[2025] KEHC 9058 (KLR)

Chopetta v CIC Insurance Limited (Commercial Case E063 of 2020) [2025] KEHC 9058 (KLR) (Commercial and Tax) (20 June 2025) (Ruling)

Neutral citation: [2025] KEHC 9058 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Commercial Courts)

Commercial and Tax

Commercial Case E063 of 2020

RC Rutto, J

June 20, 2025

Between

Amalie Chopetta

Plaintiff

and

CIC Insurance Limited

Defendant

Ruling

1. The Plaintiff instituted this suit against the Defendant by a Plaint dated 30th October 2020, alleging a breach of her image rights. She avers that on the afternoon of 28th August 2020, she discovered that the Defendant was, and continues to be, using her image on its advertising platform at its Mombasa offices located on Nkurumah Road, without her written or verbal consent. The Plaintiff contends that she did not waive her right to privacy, and that the Defendant’s continued use of her image following the expiry of the underlying contract is injurious to her rights. Consequently, the Plaintiff seeks general, exemplary, and aggravated damages; a permanent injunction restraining the Defendant and its agents from publishing or continuing to use her image in commercial advertisements; and the costs of the suit.

2. The Defendant stated that through an agent, ALB Limited, it entered into an agreement with the Plaintiff to use her image for advertisement purposes for two years between July 2017 and August 2019 at a consideration of Kshs.40, 000/= which was paid in full. That at the end of the advertisement period, the Defendant avers that it contracted a third-party company, Good Power Management to retrieve all advertisement materials from different sites however, that they inadvertently failed to include Mombasa region and they only came to learn about the omission when it received a demand letter from the Plaintiff. That after the suit was filed, the Defendant tried to negotiate and settle the matter outside the court with the Plaintiff to no avail.

3. Pursuant to the court’s directions issued on 16th October 2024, the court inquired why a complaint was not lodged in the Office of the Data Protection Commissioner and subsequently, the court directed parties to submit on whether or not the court has jurisdiction to hear and determine the matter before it.

4. The Plaintiff’s submissions are dated 6th November 2024 while the Defendant’s submissions are dated 13th November 2024.

Plaintiff’s Submissions 5. Counsel for the Plaintiff commenced the Plaintiff’s submissions with a preliminary statement, urging the Court to retain jurisdiction over the dispute. It was submitted that referring the matter to the Office of the Data Protection Commissioner (ODPC) would not necessarily promote judicial efficiency, particularly given that the High Court is already seized of the matter and is competent to hear and determine the same.

6. The Plaintiff identified five key issues for determination: first, whether the High Court has jurisdiction to adjudicate the present dispute; second, whether the proposed referral to the ODPC would prejudice the Plaintiff’s right to access justice; third, whether the complexity and nature of the case warrant the High Court’s continued jurisdiction; fourth, whether the doctrine of exhaustion precludes the Court from exercising jurisdiction; and fifth, whether the Defendant would suffer any prejudice if the matter is retained by the High Court.

7. On the first issue, the Plaintiff submitted that the High Court remains the forum of choice for matters that require judicial oversight, particularly where complex issues of law are involved. In support of this position, the Plaintiff relied on the cases of Ann Njoki Kamane v KTDA Agency [2019] eKLR; Donald Eliakim Obon v Faulu Kenya DTM Limited [2020] eKLR; Kuria v University of Kabianga (Petition E002 of 2022) eKLR; and Mutuku Ndambuki Matingi v Rafiki Micro Finance Bank Limited [2021] eKLR. The Plaintiff submitted that these decisions, which were rendered after the enactment of the Data Protection Act and the establishment of the Office of the Data Protection Commissioner (ODPC), illustrate that the High Court has continued to entertain and determine claims relating to data protection, notwithstanding the existence of the ODPC.

8. The Plaintiff further contended that although the ODPC was established in 2019, the rules operationalizing its mandate only came into force in December 2021. As such, the present suit, having been filed prior to the commencement of the ODPC’s adjudicative function, falls within the proper jurisdiction of the High Court. It was argued that transferring the matter at this stage would likely result in further delay in its resolution and that, in the interest of efficiency and finality, the High Court should proceed to hear and determine the matter to its logical conclusion.

9. On the second issue, the Plaintiff relied on Article 40 of the Constitution of Kenya and the case of Abidha Nicholusv Attorney General & 7 Others, Petition No. E007 of 2023, to submit that the jurisdiction of the ODPC is confined to the enforcement of the Data Protection Act and may not fully capture or redress the breadth of the Plaintiff’s claims in this matter. The Plaintiff argued that while the doctrine of exhaustion generally requires litigants to pursue alternative statutory mechanisms before approaching the courts, the doctrine is not absolute. It was submitted that where such alternative mechanisms are inadequate or incapable of providing effective remedies, litigants are entitled to seek redress before the courts directly. The Plaintiff further contended that, given the age of the suit, transferring the matter to the ODPC at this stage would undermine the timely and efficient resolution of the dispute and potentially deprive the Plaintiff of effective relief. She characterized such a transfer as a “zero-sum game,” arguing that it would not meaningfully advance the interests of justice. Additionally, it was submitted that since Section 64 of the Data Protection Act allows for appeals from decisions of the ODPC to the High Court, it would serve the interests of judicial economy and procedural efficiency to allow the High Court to continue hearing and determining the matter without unnecessary procedural detours.

10. On the third issue, the Plaintiff submitted that the nature of the dispute is complex and transcends the mere enforcement of data protection rights. It was her position that the suit also raises contractual questions which, she argued, fall outside the jurisdictional competence of the ODPC. The Plaintiff maintained that these contractual dimensions would need to be canvassed during the hearing and determination of the suit, and therefore, the High Court is the appropriate forum to adjudicate all aspects of the dispute comprehensively.

11. On the fourth issue, the Plaintiff submitted that the Defendant would not suffer any prejudice if the matter were to proceed before the High Court. On the contrary, she argued that the High Court is well-positioned to address all legal issues arising from the dispute in a holistic manner, including those that fall outside the jurisdictional remit of the ODPC, thereby avoiding fragmented litigation across multiple fora. The Plaintiff further contended that the Defendant stands to face no procedural or financial disadvantage by having the matter adjudicated by the High Court, as both parties would be afforded a fair opportunity to present their respective evidence and arguments.

12. In conclusion, the Plaintiff submitted that the High Court is the most suitable forum to resolve the issues raised in the suit, as it is capable of safeguarding both procedural fairness and substantive justice. She emphasized that while the doctrine of exhaustion is a relevant consideration, it is not to be applied rigidly, particularly in cases involving constitutional claims. The Plaintiff asserted her right to seek relief directly before the High Court, arguing that such an approach would enable her to obtain comprehensive justice without being encumbered by unnecessary procedural barriers.

Defendant’s Submissions 13. The Defendant, in its submissions, aligned itself with the Court’s earlier observation regarding jurisdiction and contended that the High Court lacks the requisite jurisdiction to entertain the present suit. In support of this position, the Defendant relied on the decision in Owners of the Motor Vessel “Lilian S” v Caltex Oil (Kenya) Limited [1989] KLR 1, which established the foundational principle that jurisdiction is everything, and that a court must down its tools the moment it finds that it lacks jurisdiction. The Defendant further cited the decision in Kweri v Beehive Media Limited [2023] KEHC 2684 (KLR) (Constitutional and Human Rights), in which the High Court held that claims relating to the unauthorized use of an individual’s image constitute a breach of data protection rights and, as such, fall within the exclusive domain of the Office of the Data Protection Commissioner. The Defendant submitted that the Plaintiff’s complaint in the present case is one of unauthorized use of personal data and is therefore squarely within the purview of the ODPC under the Data Protection Act.

Analysis and Determination 14. Having carefully considered the parties submissions made and all authorities cited, this court is of the view that the issue arising for determination is Whether the High Court has jurisdiction to determine the claim for unauthorized use of Plaintiff’s image or whether the matter falls within the exclusive mandate of the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act 2019.

15. The Plaintiff's claim is based on the alleged unauthorized use of her image by the Defendant in commercial advertising after the expiration of their contract. She asserts that this constitutes a violation of her rights, including her right to privacy and data protection. These allegations fall within the scope of personal data protection, as she contends that her image qualifies as personal data under Section 2 of the Data Protection Act, 2019 (DPA), which defines personal date as "any information relating to an identified or identifiable natural person."

16. The Plaintiff argues that the Defendant's continued use of her image without her consent amounts to a breach of the provisions outlined in the DPA. Section 25 of the DPA provides for the principles of data protection while section 30 provides for the lawful processing of personal date which should be subject to the consent of the data subject. Thus, the core legal issue in this case is the processing of personal data without consent, as well as whether the continued display of the Plaintiff’s image post contract without renewed consent amounts to unlawful data processing under these sections.

17. Further, the Data Protection Act establishes the ODPC as the primary enforcement body for violations of data protection rights and its powers include receiving and investigating complaints as per Section 56 of the DPA, issuing enforcement and penalty notices as per Sections 58 to 60 of DPA and resolving disputes and ordering compensation as per Section 65 of DPA. Section 64 of the DPA provides for appeals from ODPC decisions to the High Court, reinforcing the ODPC’s role as the first port of call.

18. Under the doctrine of exhaustion, litigants must first seek remedies through available statutory mechanisms before approaching the courts and various courts have upheld this doctrine in numerous cases. Courts lack original jurisdiction unless exceptional circumstances are proven. In the present case therefore, are there exceptional circumstances to retain jurisdiction? The Plaintiff has urged this Court to exercise its jurisdiction notwithstanding the existence of the Office of the Data Protection Commissioner (ODPC), citing several grounds which, in her view, constitute exceptional circumstances. These include the age of the suit, the alleged complexity of the matter, and the concern that referring the matter to the ODPC would hinder access to justice and delay resolution.

19. The Plaintiff also argues that the suit was filed before the ODPC was fully operational, and that transferring the matter at this stage would occasion delay and potentially prejudice the Plaintiff’s right to an effective remedy. It is not in dispute that the ODPC was established pursuant to the Data Protection Act, 2019, but only became fully operational upon the enactment of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations in December 2021. However, the mere fact that this suit was filed prior to the full operationalization of the ODPC does not, of itself, constitute exceptional circumstances. The correct legal position is that the jurisdiction of this Court must be considered as at the time it is invoked or questioned not merely at the time the suit was filed. Since the ODPC is now fully functional and vested with statutory jurisdiction over complaints involving unlawful processing of personal data, including images, the question becomes whether the Plaintiff has demonstrated that her case cannot be effectively and fairly resolved by that specialized body.

20. The Plaintiff also contends that the matter raises complex legal issues, including contractual elements, which are beyond the jurisdiction of the ODPC. While the Court appreciates that complexity may, in some cases, necessitate judicial oversight, it must be emphasized that the core issue in this suit relates to the alleged breach and continued use of the Plaintiff’s image without consent which is an issue that squarely falls within the ambit of the Data Protection Act. No independent contractual claims have been specifically pleaded or particularized. The existence of some factual or legal overlap does not divest the ODPC of jurisdiction nor does it automatically transform the matter into one necessitating judicial resolution. Further, the Plaintiff has raised concerns about access to justice, asserting that referral to the ODPC may impede the expedient and comprehensive resolution of the dispute. However, the Court finds this concern not persuasive. The ODPC is not only legally mandated but also equipped with the authority to investigate complaints, issue enforcement or penalty notices, and award compensation where appropriate. In fact, the DPA under Section 56 (5) provides that the resolution of a complaint which also factors in investigation of a complaint be made within ninety days which is a reasonable period to resolve a complaint.

21. More importantly, Section 64 of the Data Protection Act provides for a right of appeal to the High Court against decisions of the ODPC, thereby preserving access to judicial recourse and procedural fairness in the event the parties are aggrieved with the holding and finding of the Data Commissioner. Therefore, the availability of an appellate path within the statutory framework adequately safeguards the Plaintiff's right to access justice.

22. Summarily, I am persuaded by the decision in the case of Kwere v Beehive Media Limited; Capwell Industries Limited (Interested party) Constitutional Petition E321 of 2021 [2023] KEHC 2684 [KLR] where the court observed that;“a close scrutiny of the Data Protection Act reveals a deliberate design to ensure that all claims arising from allegations of infringement of Article 31(c) and (d) of the Constitution are wholly dealt with by the Commissioner as the first port of call---- it means that the commissioner has such power to determine whether privacy rights as provided for in the Bill of Rights has been denied, violated, infringed or threatened.”

23. This Court acknowledges the Plaintiff’s concerns but I find that no compelling or exceptional circumstances have been demonstrated to justify the bypassing of the statutory mechanism provided under the Data Protection Act. The circumstances presented do not meet the threshold articulated in case law for departure from the doctrine of exhaustion. Accordingly, the ODPC remains the proper forum to hear and determine the dispute in the first instance.

24. I hereby directed as follows;a.That this court declines jurisdiction to determine the substantive dispute at this juncture.b.The suit us hereby transferred to the Office of the Data Protection Commissioner for hearing and determination in accordance with the Data Protection Act 2019 and the relevant subsidiary legislation.c.Each party to bear their own costs.

25. Orders accordingly

DATED SIGNED AND DELIVERED AT MACHAKOS THIS 20TH DAY OF JUNE 2025. RHODA RUTTOJUDGE