which it is visible and legible.
44.Under subsection (3), a person who, without reasonable excuse, fails or refuses to comply with a notice, or who furnishes to the Data Commissioner any information which the person knows to be false or misleading, commits an offence.
45.Section 58 on enforcement provides that-1.Where the Data Commissioner is satisfied that a person has failed, or is failing, to comply with any provision of this Act, the Data Commissioner may serve an enforcement notice on that person requiring that person to take such steps and within such period as may be specified in the notice.
46.Subsection (2) provides that an enforcement notice served under subsection (1) shall— (a) specify the provision of this Act which has been, is being or is likely to be, contravened; (b) specify the measures that should be taken to remedy or eliminate the situation which makes it likely that a contravention will arise; (c) specify a period which shall not be less than twenty-one days within which those measures shall be implemented; and (d) state any right of appeal.
47.Under subsection (3), any person who, without reasonable excuse, fails to comply with an enforcement notice commits an offence and is liable on conviction to a fine not exceeding five million shillings or to imprisonment for a term not exceeding two years, or to both.
48.Section 62 is on penalty notices and states thatif the Data Commissioner is satisfied that a person has failed or is failing as described in section 58, the Data Commissioner may issue a penalty notice requiring the person to pay to the Office of the Data Commissioner an amount specified in the notice. Subsection (2) provides what the Data Commissioner will consider in determining the amount of the penalty to be paid.
49.Section 63 on administrative fines provides thatin relation to an infringement of a provision of the Act, the maximum amount of the penalty that may be imposed by the Data Commissioner in a penalty notice is up to five million shillings, or in the case of an undertaking, up to one per centum of its annual turnover of the preceding financial year, whichever is lower.
50.Section 64 which is material, provides that a person against whom any administrative action is taken by the Data Commissioner, including enforcement and penalty notices, may appeal to the High Court.
51.The petitioner argued that it responded to all the issues raised in the enforcement notices, outlined measures it had undertaken, including a referee verification mechanism which had been proposed and developed and it was in the final rollout stage. Training and sensitization of staff on the requirements of the Act was ongoing.
52.The petitioner argued however that without verifying the information it had provided in the response to the enforcement notice, or seeking further clarification on the information, the respondent issued a penalty. The petitioner asserted that in doing so, the respondent abused its discretion and made a decision in bad faith and ulterior motive with the intention of making the petitioner an example to the rest of those in the digital credit provision.
53.The petitioner further argued that the respondent relied on unknown and ambiguous parameters to determine its response to the enforcement notice and that the procedure for arriving at the penalty was not in conformity with the provisions of the Fair Administrative Action Act thus, was illegal, irrational and unfair. It was the petitioner’s position that the respondent violated its right to fair hearing and breached the provisions of articles 25(c), 40(1) (a), 47 (1) and (2), 50(1) and (2) (d) and (q) and 73 of the Constitution.
54.The respondent denied violating the Constitution, the law or the petitioners’ rights and fundamental freedoms. The respondent maintained that the petitioner was accorded fair hearing in accordance with the law; the penalty notice complied with the requirements in article 47(2) of the Constitution and section 4(2) of the Fair Administrative Action Act. The respondent denied violating any articles of the Constitution, maintaining that the petitioner should have lodged an appeal instead of a constitutional petition.
55.I have considered the arguments by parties and perused the record. There is no denial that the petitioner received inquiries and notifications, including complaints raised against it and responded. The petitioner was again served with an enforcement notice requiring it to take certain remedial actions and the petitioner did not fault the respondent in this regard. The respondent thereafter issued a penalty notice requiring the petitioner to pay a penalty of Kshs. 2,975,000 within 30 from the date of service of the penalty notice for failure to demonstrate compliance with the directions issue by the respondent. The penalty notice informed the petitioner of its right of appeal against the decision or the administrative action taken against it within 30 days.
56.Section 64 of the Act gives a party aggrieved by the respondent’s decision the right of appeal to the High Court. However, despite this provision of the law, the petitioner filed a constitutional petition arguing that its rights were violated, which the respondent argued should not have been the case.
57.The respondent exercised its mandate and made a decision under the Act. A challenge to that decision is by way of appeal to the High Court. Section 64 of the Act establishes a mechanism for accessing justice by providing a system of appeal where one is not satisfied with the respondent’s decision. This is an efficacious statutory mechanism an aggrieved party is required to invoke in the event of a desire to challenge such a decision.
58.The law has long been settled that where a statutory remedy exists, a party should pursue that remedy rather than invoking a different jurisdiction other than the available remedy except in exceptional circumstances which must be demonstrated one of which is that the available recourse will not result into an effective remedy.
59.In Speaker of National Assembly v James Njenga Karume (supra) the Court of Appeal stated that where there is a clear procedure for the redress of any particular grievance prescribed by the Constitution or an Act of Parliament, that procedure should be strictly followed. This position has received approval by the Supreme Court in several decisions.
60.In Albert Chaurembo Mumba & 7 others v Munyao & 148 others [2019] KESC83(KLR), the Supreme Court explained that jurisdiction cannot be “optional” unless such parallel avenues are provided with certain limitations by any written law and neither can jurisdiction be acquired or exercised depending on the unique facts and circumstances of each particular case.
61.In other words, the Supreme Court approved the view expressed in Tom Kusienya & 11 others v Kenya Railways Corporation & 2 others [2013] KEHC 7037 (KLR), that the (High) Court should exercise restraint in exercising its jurisdiction under article 165 where there exists alternative method of dispute resolution.
62.The Data Protection Act identifies the appellate procedure as the route that should be followed by a party wishing to challenge the decision by the respondent. That is the route that was available to the petitioner but instead of following the appellate procedure provided for by law, the petitioner chose to invoke the jurisdiction of this court under article 165(3) of the Constitution.
63.The appellate route provided for is still to this court exercising its appellate jurisdiction. An appeal has to be lodged in the manner provided for under the Civil Procedure Rules, 2010 a different mode of invoking the court’s jurisdiction from that in a constitutional petition. The court will have jurisdiction to deal with all issues the petitioner raised in the petition, including misinterpretation and misapplication of the law (section 63), failure to accord one fair hearing and any deficiencies or failures on the part of the body making the administrative decision. The petitioner had no option but to follow the procedure provided by statute. It was not available to it to decide to file a constitutional petition claiming violation of rights and fundamental freedoms, a procedure not provided for and to a court that is not intended to deal with administrative decisions made by the respondent.
64.In this regard, the decision of the Privy Council in Harriskissoon v Attorney General of Trinidad and Tobago (supra) is also material and to the point. In that case, the Privy Council agreed with the decision of the Court of Appeal of Trinidad and Tobago and dismissed the appeal. The Privy Council stated although the right to apply to the High Court under the Constitution for redress when a human right or fundamental freedom had been or was likely to be contravened was an important safeguard of those rights and freedoms, it was an abuse of the process of the court to make such an application as a means of avoiding the necessity of applying for the appropriate judicial remedy for an unlawful administrative action which involved no contravention of a human right or fundamental freedom. The court was of the view, that since the appellant had deliberately chosen not to apply for the appropriate judicial remedy which the law gave him, the proceedings brought by the appellant and his claim that he had been deprived of the human rights and fundamental freedoms guaranteed by the Constitution, namely, the rights to enjoy property, equality before the law and the protection of the law, were totally misconceived.
65.I must state here that it is not all actions, including administrative actions by public authorities that constitute human rights violations. Since the Act provides an avenue for seeking redress over the respondent’s decisions, that is the route the law has availed to those aggrieved by the respondent’s administrative actions and the petitioner was bound to follow that procedure by filing an appeal to the appropriate court rather than seeking judicial intervention under article 22 of the Constitution thereby bypassing a mandatory step for challenging the impugned administrative action.
66.There must be a delineating boundary between violation of rights and fundamental freedoms in the Bill of Rights and decisions from administrative bodies which are appealable through the normal appellate channel where the law has clearly provided for that avenue. The petitioner could not deviate from this procedure and hope to sustain its claim through a procedure other than that provided for by the Act.
67.I agree with the respondent that the proceedings before this court were instituted contrary to the procedure allowed by section 64 of the Act and therefore are unsustainable. This is because constitutional protections are not universally applicable to all administrative actions arising from the respondent’s decisions. Those aggrieved must of necessity engage with established the processes under statute in seeking judicial intervention.
68.Consequently, and for the above reasons, the petition fails for engaging the wrong court through a fault process and is dismissed with costs.
DATED AND DELIVERED AT NAIROBI THIS 31ST DAY OF JULY 2025E C MWITAJUDGE