[2023] KEHC 23661 (KLR)

Republic v Cabinet Secretary, Ministry of Transport, Infrastructure, Housing Urban Development, and Public Works & 2 others; Boyi (Exparte Applicant) (Miscellaneous Application E132 of 2022) [2023] KEHC 23661 (KLR) (Judicial Review) (12 October 2023) (Judgment)

Neutral citation: [2023] KEHC 23661 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Judicial Review

Miscellaneous Application E132 of 2022

JM Chigiti, J

October 12, 2023

Between

Republic

Applicant

and

Cabinet Secretary, Ministry of Transport, Infrastructure, Housing Urban Development, and Public Works

1st Respondent

Attorney General

2nd Respondent

Data Protection Commissioner

3rd Respondent

and

Humphrey Boyi

Exparte Applicant

Judgment

1. Pursuant to leave of court granted on 2nd September, 2022; the Applicant in his Substantive Notice of Motion dated 3rd September, 2022 – under Article 31 and 47 of the Constitution of Kenya, 2010, Sections 2 and 25 of the Data Protection Act, Act No. 24 of 2019, Section 8 & 9 of the Law Reform Act Cap 26 Laws of Kenya, Sections 7(1)(a) and 9(1) of the Fair Administrative Action Act, 2015, and Order 53 Rule 3 of the Civil Procedure Rules 2010 - seeks for:a.An order of Certiorari to bring to this court and quash the 1st Respondent's tender document described as No. Tihudpw/Sdhud/ SHSF/046/2021­2022. b.An order of Prohibition to prohibit and/ or restrain the 1st Respondent from signing any contract with respect to tender No. Tihudpw/Sdhud/CSHSF /046/2021-2022 for proposed supply, design, development, customization, installation, training, configuration, testing, commissioning and technical support of enterprise resource planning (ERP) information system with any successful bidder.c.An order of Mandamus do issue, directing the 3rd Respondent to prescribe and direct for the 1st Respondent the basic content of data protection for tender No. Mtihudpw /Sdhud/CSHSF/046/2021-2022, to include designation of a Data Processor, protection of Data Subjects, Encryption of the subject Tender for the ERP, inclusion of Data Collection protocols, Data Storage Protocols and recognition of Data Controllers as a prerequisite for bidders.d.That costs of this Application be borne by the Respondents.

2. The Application is supported by a verifying Affidavit deponed by Humphrey Boyi - who identifies himself as a citizen of Kenya, and a Statutory Statement both dated 30th August, 2022.

3. In sum, the Applicant’s case is that the successful bidder (in tender No. Mtihudpw /Sdhud/CSHSF/046/2021-2022) would be a Data Controller within the meaning of the Data Protection Act. The bidders were required to comply with mandatory documentation and technical requirements.

4. Essentially, bidders were to provide tools to perform data conversion and migration services. However, as per the Applicant, the tender bidding documents failed to require data protection compliance by the bidders such as to ensure personal data is processed in accordance with the right to privacy of the data subject, and processed lawfully, fairly and in a transparent manner in relation to any data subject as per the provisions of Section 25 of the Data Protection Act.

5. Notably, according to the Applicant, the tender bidding documents, in contravention of the Data Protection Act No. 24 of 2019 and in particular Section 8(1) thereof, failed to require data protection compliance of the system or user by:i.The bidders being asked to appoint Data Processors in their bid;ii.Did not prescribe an electronic filing system;iii.Did not set out the scope of Data Processing by the System or Users in keeping with Section 2 of the Data Protection Act;iv.Did not set out system parameters for profiling Data Subjects;v.Did not make provision for pseudonymization of personal data;vi.Did not make provision for restriction of processing data, posing a national security risk;vii.Did not make provision in the system or users of the system on how to profile sensitive personal data; andviii.Did not make provision for scope of processing of data by third party user

6. Additionally, it was claimed by the Applicant that the failure to provide for data protection compliance in the tender bidding documents: violates the right to privacy of data subjects under Article 31 of the Constitution of Kenya, is materially influenced by an error of law, is influenced by ulterior motive or purpose calculated to prejudice the legal rights of the data subjects, is bad in faith and an abuse of discretion.

7. Therefore, to the Applicant the 1st Respondent's actions: are illegal, irrational, and improper for failure to require data protection compliance in the bid documents. Also, that the 1st Respondent's conduct is bad in law, illegal, and against the principle of good governance integrity, transparency, accountability, and sustainable development with the objective of infringing the legal rights of data subjects.

8. The Applicant maintains that in the event that the Orders herein sought are not granted, the 1st Respondent will proceed to perpetuate an illegality and prejudice the Applicant as well as other data subjects to the detriment of their fundamental rights and freedoms.

9. In response, and in opposition to the Application, the 1st Respondent filed a Replying Affidavit dated 22nd November, 2022 deponed by Charles M Hinga, the Principal Secretary of the State Department for Housing and Urban Development.

10. The 1st Respondent avers that the it (State Department) used the standard procurement and asset disposal documents prescribed by the Public Procurement Regulatory Authority, while floating this subject tender. Therefore, the bidders who submitted their bids in response were duly evaluated in accordance with the dictates of the Public procurement and Asset Disposal Act (PPADA)2015 and the attendant Regulations.

11. It was stated that the procedures that were being undertaken by the 1st Respondent (State Department) at that point in time, was to gauge the technical and financial capability of the bidders who had submitted their bids in accordance with the parameters laid out.

12. It was maintained, that in Section B of the bid document, provided for functional, architectural, and performance requirements of the information system. In addition, a bidder was supposed to enlist the legal and regulatory requirements that were to be met by the information system, noting that the information system was to comply with the relevant legal and regulatory norms.

13. Additionally, it was averred that the bidder was also required to summarize each relevant legal code and regulations that were to govern the business processes and procedures that will be automated in the information system. That the 1st Respondent did not make any exemption to the Data Protection Act, 2019 or any other laws.

14. It was the Applicant’s position that the stages being undertaken were preliminaries to the eventual preparation and signing of a contract with the successful bidder. That it is in the crystallized contract that fuller and specific obligations of the parties would be captured including the statutory obligations that each party was to adhere to.

15. According to the 1st Respondent, the legal, regulatory, and normative context of the information system being procured had been laid out, though not with specifics but with sufficient information to guide on the legal environment it was to operate in was availed. This was to ensure that each bidder had a sense of any legal burden that could arise and eventually its impact on the costing, hence a possible guide how a bidder could state its financial bid.

16. To the 1st Respondent, it would be erroneous, and burdensome to ask the bidders to appoint data processors amongst other obligations at this point in time. That very bidder would not be held as successful as per the requirements of PPADA ,2015 and doing so would be contrary to Constitutional principles on Public Procurement under Article 227(1) that is fair. equitable, transparent, competitive, and cost effective.

17. In the circumstances, the 1st Respondent strongly denies the allegations raised by the Applicant, and holds them as premature, ill motivated, untenable, and without any legal basis. There is no assertion as to how the 1st Respondent has failed to comply with the requirements of the Data Protection Act, and the Applicant is put to strict proof thereof.

18. As per the 1st Respondent, the matter as presented is premature as the Applicant has not exhausted the alternative dispute resolution mechanisms as provided by the provisions of Sections 56 and 57 of the Data Protection Act, 2019. Also that the right to privacy as under Article 31 of the Constitution of Kenya, as claimed to be violations, is unsubstantiated.

19. Accordingly, that the Application is mere generalities, meant to frustrate a legally grounded procurement process without appreciating its graduated stages. Therefore, the 1st Respondent beseeched this court to dismiss the Application with costs.

20. Further, in opposing the Application, the 3rd Respondent filed their Grounds of Opposition, and a Notice of Preliminary Objection both dated 12th September, 2023.

21. The Grounds of Opposition was based on grounds that:1. This Honourable Court lacks jurisdiction to hear and determine the Application.2. The Applicant has not produced any proof that the complaint process at pages 28, 38 & 161 of the tender document have been exhausted.3. The Applicant has not exhausted the alternative dispute resolution mechanisms laid out in Sections 56 and 57 of the Data Protection Act, 2019. 4.The entity with the statutory duty to review and adjudicate on tendering and asset disposal disputes is the Public Procurement Administrative Review Board established under Section 27 (1) of the Public Procurement and Asset Disposal Act, 2015. 5.The Applicant has no locus standi to institute the instant Judicial Review Application.6. The Public Procurement and Asset Disposal Act, 2015 is not part of the laws affected by the consequential amendments under both the Second schedule and Section 75 of the Data Protection Act, 2019. 7.Stricto sensu, data protection compliance is a process, not an event; hence a question that can be raised directly by the 3rd Respondent's Office even after the tender process, in line with the provisions of Section 8 and 9 of the Data Protection Act, 2019. 8.The Applicant has not furnished any proof or evidence of the violation of the right to privacy under Article 31 of the Constitution of Kenya, 2010 as alleged.9. The instant Application is therefore frivolous, vexatious, incompetent and an abuse of the court process.

22. While, the Notice of Preliminary Objection was based on grounds that:1. The honourable Court lacks jurisdiction to determine the application;2. The Applicant herein lacks locus standi to file the judicial review application;3. This matter violates the doctrine of exhaustion in so far as it relates to data privacy dispute;4. The impugned tender document is compliant with the Data Protection Act,2019 and the Public Procurement and Assets Disposal Act, 2015;5. The Application is an abuse of the court process.

23. To advance their cases, the parties filed their respective written submissions. The Applicant, supporting the Application in their submissions dated 30th August, 2023 in sum submits that, based on Section 8 and 9 of the Fair Administrative Action Act, this Honourable Court has jurisdiction to entertain the judicial review application by the Ex-parte Applicant for reasons that the matter relates to an erroneous and unlawful administrative action by the 1st Respondent; In particular, failure to provide for data protection compliance in the tender bidding documents thus, violating and or threatening the right to privacy of data subjects under Article 31 of the Constitution of Kenya, a decision materially influenced by an error of law.

24. Further, that the failure to provide for data protection compliance in the tender bidding documents is influenced ulterior motive or purpose calculated to prejudice the legal rights of the data subjects, in bad faith, and an abuse of discretion. Also, that this error of law by the 1st Respondent is as a result of abdication of the duties of the 3rd Respondent set out at Section 8(1)(a) of the Fair Administrative Action Act, 2015.

25. Additionally, it is contended that this Honourable Court has jurisdiction under Article 165 of the Constitution of Kenya to determine the question whether a right or a fundamental freedom in the Bill of rights has been violated, denied, infringed, or threatened as is in this case. Reliance was placed on the case of R v Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology & 2 others (Judicial Review Application E1138 of 2020) [2021] KEHC 122 (KLR) where the court entertained a judicial review application and, in the end, quashed the decision to roll out Huduma Cards for being ultra vires vide Section 31 of the Data Protection Act on data Protection impact assessment.

26. According to the Ex-parte Applicant the literal interpretation of the complaint process of the tender document excludes the Ex-parte Applicant from lodging a complaint using the laid-out procedure thereunder, as he was not a supplier who submitted a Tender. Therefore, the argument by the 3rd Respondent that he (Ex-parte Applicant) ought to have first exhausted the complaint process therein fails.

27. To the Ex-parte Applicant, the land 3rd Respondents argue that this Honourable Court lacks jurisdiction to entertain the Ex-parte Applicant's and argue that the provisions of Section 9(1)(2)63) & (4) of the Fair Administrative Action Act apply in so far as the principle of exhaustion of available remedies is concerned.

28. To controvert the said position, the ex-parte Applicant submit that the exceptional circumstances of this case qualify the Applicant to by-pass the exhaustion requirement. The Applicant posited that any other alternative dispute resolution mechanism would not serve the values of the Constitution, therefore making it necessary for (him) the ex-parte Applicant to invoke the jurisdiction of this Honourable Court. Relied on the case of Krystalline Salt Limited v Kenya Revenue Authority (2019) eKLR where a similar position was affirmed.

29. It was the Applicant’s submissions that power of the Data Protection Commissioner is limited to Section 9 of the Data Protection Act including conducting investigations and imposing administrative fines for failure to comply with the Data Protection Act; While on the other hand, functions of the Review Board under Section 28 of the Public Procurement and Asset Disposal Act are limited to hearing tendering and asset disposal Act.

30. However, that the ex-parte Applicant herein is seeking orders of certiorari to quash the tender document, prohibition to restraint the 1st Respondent from signing any contract with respect to the tender, and orders of Mandamus to direct the 3rd Respondent to prescribe for the 3rd Respondent the basic content of data protection for the tender.

31. To the Ex-parte Applicant it is then clear that the process of alternative dispute resolution mechanism under the tender document, Data Protection Act, and the Public Procurement and Asset Disposal Act are inadequate to grant the Ex parte Applicant the orders sought in manner of Article 47 of the Constitution. Reliance was placed on Republic v Dedan Kimathi University of Technology; Mutuku (Ex-parte) (Judicial Review E003 of 2021) case, where the court averted to apply the doctrine of exhaustion upon finding that the alternative dispute resolution mechanisms would not be an efficacious remedy to the Applicant therein.

32. Notably, the Ex-parte Applicant contended that it would be a contradiction in terms to initiate proceedings before the 3rd Respondent for her abdication of her statutory responsibilities and expect justice. It would be constituting her as a judge in her own cause. No fairness nor justice would be expected of her. This indeed would be one of those cases where provisions of the Data Protection Act would be inapplicable in as far as dispute resolution is concerned. Therefore, that it would be futile to pursue the alternative dispute resolution mechanisms when there is no guarantee for expeditious resolution of the matter or even granting the orders sought. Accordingly, that the resort to court in this case does not offend the doctrine of exhaustion.

33. On locus standi, it was stated, that the Applicant has an obligation to respect, uphold and defend the Constitution whenever it is under attack, in this case in his capacity as a potential data subject. The subject tender is for an Information System that would receive personal data of the members of the Public, and therefore qualifies as a matter of public interest. Reliance was placed on Article 22 and 23 of the Constitution, and on the case of Mumo Matemo -vs- Trusted Society of Human Rights Alliance & 5 Others as cited with approval in the case of Humphrev Makokha Nvongesa & another v Communications Authority of Kenya & 2 others (2018] eKLR where it was observed that in this border context, this court cannot fashion nor sanction an invitation to a judicial standard for locus standi that places hurdles on access to the courts except only when such litigation is hypothetical, abstract or is an abuse of the judicial process.

34. In further promoting his (Applicant’s) position, he relied on the case of Humphrev Makokha Nongesa & another v Communications Authority of Kenya & 2 others [2018] eKLR where the court in considering whether the matter was of public interest held that the same had to disadvantage or cause loss to the public, and that the subject tender document therein affects the general public and therefore, this means that it is matter of public importance which the Applicant herein qualifies to have locus standi.

35. It is therefore the duty of this court to determine whether the decision of the 1st Respondent to invite bidders to submit their tender bidding documents and failure by the Respondents to require data protection compliance by the bidders such as ensuring that personal data is processed in accordance with the right to privacy of the data subject and processed lawfully, fairly and in a transparent manner in relation to any data subject was ultra vires, influenced by an error of law, influenced by ulterior motive or purpose calculated to prejudice the legal rights of data subject. Relied on Article 10, 47 of the Constitution and Section7(2) of Fair Administrative Action Act.

36. The Ex-parte Applicant asserted that compliance with the Constitution and the Data Protection Act ought to be seen from the onset of the procurement process and not only at the implementation stage. Accordingly, that the application has met the threshold for grant of judicial review orders sought which are decisions materially influenced by an error of law, the administrative decision in issue was taken with an ulterior motive or purpose calculated to prejudice the legal rights of the Applicant and other Kenyans, was made in bad faith and is an abuse of discretion. Council for Civil Service Unions v Minister for Civil Service (1985) AC374 at 401 and in Pastoli v Kabale District Local Government Council & Others (2008) 2 EA 303 as cited with approval in the case of Republic v Technology (Judicial Review E002 of 2021) [2022] KEHC 494 (KLR) cases were relied upon.

37. In sum, the ex-parte Applicant submitted that he has demonstrated to have locus standi in this matter, and that the court has jurisdiction to entertain the Application. Also, has demonstrated to the required standard that the Application has met the threshold for grant of judicial review orders sought, and as such, prays that this Honourable Court grants the orders sought by him (the ex-parte Applicant) in the Notice of Motion application dated 30th August 2022. On cost, the Applicant submitted that the Respondent to bear the cost, or in the alternative each party to bear its own cost.

38. In buttressing their case, the 1st and 2nd Respondent filed their written submissions dated 23rd February, 2023 where they contend that the Applicant is neither a candidate nor a tenderer, and that the procurement does not affect him in anyway.

39. As per the 1st and 2nd Respondents, for an individual to have a locus standi, he must have an interest either vested some. Such interest must be above that of other members of the public in general. This position was also observed in the case of Khelef Khalifa El-Busaidy v Commissioner of Lands & 2 others [2002] eKLR

40. The 1st and 2nd Respondent submits that, the Applicant has failed to exhaust the remedies available to them under the Data Protection Act and the Public Procurement and Asset Disposal Act and therefore this court should not issue the orders prayed for. That the Applicant has not lodged an appeal against the alleged decision with the Data Commissioner as well as a Request for Review to the Public Procurement Administrative Review Board. As per Section 56 of the Data Protection Act, Section 27, 28, and 167(1) of the Public Procurement and Asset Disposal Act. In the circumstances, an application for judicial review to this court is barred by Section 9 (2) and (3) of the Fair Administrative Action Act, 2015 which is couched in mandatory terms; as observed in Republic v Kenyatta University Ex parte Ochieng Orwa Domnick & 7 others [2018] eKLR; and Republic v Firearms Licensing Board & another Ex Parte Stephen Vincent Jobling [2019] eKLR case.

41. It was posited that this honourable court should adopt a similar construction and hold that the Applicant ought to have first exhausted the appeal mechanism provided for in Section 56 of the Data Protection Act and his failure must be visited on him by dismissing the suit. That courts must not be burdened with matters where the law has provided alternative mechanisms for dispute resolution.

42. That the court should satisfy itself that such mechanisms have been tried and failed. only then can a party be justified in bringing a Judicial Review application. The Applicant has not appealed to the Data Commissioner neither has he applied for exemption from the requirement of exhaustion of alternative remedies. This Application is therefore bad in law should fail.

43. It was submitted that it is incumbent upon a party in a judicial review application who seeks the issuance of any of the orders to proof breach for that party to succeed in their claim. This has not been done by the Applicant and thus the Application fails.

44. That the 1st Respondent has done all that is required under the law and thus the prerogative orders sought ought to fail to issue. The application does not meet the basic tenets of judicial review application and should be dismissed with costs to the 1st and 2nd Respondent.

45. The 3rd Respondent, in buttressing their case, filed written submissions dated 24th April, 2023. It was posited that the Applicant is neither a candidate (bidder) or tenderer in the alleged impugned tender process, thus lacks locus to institute the current proceedings. That the instant Application is a veiled Public Interest Litigation suit.

46. That the definition of a person excludes any pass-by who is disgruntled with a decision; and that issue of locus standi raises a point of law which touches on the jurisdiction of the court, and it should be resolved at the earliest opportunity. Relied on case of Law Society of Kenya v Communications Authority of Kenya & 10 others, Petition No. 8 of 2020, and Mumo Matemu v Trusted Society of Human Rights Alliance & 5 others [2014] eKLR.

47. The 3rd Respondent asserts that it was neither a party to the tendering process, nor had any mandate in the procurement process. Its purported joinder, thus finds itself with no legs to stand on. This Honourable Court is subsequently invited to expunge the 3rd Respondent, as a substantive party from the proceedings. Also, that the deliberate omission of Public Procurement Regulatory Authority, and the Public Procurement Administrative Review Board, further speaks volumes to the Applicant's efforts to mislead this Honourable Court.

48. It was the 3rd Respondent’s submissions that Sections 9(2) and (3) of the Fair Administrative Actions Act, 2015 requires a party to exhaust internal mechanisms for appeal or review and all remedies available before seeking judicial review orders. Relied on East Africa Pentecostal Churches Registered Trustees & 1754 others v Samuel Muguna Henry & 4 others (2015) eKLR where a statute establishes a dispute resolution procedure it must be strictly followed.

49. To the 3rd Respondent, the Applicant has not advanced any evidence to prove that the adequacy or availability of the stipulated mechanisms was and/or is wanting to warrant the creation of an exceptional case that allows this Honourable Court to intervene. Similarly, that the Public Procurement and Asset Disposal Act; 2015 is not part of the laws affected by the consequential amendments under the Second schedule and Section 75 of the Data Protection Act, 2019.

50. On the compliance of the tender biding documents, the 3rd Respondent holds the position that data protection compliance is a process, not an event. Compliance issues can thus be raised directly to the 3rd Respondent's Office, even after the tender process, in line with the provisions of Section 8 and 9 of the Data Protection Act, 2019. Therefore, that the instant Application is premature and this court should find so.

51. The Applicant has not showed that his right to privacy, alleged to be infringed, as well as the basis of each of his grievance. Moreover, that no evidence has been adduced to qualify the said violations. The Applicant has simply quoted the constitutional provision on the right to privacy, without elaborate particulars of the said violation. Thus, that the Application lacks merit, is premature, and not brought in bad faith; hence the same should be dismissed with cost.

Analysis and Determination 52. I have considered the pleadings and the parties’ cases together with the cited authorities. The following issues crystalize for determination:i.Whether the Applicant has locus standi in this matterii.Whether the doctrine of exhaustion applies to this case, andiii.Whether the orders sought are merited.

53. It is important to appreciate that lack of capacity to sue or be sued is a weighty matter that goes to the root of the validity of proceedings before a court. It is not a mere procedural issue. The consequences of instituting a suit without legal capacity to sue are grave. Such a suit is incompetent and any proceedings flowing from it are a nullity in law.

54. On the first issue, locus standi;In Apex Finance International Limited and Another v Kenya Anti-Corruption Commission NKU HC JR No. 64 of 2011[2012] eKLR, the court cited a decision of the Supreme Court of Nigeria, Goodwill and Trust Investment Ltd and Another v. Witt and Bush Ltd Nigerian SC 266/2005 which captured the fundamental nature of the issue of capacity. The court observed that:“It is trite law that to be competent and have jurisdiction over a matter, proper parties must be identified before the action can succeed, the parties to it must be shown to be proper parties whom rights and obligations arising from the cause of action attach. The question of proper parties is a very important issue which would affect the jurisdiction of the suit in limine. When proper parties are not before the court the court lacks jurisdiction to hear the suit, and, “where the court purports to exercise jurisdiction which it does not have, the proceedings before it, and its judgment will amount to a nullity no matter how well reasoned.”

55. In the case of John Githinji Wang’ondu versus Raphael Gitau Njau et al, Civil Appeal No. 241 of 1997 [1997 LLR 6700 the court hastened to add, the question of standing before court is not a mere technicality as it touches on the substance of the claim and a fundamental flaw if not addressed before parties file their claims. Standing before court goes to the root of the matter as where a wrong party is brought to court, then that is the injustice not curable by any Constitutional provision looking at the Constitutional preamble to the last Article.

56. Further, Section 167 (1) of the Public Procurement and Asset Disposal Act, 2015 provides that Subject to the provisions of this Part, a candidate or a tenderer, who claims to have suffered or to risk suffering, loss or damage due to the breach of a duty imposed on a procuring entity by this Act or the Regulations, may seek administrative review within fourteen days of notification of award or date of occurrence of the alleged breach at any stage of the procurement process, or disposal process as in such manner as may be prescribed.

57. While Section 2 of The Public Procurement and Asset Disposal Act, 2015 defines a "candidate" means a person who has obtained the tender documents from a public entity pursuant to an invitation notice by a procuring entity; “tender” means an offer in writing by a candidate to supply goods, services or works at a price; or to acquire or dispose stores, equipment or other assets at a price, pursuant to an invitation to tender, request for quotation or proposal by a procuring entity; “tenderer” means a person who submitted a tender pursuant to an invitation by a public entity; Republic vs Independent Electoral & Boundaries Commission & 2 Others (2017) eKLR where it was held that persons who do not fall in the category of persons contemplated in Section 167 (1) have no locus standi to commence review proceedings.

58. The same position was restated in Philip Nyandieka (Suing on own behalf and on behalf of the general public) -vs- National Government CDF - Bomachoge Borabu constituency (20191 eKLR and also in the Court of Appeal case in Al Ghurair Printing and Publishing LLC vs Coalition for Reform & Democracy (2017) eKLR.

59. Consequently, the Applicant lacks the locus standi to institute judicial Review Proceedings under Public Procurement and Asset Disposal Act, 2015 in particular, under Section 167(1) since he was neither a candidate nor tenderer in the Tender floated by the 1st Respondent. Therefore, the provisions of Public Procurement and Asset Disposal Act fail to apply in this case.

60. However, another dimension to the issue of jurisdiction flows from the Fair Administrative Action Act, 2015. The Applicant argues that he has access to the judicial review jurisdiction of the court. In the heading of the Notice of Motion it can be gleaned that he has invoked Sections 7(1) and 9(1) of Fair Administrative Action Act, 2015.

61. Section 7 of The Fair Administrative Action Act, 2015 provides for the institution of judicial review proceedings as follows: -“(1)Any person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision to–a.A court in accordance with Section 8; orb.A tribunal in exercise of its jurisdiction conferred in that regard under any written law.”

62. Section 9 of The Fair Administrative Action Act, 2015 provides for the procedure for judicial review as follows: -“(1)Subject to subsection (2), a person who is aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of any administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to Article 22(3) of the Constitution.

63. Having invoked the provisions of the Fair Administrative Act, Law Reform Act, and Civil Procedure Rules, I find that the Applicant has standing/ locus standi to institute Judicial Review Proceedings for prerogative orders.

64. On the second issue, doctrine of exhaustion;Section 9 of The Fair Administrative Action Act, 2015 provides for the procedure for judicial review as follows: -“(1)Subject to subsection (2), a person who is aggrieved by an administrative action may, without unreasonable delay, apply for judicial review of any administrative action to the High Court or to a subordinate court upon which original jurisdiction is conferred pursuant to Article 22(3) of the Constitution.(2)The High Court or a subordinate court under sub-Section (1) shall not review an administrative action or decision under this Act unless the mechanisms including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted.(3)The High Court or a subordinate Court shall, if it is not satisfied that the remedies referred to in subsection (2) have been exhausted, direct that Applicant shall first exhaust such remedy before instituting proceedings under sub-Section (1).(4)Notwithstanding subsection (3), the High Court or a subordinate Court may, in exceptional circumstances and on application by the Applicant, exempt such person from the obligation to exhaust any remedy if the court considers such exemption to be in the interest of justice.”

65. Under Section 9 (3) the High Court or a subordinate Court shall, if it is not satisfied that the remedies referred to in subsection (2) have been exhausted, direct that Applicant shall first exhaust such remedy before instituting proceedings under sub-section (1).

66. Section 9 (4) stipulates that, notwithstanding subsection (3), the High Court or a subordinate Court may, in exceptional circumstances and on application by the Applicant, exempt such person from the obligation to exhaust any remedy if the court considers such exemption to be in the interest of justice.

67. In Jeremiah Memba Ocharo v Evangeline Njoka & 3 others [2022] eKLR the Court dealt with the exceptions to the doctrine of exhaustion. It expressed itself as follows: -“59. However, our case law has developed a number of exceptions to the doctrine of exhaustion. In Republic v Independent Electoral and Boundaries Commission [IEBC] Ex Parte National Super Alliance (NASA) Kenya & 6 Others [2017] after exhaustively reviewing Kenya's decisional law on the exhaustion doctrine, the High Court described the first exception thus: “What emerges from our jurisprudence in these cases are at least two principles: while, exceptions to the exhaustion requirement are not clearly delineated, Courts must undertake an extensive analysis of the facts, regulatory scheme involved, the nature of the interests involved – including level of public interest involved and the polycentricity of the issue (and hence the ability of a statutory forum to balance them) to determine whether an exception applies. As the Court of Appeal acknowledged in the Shikara Limited Case (supra), the High Court may, in exceptional circumstances, find that exhaustion requirement would not serve the values enshrined in the Constitution or law and permit the suit to proceed before it. This exception to the exhaustion requirement is particularly likely where a party pleads issues that verge on Constitutional interpretation especially in virgin areas or where an important constitutional value is at stake.” See also Moffat Kamau and 9 others vs Aelous (K) Ltd and 9 others.)

68. As observed above, the first principle is that the High Court may, in exceptional circumstances consider, and determine that the exhaustion requirement would not serve the values enshrined in the Constitution or law and allow the suit to proceed before it. It is also essential for the Court to consider the suitability of the appeal mechanism available in the context of the particular case and determine whether it is suitable to determine the issues raised.

69. The second principle is that the jurisdiction of the Courts to consider valid grievances from parties who lack adequate audience before a forum created by a statute, or who may not have the quality of audience before the forum which is proportionate to the interests the party wishes to advance in a suit must not be ousted.

70. The rationale behind this precept is that statutory provisions ousting Court’s jurisdiction must be construed restrictively. This was extensively elaborated by Mativo J in Night Rose Cosmetics (1972) Ltd v Nairobi County Government & 2 others [2018] eKLR. In the instant case, the Petitioners allege the [likelihood of] violation of their fundamental rights. Where a suit primarily seeks to enforce fundamental rights and freedoms and it is demonstrated that the claimed constitutional violations are not mere “bootstraps” or merely framed in Bill of Rights language as a pretext to gain entry to the Court, it is not barred by the doctrine of exhaustion. This is especially so because the enforcement of fundamental rights or freedoms is a question which can only be determined by the High Court.

71. Having already determined that the Applicant lacks the locus standi to institute judicial Review Proceedings under Public Procurement and Asset Disposal Act, 2015 in particular, under Section 167(1) since he was neither a candidate nor tenderer in the Tender floated by the 1st Respondent; Likewise, the provisions of Public Procurement and Asset Disposal Act fail to apply in this case, including the internal dispute resolutions mechanisms therein.

72. Another assertion by the Respondents is on doctrine of exhaustion under Section 56(1) of the Data Protection Act being complaints to the Data Commissioner, stipulates that, a data subject who is aggrieved by a decision of any person under this Act may lodge a complaint with the Data Commissioner in accordance with this Act. In the instant matter, there is no decision that is alleged to have been made by any person under the Data Protection Act. Therefore, Section 56 and 57 of the Act are not applicable in the circumstances.

73. Resultantly, the argument that the Applicant ought to have exhausted the internal mechanisms provided for under the Public Procurement and Asset Disposal Act, and Data Protection Act hold no grounds. Therefore, the Applicant was at liberty to institute Judicial Review proceedings under the provisions of Civil Procedure Rules, the Fair Administrative Action Act and the Law Reform Act.

74. Since the suit before me was brought under Section 8 & 9 of the Law Reform Act Cap 26 Laws of Kenya, Sections 7(1)(a) and 9(1) of the Fair Administrative Action Act, 2015, and Order 53 Rule 3 of the Civil Procedure Rules 2010 is properly before this court. The doctrine of exhaustion is inapplicable in this circumstances.

75. On the third issue, of prerogative orders sought, before determination of the issues before the Court, it is necessary to restate the parameters of judicial review jurisdiction, as stated in the Ugandan case of Pastoli vs Kabale District Local Government Council & Others, (2008) 2 EA 300 thus:“In order to succeed in an application for Judicial Review, the Applicant has to show that the decision or act complained of is tainted with illegality, irrationality and procedural impropriety: See Council of Civil Service Union v Minister for the Civil Service [1985] AC 2; and also Francis Bahikirwe Muntu and others v Kyambogo University, High Court, Kampala, miscellaneous application number 643 of 2005 (UR).Illegality is when the decision making authority commits an error of law in the process of taking the decision or making the act, the subject of the complaint. Acting without Jurisdiction or ultra vires, or contrary to the provisions of a law or its principles are instances of illegality….Irrationality is when there is such gross unreasonableness in the decision taken or act done, that no reasonable authority, addressing itself to the facts and the law before it, would have made such a decision. Such a decision is usually in defiance of logic and acceptable moral standards: Re An Application by Bukoba Gymkhana Club [1963] EA 478 at page 479 paragraph “E”.Procedural impropriety is when there is failure to act fairly on the part of the decision making authority in the process of taking a decision. The unfairness may be in non-observance of the Rules of Natural Justice or to act with procedural fairness towards one to be affected by the decision. It may also involve failure to adhere and observe procedural rules expressly laid down in a statute or legislative Instrument by which such authority exercises jurisdiction to make a decision. (Al-Mehdawi v Secretary of State for the Home Department [1990] AC 876).”

76. Judicial review is now entrenched as a Constitutional principle pursuant to the provisions of Article 47 of the Constitution, which provides for the right to fair administrative action, and Section 7 of the Fair Administrative Action Act in this regard provides that any person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision.

77. In addition, it was emphasized by the Court of Appeal in Suchan Investment Limited vs. Ministry of National Heritage & Culture & 3 others, (2016) eKLR that Article 47 of the Constitution as read with the grounds for review provided by Section 7 of the Fair Administrative Action Act reveals an implicit shift of judicial review to include aspects of merit review of administrative action, even though the reviewing court has no mandate to substitute its own decision for that of the administrator.

78. Also, Article 165(6) of the Constitution also provides that this Court has supervisory jurisdiction over any person, body or authority that exercises a quasi-judicial function or a function that is likely to affect a person’s rights. The consideration and determination of the substantive issues raised in the instant application now follows.

79. The Applicant alleged illegality, irrationality, and impropriety, on the 1st Respondents actions for failure to require data protection compliance in the bid documents. The Applicant has not demonstrated to this court that the 1st Respondent has failed and how failure to require data protection compliance at this preliminary stage of the tender process would amount to illegality, irrationality, and impropriety.

80. In any event, once the tender is implemented and there are legal failures by the data controllers and any other persons to comply with the Data Protection Act or any other laws, then there are legal avenues that can provide for redress in law. At this stage though, I find the Applicant to have put the cart before the horse; the application is premature and I would take it to be speculative.

81. The Data Protection Act, 2019 is an act of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.

82. Powers of the 3rd Respondent are set out in Section 8 (1) of The Data Protection Act, 2019 are clearly listed as follows:Section 8(1)a.oversee the implementation of and be responsible for the enforcement of this Act:b.establish and maintain a register of data controllers and data processors;c.exercise oversight on data processing operations, either of own motion or at the request of a data Protection subject, and verify whether the processing of data is done in accordance with this Act;d.promote self-regulation among data controllers and data processors;e.conduct an assessment, on its own initiative of a public or private body, or at the request of a private or public body for the purpose of ascertaining whether information is processed according to the provisions of this Act or any other relevant law;f.receive and investigate any complaint by any person on infringements of the rights under this Act;g.take such measures as may be necessary to bring the provisions of this Act to the knowledge of the general public;h.carry out inspections of public and private entities with a view to evaluating the processing of personal data;i.promote international cooperation in matters relating to data protection and ensure country's compliance on data protection obligations under international conventions and agreements;j.undertake research on developments in data processing of personal data and ensure that there is no significant risk or adverse effect of any developments on the privacy of individuals; andk.perform such other functions as may be prescribed by any other law or as necessary for the promotion of object of this Act.(2)The Office of the Data Commissioner may, in the performance of its functions collaborate with the national security organs.(3)The Data Commissioner shall act independently in exercise of powers and carrying out of functions under this Act.

83. Section 9 (1) The Data Commissioner shall have power to;Section 9(1)a.conduct investigations on own initiative, or on the basis of a complaint made by a data subject or a third party;b.obtain professional assistance, consultancy or advice from such persons or organisations whether within or outside public service as considered appropriate;c.facilitate conciliation, mediation and negotiation on disputes arising from this Act;d.issue summons to a witness for the purposes of investigation;e.require any person that is subject to this Act to provide explanations, information and assistance in person and in writing;f.impose administrative fines for failures to comply with this Act;g.undertake any activity necessary for the fulfilment of any of the functions of the Office; andh.exercise any powers prescribed by any other legislation.(2)The Data Commissioner may enter into association with other bodies or organisations within and outside Kenya as appropriate in furtherance of the object of this Act.

84. The applicant seeks an order of Mandamus to issue directing the 3rd Respondent to prescribe and direct for the 1stRespondent the basic content of data protection for tender NO. Mtihudpw /Sdhud/CSHSF/046/2021-2022, to include designation of a Data Processor, protection of Data Subjects, Encryption of the subject Tender for the ERP, inclusion of Data Collection protocols, Data Storage Protocols and recognition of Data Controllers as a prerequisite for bidders.

85. The PPAD Act has no provision that directs or prescribes to the 3rd Respondent on how to exercise its powers, while Section 9 (3) provides that the Data Commissioner shall act independently in exercise of powers and carrying out of functions under this Act.

86. Allowing the order of Mandamus will be tantamount to micromanaging the functions of a procurement entity.

87. There are many consumer protection structures that are available to the Applicant should the service provider that is secured by the 1st Respondent fail to meet the standards that they were intended to achieve. The suit is not ripe.

88. It is this court’s finding that the basic content of data protection like designation of a Data Processor, protection of Data Subjects, Encryption of the subject Tender for the ERP, inclusion of Data Collection protocols, Data Storage Protocols and recognition of Data Controllers as a prerequisite for bidders are critical Components of right to privacy as guaranteed under Article 31 of the Constitution.

89. It is my finding and I so hold that the proposed basic content of data protection are activities that are within the 2nd Respondents powers under Section 9 to conduct investigations on its own initiative, or on the basis of a complaint made by a data subject or a third party, to undertake any activity necessary for the fulfilment of any of the functions of the Office and to exercise any powers prescribed by any other legislation.

90. Article 46 (1) of the Constitution guarantees the Applicant the right-a.to goods and services of reasonable quality;b.to the information necessary for them to gain full benefit from goods and services;c.to the protection of their health, safety, and economic interests; andd.to compensation for loss or injury arising from defects in goods or services.

91. The Applicant can seek remedies under the Consumer Protection Act, 2012 in the event the service provider that the 1st Respondent secures don’t meet the prescribed standards.

92. The Applicant has a host of avenues where he can seek redress should the contracting parties fail to supply quality services and I so hold.

93. The Applicant has sought orders of certiorari, prohibition and mandamus. The Court of Appeal held in Kenya National Examinations Council vs. Republic Ex parte Geoffrey Gathenji Njoroge Civil Appeal No. 266 of 1996 inter alia as follows as regards the nature of the order of prohibition:“Prohibition looks to the future so that if a tribunal were to announce in advance that it would consider itself not bound by the rules of natural justice the High Court would be obliged to prohibit it from acting contrary to the rules of natural justice. However, where a decision has been made, whether in excess or lack of jurisdiction or whether in violation of the rules of natural justice, an order of prohibition would not be efficacious against the decision so made. Prohibition cannot quash a decision which has already been made; it can only prevent the making of a contemplated decision…Prohibition is an order from the High Court directed to an inferior tribunal or body which forbids that tribunal or body to continue proceedings therein in excess of its jurisdiction or in contravention of the laws of the land. It lies, not only for excess of jurisdiction or absence of it but also for a departure from the rules of natural justice. It does not, however, lie to correct the course, practice or procedure of an inferior tribunal, or a wrong decision on the merits of the proceedings…”

94. As regards the requirements for an order of mandamus to issue, the Court proceeded to hold as follows:“The order of mandamus is of a most extensive remedial nature, and is, in form, a command issuing from the High Court of Justice, directed to any person, corporation or inferior tribunal, requiring him or them to do some particular thing therein specified which appertains to his or their office and is in the nature of a public duty. Its purpose is to remedy the defects of justice and accordingly it will issue, to the end that justice may be done, in all cases where there is a specific legal right or no specific legal remedy for enforcing that right; and it may issue in cases where, although there is an alternative legal remedy, yet that mode of redress is less convenient, beneficial and effectual. The order must command no more than the party against whom the application is legally bound to perform. Where a general duty is imposed, a mandamus cannot require it to be done at once. Where a statute, which imposes a duty, leaves discretion as to the mode of performing the duty in the hands of the party on whom the obligation is laid, a mandamus cannot command the duty in question to be carried out in a specific way… These principles mean that an order of mandamus compel the performance of a public duty which is imposed on a person or body of persons by a statute and where that person or body of persons has failed to perform the duty to the detriment of a party who has a legal right to expect the duty to be performed. An order of mandamus compels the performance of a duty imposed by statute where the person or body on whom the duty is imposed fails or refuses to perform the same but if the complaint is that the duty has been wrongfully performed i.e. that the duty has not been performed according to the law, then mandamus is wrong remedy to apply for because, like an order of prohibition, an order of mandamus cannot quash what has already been done…”

95. Lastly, the Court of Appeal discussed the order of certiorari, and opined as follows:“…Only an order of certiorari can quash a decision already made and an order of certiorari will issue if the decision is without jurisdiction or in excess of jurisdiction, or where the rules of natural justice are not complied with or for such like reasons. In the present appeal the Respondents did not apply for an order of certiorari and that is all the court wants to say on that aspect of the matter.”

96. There are many stages in the procurement journey which culminate in the preparation and signing of a contract with the successful bidder, and thereafter other processes like performance/implementation of the contract.

97. On the violation of the Constitution, the Applicant has merely alleged the violation of Constitution provisions without demonstrating how the same has been violated. It is trite law that a party must provide evidence which demonstrates how their rights have been violated, as merely citing the provisions of the Constitution alleged to have been violated is not enough.

98. In Consumer Federation of Kenya v Toyota Motors Corporation & 4 others (Petition 455 of 2018) [2022] KEHC 15459 (KLR) (Constitutional and Human Rights) (18 November 2022) (Judgment) the high court observed that,“92. Likewise, the court in the case of Meme v Republic [2004] eKLR, restated the position in the Anarita Karimi Case (supra) stated as follows:-“Where a person is seeking redress from the High Court on a matter which involves a reference to the Constitution, it is important that he should set out with reasonable degree of precision that of which he complains, the provisions said to have been infringed and the manner in which they are alleged to have been infringed and that the Applicant’s instant application had not fully complied with the basic test of constitutional references, as it was founded on generalized complaints without any focus on fact, law or Constitution, hence it had nothing to do with the constitutional rights of the appellant.93. My interpretation of the above provision is that for a constitutional petition to be sustainable a party must by way of evidence demonstrate how its rights have been violated. It therefore follows that the mere citing of constitutional provisions is not enough. “

99. From the foregoing, I find that the Orders for certiorari, prohibition, and mandamus cannot be issued.Order1. The Notice of Motion dated 3rd September, 2022 lacks merit and the same is dismissed.2. Due to the nature of the matter, each party to bear its own cost.

DATED, SIGNED AND DELIVERED AT NAIROBI VIRTUALLY THIS 12TH DAY OF OCTOBER 2023………………………J. CHIGITI (SC)JUDGE