[2024] KEHC 3927 (KLR)

Roma School Uthiru v Data Protection Commissioner; Muturi (Interested Party) (Judicial Review E165 of 2023) [2024] KEHC 3927 (KLR) (Judicial Review) (3 April 2024) (Judgment)

Neutral citation: [2024] KEHC 3927 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Judicial Review

Judicial Review E165 of 2023

JM Chigiti, J

April 3, 2024

Between

Roma School Uthiru

Applicant

and

The Data Protection Commissioner

Respondent

and

Christine Muturi

Interested Party

Judgment

1. The application that is before this court for determination is the one dated 24th October 2023 where in the applicant is seeking for the following orders:1. That an Order of Prohibition be and is hereby issued against the Respondent prohibiting it from enforcing, compelling, executing and/or taking any action towards the realization, enforcement and execution of the Penalty Notice dated 25th September 2023 as against the Applicant pending the hearing and determination of this Application.2. That an Order of Certiorari be and is hereby issued to remove to this Court for quashing the decision of the Office of the Data Protection Commissioner dated 25th September 2023, in respect of the Reference No ODPC/CONF/1/7/3 VOL 1(7) Christine Muturi v Roma School Uthiru pending the hearing and determination of the main suit.3. That an Order of Mandamus be and is hereby issued directing the Respondent to properly and effectively serve the Enforcement Notice on the Applicant and allow the Applicant to act on the recommended measures therein in compliance with the provisions of the Data Protection Act, 2019. 4.That A Declaration do issue that the Penalty Notice by the Respondent made on 25th September 2023, violated the Applicants right to a fair hearing and the principles of Fair Administrative Action as provided for under Articles 47 and 50 of the Constitution of Kenya, 2010 by failing to consider that the Respondent's Enforcement Notice dated 11th August 2023 was not properly served upon the Applicant, hence the Applicant did not have a chance to take the recommended measures therein.5. That A Declaration do issue that the Penalty Notice of the Respondent dated 25th September 2023, violated the principles of procedural fairness.6. That Costs of this Application be provided for.7. That this Honourable Court be pleased to issue any further orders and or directions as may be necessary to give effect to the Orders sought herein and it deems fit in the interest of justice.

2. The Application is supported by the annexed affidavit of John Robe.

Applicant’s Case 3. On 9th June 2023 the Respondent vide its letter Reference no. ODPC/CONF/1/5 Vol 1(288) notified the Applicant of a complaint filed against it by the Interested Party, both via email and physically, seeking, among other things, a response to the allegation made against it.

4. On 6th July 2023, the Applicant wrote back to the Respondent in view of the complaint by the Interested Party, responding to the said allegations and further requesting the Respondent for detailed information on the allegations made.

5. On 13th July 2023, the Applicant requested for further information on the complaint from the Respondent, citing that the Interested Party was not a parent in the school and that the complainant had not provided any evidence in support of her complaint against the Applicant. The Respondent did not respond to the said email.

6. On 26th September 2023, the Respondent served upon the Applicant a Penalty Notice for the payment of Kenya Shillings Four Million Five Hundred and Fifty Thousand (Kshs. 4,550,000/=) for failure to comply with an alleged Enforcement Notice allegedly upon the Applicant on or about 11th August 2023.

7. Upon receipt of the Penalty Notice, the Applicant notified the Respondent that they had not received the Enforcement Notice dated 2nd August 2023 and signed on 11th August 2023, and it was unable to take the recommended measures in compliance with the Data Protection Act, 2019. It is only then that the Respondent notified the Applicant that the same had only been served on email, contrary to previous methods of service of the Notification of Complaint that was both physical and via email; email which had not been received by the Applicant. The Applicant came into contact with the Respondent’s Enforcement Notice on the email of 26th September 2023.

8. On 6th October 2023, the Applicant’s Director visited the Respondent’s office to get more information on the Penalty Notice.“It is their case that the Director notified the Respondent that the Applicant had never received the Enforcement Notice until 26th September 2023 when it was forwarded to the Applicant’s email. The Respondent, at that point, notified him that the said Enforcement Notice dated 2nd August 2023 (“the Enforcement Notice”) but signed on 11th August 2023, was allegedly served on the Applicant vide email on 15th August 2023, date by which the Applicant had already closed for recognized school holidays.This being a school and the period of alleged service of the Enforcement Notice having been undertaken during a recognized school holiday, the Respondent ought to have taken all measures to ensure that service of the Enforcement Notice was not only via electronic mail but also personal as they had previously done on all previous correspondence.Article 47 of the Constitution of Kenya, 2010 (“the Constitution”) entitles everyone to administrative action that is expeditious, efficient, lawful, reasonable, and procedurally fair. Article 50 then goes on to cement that every person has a right to fair hearing in any dispute which cannot be divorced from the right to fair administrative actions. 4. 3. Section 4 of the Fair Administrative Actions Act No. 4 of 2015 (“the FAA”) further cements and emphasizes on the need for procedural fairness in administrative actions.

4. 4. While Order 5 Rules 22B of the Civil Procedure Rules (“the Rules”) provides for and guides the services of processes via email, Order 5 Rule 22B (2) is rather express on what passes as effective service. To wit, “Service shall be deemed to have been effected when the Sender receives a delivery receipt.” (Emphasis ours)

4. 5Reliance is placed in the case of Justus Nyaribo vs Clerk Nyamira County Assembly [2013] eKLR which postulates a very important principle of service and knowledge. The court goes on to hold that if knowledge of a decision cannot be established, then punishment cannot be meted on a party who has no such knowledge.

4. 6Further, the case of Mike Maina Kamau vs Hon Frankline Bett & 6 Others (2012) eKLR held that failure of service renders a process defective. Cass R. Sustain in his paper titled Two Conceptions of Procedural Fairness, posits that:

“…There are two conceptions of procedural fairness. The first places a high premium on the creation and application of general rules. On this view, public authorities should avoid "balancing tests" or close attention to individual circumstances. They should attempt instead to give guidance to citizens through clear, specific, abstract rules laid down in advance of actual applications (see Fuller, 1964). This approach sees procedural fairness in the similar treatment of the similarly situated, which is ensured by rule-bound judgments.The second conception emphasizes the value of individualized treatment, highly attentive to the facts of the particular circumstances. On this view, public authorities should stay close to the details of the controversy before them and avoid rigid rules altogether. The problem with rigid rules is that they are likely to overreach. They tend to produce arbitrariness or unfairness when applied to new or unanticipated problems.” 4. 8.Consequently, according to the Applicant, the purpose of an Enforcement Notice as provided for under the Data Protection Act, 2019 is to allow an accused party who is deemed by the Commissioner not to be compliant with the requirements of the Act to take up corrective measures as proposed in the Enforcement Notice to aid towards the desired compliance with the Act.

4. 9.It is their case that the Respondent should ensure that service of the Enforcement Notice is demonstrably complete with a delivery receipt they delivered once they sent the Notice in accordance with Order 5 Rule 22B (2) of the Rules to give the offending party such as the Applicant herein a reasonable opportunity to effect and do all that is necessary towards compliance within the stipulated Thirty (30) days period.

9. It is the Applicants case that the question of service is a fundamentally crucial question that is at the heart of the constitutionally guaranteed right to procedural fairness in hearings, and as such the same cannot be casually treated particularly where the resultant effect is as punitive as the looming Penalty Notice that is dangling on the head of the head of the Applicant.

10. Failure to serve the Enforcement Notice fundamentally infringes and violates the Applicants right to Fair Administrative action and Fair Hearing as guaranteed by the Constitution in Articles 47 and 51.

11. Without proof of effective service, it is it is impossible to for the Respondent herein to substantiate that the Applicant had any knowledge of the Enforcement Notice to warrant a penalty.

12. Any penalty without sufficient proof of service or knowledge of any enforcements violates the right of the Applicant to fair administrative action and fair hearing. Consequently, any penalty emanating from an imagined knowledge and ineffective service must be frowned upon and overturned with reliance on Justus Nyaribo vs Clerk Nyamira County Assembly and Mike Maina Kamau vs Hon Frankline Bett & 6 Others (supra).

13. The Respondent had served physical copies of all the processes on the Applicant every previous time. Bearing in mind that the Applicant is a school whose school holidays are highly publicized and reliant on government directed days, it reeks of malice that the one Enforcement Notice that bears consequences that are dire is what the Respondent choose to ineffective service on the Applicant.

14. Even if it was to be argued by the Respondent that they served electronically, there was a real likelihood that the same may have been missed owing to the fact that the Applicant had closed for holidays with no access to school emails, thereby rendering them incapable of acting on the Enforcement Notice, and as such there was no effective service of the Enforcement Notice.

15. The nature of the penalty is so punitive bearing in mind that the complaint related to an intention to post and not an actual posting, and as such the Respondent ought to be minded in allowing the Applicant, being an institution of learning, ample time to take corrective measures including the adoption of relevant policies as well as obtaining necessary consents before issuing penalties that threaten the very existence of the institution.

16. It is also a function of the Respondent to aid data controllers and processors in self-regulation and compliance with the Act, so that the intention of the Act was not to solely promote issuance of penalties against non-compliant entities, but also to allow the Respondent to help in the compliance journey.

17. In carrying out its functions, the Respondent should do so in pursuance of the provisions of Article 47 on fair administrative action. The Respondent is therefore bound to ensure that the administrative action is expeditious, fair, lawful, reasonable, procedurally fair and is such failure to observe this constitutional decree, for all intents and purposes, undermines the rule of law and the value of Article 19(1) of the Constitution.

18. A fundamental requirement of every organ exercising an administrative action is to ensure that where the contemplated action is likely to adversely affect the rights or fundamental freedoms of any person, the person affected is given prior and adequate notice of the nature and reasons for the proposed action.

19. The enforcement notice was blatantly allegedly served via email with no evidence of delivery of the same on the Applicant and any penalties emanating therefrom are illegal and unconstitutional for violating the Applicant’s right to fair administrative action and earing.

Respondents case 20. The respondents opposed the application through the Replying Affidavit of Oscar Omni the Deputy Data Commissioner- Complaints, Investigations & Enforcement, at the Office of the Data Protection Commissioner (the “office”).

21. The office received a complaint on 22nd May 2023 from the Interested Party against the Applicant premised on the publication of a minor's image on social media without the express consent of the parents and/or guardian.

22. The Office, 27th June 2023 the Respondent notified the Applicant of the complaint and sent a reminder on 4th July 2023. The Applicant responded, via email address romaschooI30@gmail.com

23. The Respondent conducted an exhaustive investigation, under Sections 8 & 9 of the Data Protection Act, 2019 and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

24. The Respondent found that the Applicant only denied the allegations without providing a sufficient response to the Complaint and was in contravention of sections 9, 25,26,29,33, 34(1) and 41(1) of the Data Protection Act.

25. Informed by the findings, the Respondent issued the Applicant with an enforcement notice dated 11th August 2023 giving it 30 days to implement the remedial measure enumerated in the Enforcement Notice which was served on 15th August 2023 via the email address- romaschool30@gmail.com

26. The Applicant failed to implement the remedial measures culminating in a Penalty Notice dated 25th September 2023 for the sum of Kshs. Four million five hundred and fifty Thousand (Kshs. 4,550,000) that was served through romaschool30@gmail.com.

27. The email address romaschool30@gmail.com the address on the Applicant's letterhead and is the same email address that was used to respond to the Notification of Complaint on 6th July 2023.

28. Regulation 17 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 Regulations provides that an enforcement notice shall be deemed to have been duly served on the concerned person where an electronic copy of the enforcement notice is sent to the concerned person's last used email address.

29. That from the foregoing, service was proper under Order 5 Rule 22B of the Civil Procedure Rules.

30. The determination of quantum of the Penalty is within the discretion of the Data Commissioner.

31. The office carried out its mandate in a procedural, proper, and fair manner.

Analysis And Determination 32. Judicial review jurisdiction, was discussed in the Ugandan case of Pastoli vs Kabale District Local Government Council & Others, (2008) 2 EA 300, that:“In order to succeed in an application for Judicial Review, the applicant has to show that the decision or act complained of is tainted with illegality, irrationality and procedural impropriety: See Council of Civil Service Union v Minister for the Civil Service [1985] AC 2; and also Francis Bahikirwe Muntu and others v Kyambogo University, High Court, Kampala, Miscellaneous Application Number 643 of 2005 (UR).Illegality is when the decision making authority commits an error of law in the process of taking the decision or making the act, the subject of the complaint. Acting without Jurisdiction or ultra vires, or contrary to the provisions of a law or its principles are instances of illegality….Irrationality is when there is such gross unreasonableness in the decision taken or act done, that no reasonable authority, addressing itself to the facts and the law before it, would have made such a decision. Such a decision is usually in defiance of logic and acceptable moral standards: Re An Application by Bukoba Gymkhana Club [1963] EA 478 at page 479 paragraph “E”.Procedural impropriety is when there is failure to act fairly on the part of the decision making authority in the process of taking a decision. The unfairness may be in non-observance of the Rules of Natural Justice or to act with procedural fairness towards one to be affected by the decision. It may also involve failure to adhere and observe procedural rules expressly laid down in a statute or legislative Instrument by which such authority exercises jurisdiction to make a decision. (Al-Mehdawi v Secretary of State for the Home Department [1990] AC 876).”

33. Judicial review is now entrenched as a constitutional principle pursuant to the provisions of Article 47 of the Constitution, which provides for the right to fair administrative action, and Section 7 of the Fair Administrative Action Act in this regard provides that any person who is aggrieved by an administrative action or decision may apply for review of the administrative action or decision.

34. In the case of Republic v County Director of Education, Nairobi & 4 others Ex-parte Abdukadir Elmi Robleh [2018] eKLR learned judge observed as follows in paragraph 27 of his judgment;“In my view the notice contemplated under Article 47 of the Constitution as read with Section 4(3) of the Fair Administrative Action Act must not only be prior to the decision but must also be adequate and must disclose the nature and reasons for the proposed administrative action.”

35. In Geothermal Development Company Limited vs. Attorney General & 3 Others [2013] eKLR it was held that:“Article 47 enshrines the right of every person to fair administrative action. Article 232 enunciates various values and principles of public service including “(c) responsive, prompt, effective, impartial and equitable provision of services” and “(f) transparency and provision to the public of timely, accurate information.”As a component of due process, it is important that a party has reasonable opportunity to know the basis of allegations against it. Elementary justice and the law demands that a person be given full information on the case against him and given reasonable opportunity to present a response. This right is not limited only in cases of a hearing as in the case of a court or before a tribunal, but when taking administrative actions as well. (See Donoghue v South Eastern Health Board [2005] 4 IR 217). Hilary Delany in his book, Judicial Review of Administrative Action, Thomson Reuters 2ndedition, at page 272, notes that, “Even where no actual hearing is held in relation to the making of an administrative or quasi-judicial decision, an individual may be entitled to be informed that a decision which will have adverse consequences for him may be taken and to notification of the possible consequences of the decision.”

36. Notice is a matter of procedural fairness and an important component of natural justice. As such, information provided in relation to administrative proceedings must be sufficiently precise to put the individual on notice of exactly what the focus of any forthcoming inquiry or action will be.

37. In Msagha vs. Chief Justice & 7 Others Nairobi HCMCA no. 1062 of 2004 (Lessit, Wendo & Emukule, JJ on 3/11/06) (HCK) [2006] 2 KLR 553 it was held:“The Court observes firstly that the rules of natural justice “audi alteram partem” hear the other party, and no man/woman may be condemned unheard are deeply rooted in the English common law and have been transplanted by reason of colonialization of the globe during the hey-days of the British Empire. An essential requirement for the performance of any judicial or quasi-judicial function is that the decision makers observe the principles of natural justice. A decision is unfair if the decision-maker deprives himself of the views of the person who will be affected by the decision”

38. On 9th June 2023 the Respondent notified the Applicant of a complaint filed against it by the Interested Party, both via email and physically, seeking, among other things, a response to the allegation made against it.

39. On 27th June 2023 the Respondent notified the Applicant of the complaint and sent a reminder on 4th July 2023. The Applicant responded, via email address romaschool30@gmail.com.

40. On 6th July 2023, the Applicant wrote back to the Respondent in view of the complaint by the Interested Party, responding to the said allegations and further requesting the Respondent for detailed information on the allegations made.

41. The Respondent conducted an exhaustive investigation, under Sections 8 & 9 of the Data Protection Act, 2019 and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

42. The Respondent found that the Applicant only denied the allegations without providing a sufficient response to the Complaint and was in contravention of sections 9, 25,26,29,33, 34(1) and 41(1) of the Data Protection Act.

43. Informed by the findings, the Respondent issued the Applicant with an enforcement notice dated 11th August 2023 giving it 30 days to implement the remedial measure enumerated in the Enforcement Notice which was served on 15th August 2023 via the email address-romaschool30@gmail.com.

44. The Applicant failed to implement the remedial measures culminating in a Penalty Notice dated 25th September 2023 for the sum of Kshs. Four million five hundred and fifty Thousand (Kshs. 4,550,000) that was served through romaschool30@gmail.com.

45. The email address romaschool30@gmail.com on the Applicant's letterhead is the same email address that was used to respond to the Notification of Complaint on 6th July 2023.

46. On 6th July 2023, the Applicant wrote back to the Respondent on the same address.

47. The Applicant has not tendered any evidence to demonstrate that the school administration and staff who man the e-mail platform were not available to attend to e mails and in particular to receive The Enforcement Notice that was served on the Applicant vide email on 15th August 2023.

48. Regulation 17 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 Regulations provides that an enforcement notice shall be deemed to have been duly served on the concerned person where an electronic copy of the enforcement notice is sent to the concerned person's last used email address.

49. I am satisfied that the Applicant was given ample notice of the complaint though the address- romaschool30@gmail.com. From the foregoing, service was proper under Order 5 Rule 22B of the Civil Procedure Rules.

50. In exercising its discretionary power, The Respondent issued a Penalty Notice dated 25th September 2023 for the sum of Kshs. Four million five hundred and fifty Thousand (Kshs. 4,550,000). The determination of quantum of the Penalty is within the discretion of the Data Commissioner.

51. This court has no jurisdiction to interfering with the determination on the issues quantum as set out in the enforcement Notice since the same was arrived at through the exercise of discretion on the part of the Respondent.

52. In the case of Kenya National Examination Council versus Republic ex parte Geoffrey Gathenji Njoroge & 9 others [1997] eKLR, the Court stated the grounds upon which such an order may issue as follows;“What does an ORDER OF PROHIBITION do and when will it issue" It is an order from the High Court directed to an inferior tribunal or body which forbids that tribunal or body to continue proceedings therein in excess of its jurisdiction or in contravention of the laws of the land. It lies, not only for excess of jurisdiction or absence of it but also for a departure from the rules of natural justice. It does not, however, lie to correct the course, practice or procedure of an inferior tribunal, or a wrong decision on the merits of the proceedings – See HALSBURY&39; S LAW OF ENGLAND, 4th Edition, and Vol.1 at pg. 37 paragraphs 128”

Disposition: 53. The applicant has failed to prove its case.

Order: 54. The Notice of Motion dated 24th October 2023 is dismissed with costs.

DATED, SIGNED AND DELIVERED AT NAIROBI THIS 3RDDAY OF APRIL 2024……………………………………J. CHIGITI (SC)JUDGE