[2023] KEHC 17321 (KLR)

Gichuhi & 2 others v Data Protection Commissioner; Mathenge & another (Interested Parties) (Judicial Review E028 of 2023) [2023] KEHC 17321 (KLR) (Judicial Review) (12 May 2023) (Judgment)

Neutral citation: [2023] KEHC 17321 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Judicial Review

Judicial Review E028 of 2023

JM Chigiti, J

May 12, 2023

Between

Allen Waiyaki Gichuhi SC

1st Applicant

Charles Wambugu Wamae

2nd Applicant

Wamae & Allen Advocates

3rd Applicant

and

Data Protection Commissioner

Respondent

and

Florence Wamuyu Mathenge

Interested Party

Ambrose Ndungu Waigwa

Interested Party

(Originating from the decision of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 Of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge And Ambrose Waigwa)

Jurisdiction of the Office of the Data Protection Commission in rendering a decision is time bound

The applicants sought to review a decision by the Office of the Data Protection Commission (ODPC) that was made outside the 90 day timeline set upon the ODPC by section 56(5) of the Data Protection Act. The applicants contended that the ODPC had no jurisdiction to render a decision outside the 90-day timeline. The High Court held that the decision of the ODPC dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the respondents’ jurisdiction lapsed. The High Court issued an order of mandamus compelling the respondent to readmit for fresh investigations the applicants’ complaint.

Reported by John Ribia

Jurisdiction– jurisdiction of the Office of the Data Protection Commission (ODPC) – where theData Protection Actgranted the ODPC 90 days to make a determination on a complaint – where the ODPC rendered a decision outside the 90 day timeframe - whether the Office of the Data Protection Commission (ODPC) acted in excess of its jurisdiction by rendering a decision on a complaint outside the 90-day timeframe - whether a purposive interpretation of legislation could excuse a tribunal that had rendered a decision outside its statutory timeframe - whether the delay of a tribunal of making a decision outside its statutory timeframe on account of the delay of the applicants in providing evidence could be excused -Data Protection Act, section 56(5)Administrative Law– reliefs – where an administrative body acted outside its jurisdiction by rendering a decision outside of statutory timelines – reliefs available to parties before such an administrative body – remitting of the dispute to the administrative body - whether the High Court could remit a matter decided by a tribunal out of the statutory timeframe back to the tribunal for reconsideration –Fair Administrative Action Actsections 8 and 11(1)(h)Civil Practice and Procedure– locus standi – locus standi to institute judicial review proceedings – locus standi of a law firm to file judicial review proceedings against the Office of the Data Protection Commission for a decision rendered out of time – where the respondent before the ODPC was the former employee of the law firm who had shared client information with third parties - whether a law firm that was appealing a decision against the Office of the Data Protection Commission which held that the act of its former employee sharing court documents to their personal email and third parties had locus standi to file a judicial review application contesting the legality of the decision.Words and Phrases- locus standi – definition - the right to bring an action or to be heard in a given forum -Black’s Law Dictionary, 9th Edition, page 1026.

Brief facts On July 8, 2022, the applicants discovered that on diverse dates between June 2021 to July 2022, the 1st interested party shared with the 2nd interested party confidential information pertaining the personal and sensitive data of the 3rd applicant’s clients. Upon the discovery of the unauthorized and unlawful sharing of the data, which also included the intellectual property of the 3rd applicant, the applicants lodged a complaint with the Office of the Data Protection Commission (ODPC/ the respondent) vide a complaint dated July 20, 2022. Upon receipt of the aforementioned complaint, the ODPC considered it and dismissed the complaint. Aggrieved the applicants filed the instant suit on grounds that the complaint was lodged with the respondent on July 20, 2022. It took the respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the applicants the respondent ought to have concluded investigation and rendered its determination by October 19, 2022. The applicants contended that the respondent’s jurisdiction came to an end by way of effluxion of time.On the effluxion of time the respondent contended that it was highly probable that the applicants jointly, severally and deliberately designed that the respondent would be time constrained having caused delay on their part by deliberately leaving out facts that would be necessary to determine the complaint. The respondent further stated that whereas statutes provided for express timelines for action to be taken, the courts had previously dealt with effluxion of time and taken a purposive approach to it.

Issues

Whether the Office of the Data Protection Commission (ODPC) acted in excess of its jurisdiction by rendering a decision on a complaint outside the 90-day timeframe set by section 56(5) of the Data Protection Act.

Whether the High Court could remit a matter decided by a tribunal out of the statutory timeframe back to the tribunal for reconsideration.

Whether a purposive interpretation of legislation could excuse a tribunal that had rendered a decision outside its statutory timeframe.

Whether the delay of a tribunal of making a decision outside its statutory timeframe on account of the delay of the applicants in providing evidence could be excused.

Whether a law firm that was appealing a decision against the Office of the Data Protection Commission which held that the act of its former employee sharing court documents to their personal email and third parties had locus standi to file a judicial review application contesting the legality of the decision.

Relevant provisions of the Law Data protection Act (Act No. 24 of 2019), section 56(5)56. Complaints to the Data CommissionerA complaint made to the Data Commissioner shall be investigated and concluded within ninety days.

Held

A preliminary objection was a point of law which must not be blurred with factual details liable to be contested and in any event, to be proved through the processes of evidence. Any assertion which claimed to be a preliminary objection, and yet it bore factual aspects calling for proof, or sought to adduce evidence for its authentication, was not, as a matter of legal principle, a true preliminary objection which the court should allow to proceed.

An issue oflocus standi raised a point of law that touched on the capacity to institute a suit, and it should be resolved at the earliest opportunity. Locus standi was the right to appear and be heard in court or other proceedings. If a party was found to have nolocus standi, then it meant the person could not be heard even on whether or not he had a case worth listening to. If the court was to find that the applicant had no locus standi, then the applicant could not be heard and that point alone may dispose of the suit.

The applicants had the necessarylocus standi to lodge and sufficient interest in these proceedings given that they were intertwined in such an intricate manner as a result of the nature and form of a law firm and the client advocate fiduciary relationship. They owed a duty of care towards one another when it came to the issue of data privacy. The preliminary objection was dismissed.

Jurisdiction was everything, it was what gave a court or a tribunal the power, authority and legitimacy to entertain a matter before it. A decision made by a court of law without jurisdiction was a nullity ab initio(from the beginning), and such a decision was amenable to setting asideex debito justitiae(as a matter of right).

As at the time of determination, January 6, 2022, the period within which the respondent had to investigate and determine the complaint had already lapsed. Pursuant to the provisions of section 56(5) of the Data Protection Act (the Act) the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days’ period ended, the respondent jurisdiction also came to an end by way effluxion of time.

Courts and tribunals could not flout the timelines expressly provided for in law. The moment the 90 days ended, the respondent’s jurisdiction also lapsed. The finding that was rendered outside time was without jurisdiction and therefore a nullity, bereft of any force of law.

Unlike the traditional Kenyan dispute resolution mechanisms like the court, the ODPC did not rely on the evidence produced by parties in making its decision. The ODPC had investigatory powers call for or collect and use more evidence before arriving at a finding.

The respondent admitted that its finding was rendered out of time. The respondent however blamed the applicant for the delay in keeping time. Two wrongs could not make a right in law. The respondent could not be heard to blame the applicant since it lacked the legal authority enlarge time.

Where the Constitution or a statute had provided or set a strict time for the delivery of a judgment or a finding then the High Court could not be called upon to apply a purposive interpretation of the law to enlarge time. Such an approach would be an affront of article 10 of the Constitution; an affront to the rule of law.

Enlarging time in such a terrain would most prejudice and or disadvantage one or the other parties in the dispute. The respondent’s jurisdiction lapsed on the ninetieth day from the day the complaint was lodged. The High Court lacked the Constitutional power to breathe life into a finding that had been arrived at ultra vires under article 165 of the Constitution.

The ODPC acted procedurally within the principles of fair hearing in granting the parties patience and latitude to file documents out of time which promoted the right to fair hearing under article 50 of the Constitution. No amount of compulsion, pressure or threats should be brought to bear on the ODPC to the extent of rendering a finding out of time.

The Data Protection Act defined a data subject as an identified or identifiable natural person who was the subject of personal data. It defined an identifiable natural person as a person who could be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity. Article 260 of the Constitution defined a person to include a company, association or other body of persons whether incorporated or unincorporated. From the Data Protection Act, it was evident that companies, limited liability partnerships, and other legal entities were not considered data subjects. As such, legal entities could not bring complaints to the Data Protection Commissioner. The applicants were partners in the 3rd applicants law firm. The applicants had the capacity to lodge a complaint with the ODPC under theData Protection Act.

The High Court’s power and authority flows from the Constitution and the Fair Administrative Action Act. Section 11(1) (h) of the Fair Administrative Action Act provided that in proceedings for judicial review under section 8, the court may grant any order that was just and equitable, including an order remitting the matter for reconsideration by the administrator.

Application allowed

Orders

An order of certiorari was issued to remove to the High Court for of quashing the decision of the office of the Data Protection Commission dated January 6, 2023 in respect of the Reference No Odpc/conf/1/5/v01 1(112), ODPC Complaint No 677 Of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae Vs Florence Mathenge and Ambrose Waigwa.

Declaration issued that the respondent lacked the jurisdiction to make the final determination dated January 6, 2023 as its jurisdiction came to an end by way of effluxion of time.

Declaration issued that the decision that a person as described under section 56(2) of theData Protection Act, be read together with the schedule of theConstitutionas envisaged in rule 2 as per theConstitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, to include individuals, organisations, company, association or any other body of persons whether incorporated or unincorporated.

Declaration issued that the decision of the respondent dated January 6, 2023, violated the principles of procedural fairness.

An order of mandamus was issued compelling the respondent to readmit for fresh investigations the applicants’ complaint dated July 20, 2022.

The respondent shall complete the fresh investigations within 30 days from the date of readmission.

Costs awarded to the applicants.

Citations Cases Alfred Njau and Others v City Council of Nairobi (Civil Appeal 74 of 1982; [1983] KECA 56 (KLR); (1982) KAR 229) — Explained

Allen Waivaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge And Ambrose Waigwa (Odpc/conf/1/5/v01 1(112), And Odpc Complaint No 677) — Explained

Aprim Consultants v Parliamentary Service Commission & Another (Civil Appeal No E039 OF 2021) — Explained

Elijah Sikona & George Pariken Narok on behalf of Trusted Society of Human Rights Alliance V Mara Conservancy & 5 others (Civil Case 37 of 2013; [2014] KEHC 4420 (KLR)) — Mentioned

Joho & another v Shahbal & 2 others (Petition10 of 2013; [2014]eKLR; [2014] 1 KLR 111) — Explained

Joint Venture of Lex Oilfield Solutions Ltd & CFAO Kenya Ltd v Public Procurement Administrative Review Board & 4 others (Civil Appeal 022 of 2022; [2022] KECA 424 (KLR)) — Mentioned

Judicial Service Commission v Davis Gitonga Karani (Civil Appeal 305 of 2019; [2020] KECA 16 (KLR)) — Explained

Karua, Martha Wangari v Independent Electoral and Boundaries Commission, Seki Lempaka, Anne Waiguru & Peter Ndambiri (Petition 3 of 2019; [2019] KESC 26 (KLR)) — Mentioned

Kenya Power & Lighting Co v Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020; [2022] KEHC 496 (KLR)) — Explained

Kidero, Evans Odhiambo & 4 others v Ferdinand Ndungu Waititu & 4 others (Petition 18 & 20 of 2014; [2014] KESC 11 (KLR)) — Mentioned

Law Society of Kenya v Commissioner of Lands & 2 others (Civil Case 464 of 2000; [2001] eKLR) — Explained

Lempaka, Harun Meitamei v Lemanken Aramat vs Lempaka & 2 Others (Petition 5 of 2014; [2014] eKLR) — Explained

Macharia and Another v Kenya Commercial Bank Limited & 2 others (Application 2 of 2011; [2012] eKLR; [2012] 3 KLR 199) — Explained

Matemu, Mumo v Trusted Society of Human Rights Alliance, Attorney-General, Minister for Justice and Constitutional Affairs, Director of Public Prosecutions, Kenya Section of International Commission of Jurists & Kenya Human Rights Commission (Civil Application 29 of 2014; [2014] KESC 6 (KLR)) — Explained

Motor Vessel ‘Lillian S’ v Caltex Oil (Kenya) Ltd (Civil Appeal 50 of 1989; [1989] eKLR; [1989] KLR 1) — Explained

Oraro v Mbaja (Civil Suit 85 of 1992; [2005] KEHC 731 (KLR); [2005] 1 KLR 141) — Explained

Quick Enterprises Ltd v Kenya Railways Corporation (Civil Case No22 of 1999) — Explained

Republic v Public Procurement Administrative Review Board & Another Ex parte Selex Sistemi Intergrati (? 1260 of 2007; [2008] KEHC 138 (KLR)) — Mentioned

Republic v Public Procurement Administrative Review Board & another; XRX Technologies Limited (Interested Party); Express Automation Limited Ex Parte (Judicial Review Application E1155 of 2020; [2020] KEHC 530 (KLR)) — Explained

Republic v Public Procurement Administrative Review Board & Kenya Power & Lighting Company Limited Ex-Parte Kleen Homes Security Services Limited (Judicial Review 503 & 502 of 2016; [2017] KEHC 7805 (KLR)) — Mentioned

Saisi , Praxidis Namoniv Director of Public Prosecutions & 2 others (Petition 39 of 2019; [2020] KESC 18 (KLR)) — Explained

Salat, Nicholas Kiptoo Arap Korir v Independent Electoral and Boundaries Commission & 7 others (Civil Appeal 228 of 2013; [2014] KECA 782 (KLR)) — Explained

Reserve Bank of India v Peerless General Finance and Investment Co Ltd (1987 AIR 1023, 1987 SCR (2) 1) — Mentioned

Mukisa Biscuit Manufacturing Co Ltd v West End Distributors Ltd ([1969)EA) — Explained

Central Electrical Board v Halifax Corporation ([1963] AC 785) — Mentioned

Statutes Constitution of Kenya, 2010 (Const2010) — article 10, 31(c)(d), 47, 50, 159, 165, 260 — Interpreted

Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013 (Constitution of Kenya, 2010 Sub Leg) — rule 2 — Interpreted

Data Protection Act, 2019 (Act No 24 of 2019) — section 3, 5, 25, 56(2), 64 — Interpreted

Elections Act, 2011 (Act No 24 of 2011) — In general — Cited

Fair Administrative Action Act, 2015 (Act No 4 of 2015) — section 8, 11(1)(h) — Interpreted

Public Procurement And Asset Disposal Act, 2015 (Act No 33 of 2015) — section 175 — Interpreted

Texts Garner, BA., (Ed) (2009), Black’s Law Dictionary (St Paul Minnesota: West Group 9th Edn p 1026)

AdvocatesNone mentioned

Judgment

1. The applicants’ moved this court by way of the substantive notice of motion application dated March 3, 2023 seeking the following orders:a.…….spent.b.…….spent.c.An order of certiorari be and is hereby issued to remove to this court for of quashing the decision of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge and Ambrose Waigwa.d.A declaration do issue that the decision by the respondent made on January 6, 2023, violated the applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider the applicants evidence that had been submitted.e.A declaration do issue that the respondent lacked the jurisdiction to make the final determination dated January 6, 2023 as its jurisdiction came to an end by way of effluxion of time.f.A declaration do issue that the decision that a person as described under section 56(2) of the Data Protection Act, be read together with the schedule of the Constitution as envisaged in rule 2 as per the Constitution of Kenya (Protection of Rights and Fundamental Freedoms) Practice and Procedure Rules, 2013, to include individuals, organisations, company, association or any other body of persons whether incorporated or unincorporated.g.A declaration do issue that the decision of the respondent dated January 6, 2023, violated the principles of procedural fairness.h.An order of mandamus be and is hereby issued to the respondent to readmit for fresh investigations the complaint by the applicants dated 2001 July 2022, and investigate the including the numerous documentations provided to the respondent within 90 days from the date of readmission.i.Costs be provided for.

The Preliminary Objection: 2. The 1st interested party opposed the notice of motion vide a notice of preliminary objection filed on the 16th day of March, 2023 on grounds that the applicants have no authority and/or locusto seek judicial review orders on behalf of their client who are legal personalities.

3. The court directed that the notice of preliminary objection shall be dealt with alongside the substantive notice of motion application.

The Applicants’ Case: 4. The application is supported by the grounds on its face, a supporting affidavit sworn by Charles Wambugu Wamae on March 3, 2023 and a further affidavit dated March 16, 2023 and written the written submissions dated March 23, 2023.

5. It is the applicants case that on July 8, 2022, the Applicants discovered that on diverse dates between June 2021 to July 2022, the 1st interested party shared with the 2nd interested party confidential information pertaining the personal and sensitive data of the 3rd applicant’s clients.

6. Upon the discovery of the unauthorized and unlawful sharing of the data, which also included the intellectual property of the 3rd applicant, the applicants lodged a complaint with the office of the Data Protection Commission (hereinafter referred to as (ODPC) vide a complaint dated July 20, 2022.

7. Upon receipt of the aforementioned complaint, the Respondent assigned the complaint reference Odpc/conf/1/5/v01 1(112), And Odpc Complaint No677 Of 2022 {{> Allen Waivaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge and Ambrose Waigwa}} in line with its mandate under section 56 of the Data Protection Act.

8. The respondent rendered its determination dated January 6, 2023 wherein it dismissed the complaint.

9. The applicants were aggrieved by the above impugned determination on the following counts, that;-i.The decision was made by a body lacking jurisdiction by virtue of effluxion of time.ii.The decision of the respondent expressly excluded evidence placed before it therefore violating the applicants right to a fair hearing as envisaged under article 50 of the Constitution of Kenya, and thus condemned the applicants unheard and in manner that is procedurally unfair.iii.The decision of the respondent expressly misrepresented that the applicant had not placed evidence before its, despite having responded to all additional queries of the respondent and providing all documentation sought.iv.The decision of the respondent expressly misrepresented that the applicants advocates lacked the authority to act despite the same being provided, thus, challenging the applicant’s right to be represented by counsel.v.The decision of the respondent demonstrates an apparent bias as against the applicants as it failed to rely on the evidence presented by the complainants in favour of the respondent.vi.The decision of the respondent violates the principle of natural justice and the principles of Fair Administrative Action.vii.The decision failed to deliver substantive justice as the same relied technicalities intended to deny the applicants a fair and just hearing.viii.The respondent determined extraneous issues that were not before the commission for determination, thus, arriving that a decision that was improper in law and fact.

10. According to the applicants section 56(5) of the Data Protection Act, is couched in mandatory terms that the respondent shall investigate and conclude its investigations ninety (90) days.

11. The complaint herein was lodged with the respondent on July 20, 2022. It took the respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the applicants the respondent ought to have concluded investigation and render it’s determination by October 19, 2022.

12. The applicants further submitted that the respondent’s jurisdiction came to an end by way of effluxion of time citing the case of Joint Venture of Lex Oilfield Solutions Ltd & CFAO Kenya Ltd v Public Procurement Administrative Review Board & 4 others (Civil Appeal 022 of2022) [2022] KECA 424 (KLR).

The Respondents and the Interested Parties’ Case: 13. In response to the motion the respondent filed a replying affidavit dated March 15, 2023 and written submission dated March 29, 2023. On her part, the 1st interested party filed a replying affidavit dated March 16, 2023 and written submissions dated March 31, 2023 while the 2nd interested party filed a replying affidavit dated March 15, 2023 and written submissions dated March 29, 2023.

The Respondent: 14. TheODPC is a regulatory office established pursuant to section 5 of the Act. The ODPC is mandated with regulating personal data processing, ensuring that the processing of a data subject’s personal data is guided by the principles set forth in section 25 of the Act, protecting individuals’ privacy, establishing a legal and institutional mechanism to protect personal data, and providing data subjects with rights and remedies to protect their personal data from processing that is not in accordance with the Act.

15. In July 2022, the ODPC received a complaint from the applicants against its the interested parties who were its ex-employees. The basis of the complaint is that the 1st interested party allegedly sent confidential information from the 3rd applicant to her personal email as well as to a third party, without consent from the data subjects and the applicants.

16. It was alleged that some of the documents shared between the Interested parties included court documents such as pleadings and supporting documents, applications, affidavits, submissions, and legal opinions, bank statements, correspondences, invoices, and subscription emails.

17. The respondent at the inception of the matter noted that a large majority of the complaint did not contain any personal data of the applicants but instead were documents relating to the 3rd applicants corporate (not natural persons) clients who on the face of it were not aware that the 3rd applicant was acting on their behalf.

18. The ODPC upon satisfaction that the applicants had adequately ventilated their complaint and the interested parties given a chance to defend the allegations and by virtue of considering the complaint and documents presented it dismissed the complaint on the grounds that the documents provided formed part of the public record, and the parties referred to in some of the documents were companies and not natural persons who are the data subjects specifically protected under the Act.

19. The respondent also found that the complainants did not demonstrate that their own personal data had been infringed and did not show that they had the authority to represent any other data subjects referred to in the complaint.

20. The respondent went a step further and informed the applicants herein at paragraph 87(ii) of the determination of their right to appeal the determination as provided for in section 64 of the Act.

21. On the effluxion of time the respondent submitted that it is highly probable that the applicants jointly, severally and deliberately designed that the respondent would be time constrained having caused delay on their part by deliberately leaving out facts that would be necessary to determine the complaint.

22. In addition, the respondent stated that the applicants participated in causing a necessary extension of time by taking long periods to lay out their claim and by supplying documents outside the mandate of the respondent.

23. The respondent further stated that whereas statutes provide for express timelines for action to be taken, the courts have previously dealt with effluxion of time and taken a purposive approach to it citing the Supreme Court case of India in Reserve Bank of India v Peerless General Finance and Investment Co Ltd 1987 SCR (2)1 and Republic v Public Procurement Administrative Review Board & another ex parte Selex Sistemi Intergrati [2008]eKLR inRepublic v Public Procurement Administrative Review Board & another ex parte Kleen Homes Security Services Limited [2017] eKLR.

1st Interested Party: 24. The 1st interested party submitted that the question of time taken by an administrator to investigate and reach a decision has to take into consideration all factors as set out in Telecommunications Research & Action Center vs FCC as cited with approval in Judicial Service Commission v Davis Gitonga Karani[2020] eKLR“In the context of a claim of unreasonable delay, the first stage of judicial inquiry is to consider whether the agency’s delay is so egregious as to warrant mandamus.” The court then enumerated several factors, to consider when answering this question. These are-i.The time agencies take to make decisions must be governed by a rule of reasons.ii.Where Parliament has provided a timetable or other indication of the speed with which it expects the agency to proceed in the enabling statute, that statutory scheme may supply content for his rule of reason.iii.Delays that might be reasonable in the sphere of economic regulation are less tolerable when human health and welfare are at stake.iv.The court should consider the effect of expediting delayed action of agency activities of a higher or competing priority.v.The court should also take into account the nature and extent of the interests prejudiced by delay; andvi.The court need not find any impropriety lurking behind agency lassitude in order to hold that agency action is unreasonably delayed.”

25. The 1st interested party further submitted that the delay was reasonable because the respondent is a fairly new public office, stating that the financial and human resources required to investigate and make a decision within the statutory timelines are strained and the parties to the investigation have to respond to the investigative authorities within shorter timelines.

2ndInterested Party: 26. The 2nd interested party urged this court to adopt a purposive interpretation of section 56 of theAct. Indicating that the key point should be to ascertain when the elements of a pleadable claim came to existence, to warrant an investigation and a decision from the respondent.

27. The 2nd interested party cited the cases of Central Electrical Board v Halifax Corporation [1963] AC 785 and Elijah Sikona & George Pariken Narok on behalf of Trusted Society of Human Rights Alliance v Mara Conservancy & 5 others [2014] eKLR.

Analysis and Determination: 28. I have carefully considered the application, the affidavits on record and after a careful consideration of the respective submissions, case law and the relevant law, I have identified the following issues for determination:- A.Whether the preliminary objection is sustainable in law.

B.Whether the ODPC acted in excess of jurisdiction or power conferred under the Data Protection Act.

C.Whether the other reliefs sought have been proven.

Whether the Preliminary Objection is Sustainable in Law: 29. In Civil Suit No 85 of 1992, Oraro v Mbaja [2005] 1 KLR 141, Ojwang J (as he then was), cited with approval the position in Mukisa Biscuit Manufacturing Co Ltd v West End Distributors Ltd [1969)EA and stated as follows on the operation of preliminary objection: -“…. I think the principle is abundantly clear. A “preliminary objection”, correctly understood, is now well identified as, and declared to be a point of law which must not be blurred with factual details liable to be contested and in any event, to be proved through the processes of evidence. Any assertion which claims to be a preliminary objection, and yet it bears factual aspects calling for proof, or seeks to adduce evidence for its authentication, is not, as a matter of legal principle, a true preliminary objection which the court should allow to proceed.”

30. The issue oflocus standi raises a point of law that touches on the capacity to institute this suit, and it should be resolved at the earliest opportunity. Locus standi is defined inBlack’s Law Dictionary, 9th Edition (page 1026) as “the right to bring an action or to be heard in a given forum”.

31. In the case of Mumo Matemu v Trusted Society of Human Rights Alliances & 5 others (2014)eKLR, where the Court held that;“It is proper to note that the evaluation oflocus ought to be based upon the constitutional consideration of capacity (articles 3, 22 and 258, the nature of the suit and the enforceability of the orders sought. These considerations inform the enforcement mechanisms and coherent clarity of the following inquiries. Who will the orders be enforced against? Who bears the costs of litigation if at all? Who represent the parties in court?”

32. In the case of Law Society of Kenya v Commissioner of Lands & Others, Nakuru High Court Civil Case No 464 of 2000, the court held that;-“locus standi signifies a right to be heard, a person must have sufficiency of interest to sustain his standing to sue in court of law”.

33. Further in the case ofAlfred Njau & others v City Council of Nairobi (1982) KAR 229, the court also held that; - “The term locus standi means a right to appear in court and conversely to say that a person has no locus standi means that he has no right to appear or be heard in such and such proceedings”.

34. It is therefore evident that locus standi is the right to appear and be heard in court or other proceedings. Therefore if a party is found to have nolocus standi, then it means he/she cannot be heard even on whether or not he has a case worth listening to. It is further evident that if this court was to find that the applicant has no locus standi, then the applicant cannot be heard and that point alone may dispose of the suit.

35. In the case of Quick Enterprises Ltd v Kenya Railways Corporation, Kisumu High Court Civil Case No 22 of 1999, the court held that:-“When preliminary points are raised, they should be capable of disposing the matter preliminarily without the court having to resort to ascertaining the facts from elsewhere apart from looking at the pleadings alone”.

36. In the instant case I find that the applicants certainly had the necessarylocus to lodge and sufficient interest in these proceedings given that they were intertwined in such an intricate manner as a result of the nature and form of a law firm and the client advocate fiduciary relationship. They owed a duty of care towards one another when it came to the issue of data privacy.

37. Consequently, the notice of preliminary objection falls by the wayside in the same is here by dismissed.

Whether the Odpc Acted In Excess of Jurisdiction or Power Conferred under the Data Protection Act. 38. It is not contested that the complaint herein was lodged on July 20, 2022. Pursuant to the provisions of section 56(5), the respondent was bound to investigate and conclude within ninety (90) days from July 20, 2022 that is to say by October 18, 2022.

39. Jurisdiction is everything, it is what gives a court or a tribunal the power, authority and legitimacy to entertain a matter before it. A decision made by a court of law without jurisdiction is a nullity ab initio, and such a decision is amenable to setting asideex debito justitiae.

40. The locus classicus case on jurisdiction is the celebrated case of Owners of the Motor Vessel ‘Lillian S’ v Caltex Oil (Kenya) Ltd [1989] KLR 1 in which Nyarangi, JA, (as he then was), relying, inter alia, on a treatise by John Beecroft Saunders titled “Words and Phrases Legally Defined” held as follows: -“…Jurisdiction is everything. Without it, a court has no power to make one more step. Where a court has no jurisdiction, there would be no basis for a continuation of proceedings pending other evidence. A court of law downs tools in respect of the matter before it the moment it holds the opinion that it is without jurisdiction.”

41. In Samuel Kamau Macharia & another v Kenya Commercial Bank Limited & 2 others[2012] eKLR, Application No 2 of 2011, the Supreme Court held as follows on jurisdiction:“[68]. A court’s jurisdiction flows from either the Constitution or legislation or both. Thus, a court of law can only exercise jurisdiction as conferred by the Constitution or other written law. It cannot arrogate itself jurisdiction exceeding that which is conferred upon it by law.”

42. The applicants contend that the respondent lacked jurisdiction to make a determination of the complaint under section 56(5) of the Data protection Act that expressly provides that:-“(5)A complaint made to the Data Commissioner shall be investigated and concluded within ninety days.”

43. This court in its decision in JR No E1155 of 2020, Republic v Public Procurement Administrative Review Board & 2 others ex parte Express Automation Limited (unreported) while addressing its mind on the issue of timelines cited the Court of Appeal decision in Civil Appeal No E039 of 2021, Aprim Consultants v Parliamentary Service Commission & another where the court held as follows;“Our reading of the Act is that the High Court was under an express duty to make its determination within the time prescribed. During such time did its jurisdiction exist, but it was a time bound jurisdiction that ran out and ceased by effluxion of time. The moment the 45 days ended, the jurisdiction also ended. Thus any judgement returned outside time would be without jurisdiction and therefore a nullity, bereft of any force of law.That legal conclusion remains irrespective of the avowed reasons, no matter how logical, sound, reasonable or persuasive they may be. No amount of policy, wisdom or practicality can invest a decision made without jurisdiction with any legal authority.’’

44. Further, the Court of Appeal overturned the High Court decision delivered 185 days outside the 45 days stipulated in section 175 of the Public Procurement and Asset Disposal Act. It described the High Court judgment as a nullity holding the court’s jurisdiction is time bound, so it lapsed with the effluxion of the 45 days.

45. So, what is the effect of the exceeded timelines? As held by this court in Kenya Power & Lighting Co v Public Procurement Administrative Review Board (Judicial Review Application 46 of 2020) [2022] KEHC 496 (KLR), the effect of this matter having surpassed the timelines within which this court is obligated by law to conclude the same is that the court is divested of jurisdiction to entertain the matter any further.

46. This has also been emphasized in the case of Harun Meitamei Lempaka v Lemanken Aramat v Lempaka & 2 others[2014] eKLR where the Supreme Court rendered itself thus:-“We have to note that the electoral process, and the electoral dispute-resolution mechanism in Kenya, is marked by certain special features. A condition set in respect of electoral disputes, is the strict adherence to the timelines prescribed by the Constitution and the electoral law. The jurisdiction of the court to hear and determine electoral disputes is inherently tied to the issue of time, and a breach of this strict scheme of time removes the dispute from the jurisdiction of the court”.

47. I associate myself with the decision of the Court of Appeal (Kiage, JA) in Nicholas Kiptoo Arap Korir Salat v Independent Electoral and Boundaries Commission & 6 others [2013] eKLR that:“I am not in the least persuaded that article 159 of the Constitution and the oxygen principles which both command courts to seek to do substantial justice in an efficient, proportionate and cost-effective manner and to eschew defeatist technicalities were ever meant to aid in the overthrow or destruction of rules of procedure and to create an anarchical free-for-all in the administration of justice. This court, indeed all courts, must never provide succour and cover to parties who exhibit scant respect for rules and timelines. Those rules and timelines serve to make the process of judicial adjudication and determination fair, just, certain and even-handed. Courts cannot aid in the bending or circumventing of rules and a shifting of goal posts for, while it may seem to aid one side, it unfairly harms the innocent party who strives to abide by the rules. I apprehend that it is in the even-handed and dispassionate application of rules that courts give assurance that there is clear method in the manner in which things are done so that outcomes can be anticipated with a measure of confidence, certainty and clarity where issues of rules and their application are concerned.”

48. In the case of Hassan Ali Joho & another v Suleiman Said Shahbal & 2 others [2014]eKLR where the Supreme Court of Kenya observed in dealing with the question of timelines dictated by the Constitution and the Elections Act citing the Court of Appeal case, of Ferdinand Waititu v Independent Electoral and Boundaries Commission, (IEBC) & 8 others, Civil Appeal No 137 of 2013 which provided as follows:“These timelines set by the Constitution and the Elections Act are neither negotiable nor can they be extended by any court for whatever reason. It is indeed the tyranny of time, if we may call it so. That means a trial court must manage the allocated time very well so as to complete a hearing and determine an election petition timeously.”

49. The need to adhere to the constitutional timeframes was also emphasized in the cases of Martha Wangari Karua v Independent Electoral and Boundaries Commission & 3 others[2019] eKLR andEvans Odhiambo Kidero & 4 others v Ferdinard Ndungu Waititu & 4 others, SC Pet No 20 of 2014; [2014] eKLR.

50. Accordingly, it therefore follows that, as at the time of determination, January 6, 2022, the period within which the respondent had to investigate and determine the complaint had already lapsed.

51. I am in agree with applicants that pursuant to the provisions of section 56(5) of the Act the ODPC had a time-bound jurisdiction to investigate and determine the complaint. When the 90 days’ period ended, the respondent jurisdiction also came to an end by way effluxion of time.

52. Courts and tribunals cannot flout the timelines expressly provided for in law.

53. The moment the 90 days ended, the respondents jurisdiction also lapsed. The finding that was rendered outside time was without jurisdiction and therefore a nullity, bereft of any force of law.

54. Guided by the Supreme Court Judgment in the case SC Petitions 39 & 40 of 2019 Praxidis Namoni Saisi & 7 Others V DPP & 2 Others unlike the traditional Kenyan dispute resolution mechanisms like the court, the ODPC does not rely on the evidence produced by parties in making its decision. The ODPC has investigatory powers call for or collect and use more evidence before arriving at a finding.

55. Through Oscar Onyango Otieno the Deputy Data Commissioner’s in Paragraph 15 to 20 of his affidavit dated 15. 3.23 the Respondent admits that its finding was rendered out of time. He however proceeds to blames the Applicant for the delay in keeping time.

56. Two wrongs cannot make a right in law. The respondent cannot be heard to blame the applicant since it lacked the legal authority enlarge time.

57. In paragraph 17 of the said affidavit, the respondent is inviting the court to consider the intention of the statutes by applying a purposive interpretation to the issue of timelines.

58. The court is of the firm view that where the Constitution or a statute has provided or set a strict time for the delivery of a judgment or a finding then the High Court cannot be called upon to apply a purposive interpretation of the law to enlarge time. Such an approach would be an affront of article 10 of the Constitution and in particular the rule of law.

59. Enlarging time in such a terrain would most certainly prejudice and or disadvantaged one or the other parties in the dispute. The respondents jurisdiction lapsed on the ninetieth day from the day the complaint is lodged.

60. This court lacks the constitutional power to breathe life into a finding that has been arrived at ultra vires under article 165 of the Constitution and I so hold.

61. From the record it can be gleaned that the ODPC acted procedurally within the principles of fair hearing in granting the parties patience and latitude to file documents out of time which promoted the right to fair hearing under article 50 of the Constitution.

62. This court further notes that at paragraph 20 of the replying affidavit the respondent is urging the court to consider the compelling circumstances that existed at the time when it considered the complaint out of time. It is this court’s finding that no amount of compulsion, pressure or threats should be brought to bear on the ODPC to the extent of rendering a finding out of time.

63. Having arrived at the foregoing finding, then the other grounds that have been raised by the Applicants will not affect this courts’ finding on this issue of jurisdiction.

64. Informed by the orders that this court will give, the court will not delve into the other issues raised by the parties in their affidavits or their submissions. To do so will compromise the parties’ respective cases.

Who Can Lodge A Complaint Before The ODPC? 65. Article 31(c) & (d) of the Constitution provides that every person has the right to privacy, which includes the right not to have information relating to their family or private affairs unnecessarily required or revealed; and the privacy of their communications infringed.

66. The Data Protection Act is an Act of Parliament that gives effect to article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner to make provision for the regulation of the processing of personal data and to provide for the rights of data subjects and obligations of data controllers and processors and for connected purposes.

67. The Act then defines a “data subject” as an identified or identifiable natural person who is the subject of personal data. It further defines an “identifiable natural person” as a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity.

68. Article 260 of the Constitution defines a person “person” includes a company, association or other body of persons whether incorporated or unincorporated.

69. From the Act it is evident that companies, limited liability partnerships, and other legal entities are not considered data subjects. As such, legal entities cannot bring complaints to the Commissioner.

70. According to section 3 of the Act, the object and purpose of this Act is—(a)To regulate the processing of personal data;(b)To ensure that the processing of personal data of a data subject is guided by the principles set out in section 25;(c)To protect the privacy of individuals;(d)To establish the legal and institutional mechanism to protect personal data; and(e)To provide data subjects with rights and remedies to protect their personal data from processing that is not in accordance with this Act.

71. The applicants are partners in the 3rd applicants law firm. i am satisfied that the applicants had the capacity to lodge a complaint with the ODPC under theData Protection Act.

Disposition: 72. The decision of the Data Protection Commission dated January 6, 2023 was rendered outside time without jurisdiction and therefore a nullity. The moment the 90 days ended, the respondents’ jurisdiction lapsed. This court cannot countenance nor flout mandatory timelines that have been expressly provided for in law.

73. No matter how logical, sound, reasonable or persuasive the respondents’ finding is, the same is standing on quick sand. No amount of policy, wisdom or practicality can invest a decision made without jurisdiction with any legal authority nor generate any enforceable outcomes. It remains a still birth at law.

74. This court’s power and authority flows from the Constitution and the Fair Administrative Action Act. Section 11(1)(h) of the Fair Administrative Action Act provides that in proceedings for judicial review under section 8, the court may grant any order that is just and equitable, including an order remitting the matter for reconsideration by the administrator.

75. An order of mandamus compelling the respondent to readmit for fresh investigations the complaint dated July 20, 2022 by the applicants within 30 days from the date of readmission will promote the right to access to justice and uphold the rule of law as guaranteed under article 10 of the Constitution commends itself.

76. In prayer D of the application, the applicants sought for a declaration that the decision by the respondent made on January 6, 2023, violated the applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider the applicants evidence that had been submitted.

77. This relief can only be conclusively determined after an in-depth analysis of the merits of the case. This court will not delve into that arena since doing so would amount to the usurpation of the role of the Office of the Data Protection Commission and the Court of Appeal.

78. I am of the considered view and I so hold that the right to fair administrative Action under article 47 of the Constitution will be promoted if the complaint is reconsidered.

Orders: 1. An order of certiorari is hereby issued to remove to this court for of quashing the decision of the office of the Data Protection Commission dated January 6, 2023,in respect of the Reference No Odpc/conf/1/5/v01 1(112), Odpc Complaint No 677 of 2022 Allen Waiyaki Gichuhi & Charles Wambugu Wamae v Florence Mathenge and Ambrose Waigwa.

2. Prayer D is disallowed.

3. Prayer E,F and G are granted as prayed.

4. An order of mandamus is hereby issued compelling the respondent to readmit for fresh investigations the applicants complaint dated July 20, 2022.

5. The respondent shall complete the fresh investigations within 30 days from the date of readmission.

6. Costs to the applicants.

DATED, SIGNED AND DELIVERED AT NAIROBI THIS 12TH DAY OF MAY 2023J. CHIGITI (SC)JUDGE