WPP Scangroup PLC & another v Data Commissioner & 2 others [2026] KEHC 13459 (KLR)

WPP Scangroup PLC & another v Data Commissioner & 2 others (Civil Appeal E1282 of 2024) [2026] KEHC 13459 (KLR) (17 August 2026) (Judgment) Neutral citation: [2026] KEHC 13459 (KLR) Republic of Kenya In the High Court at Nairobi (Milimani Commercial Courts) Civil Appeal E1282 of 2024 FR Olel, J August 17, 2026 Between WPP Scangroup PLC 1 st Appellant

WPP PLC 2 nd Appellant and The Data Commissioner 1 st Respondent Bharat Thakar 2 nd Respondent Control Risk Group 3 rd Respondent (BEING AN APPEAL FROM THE DECISION OF THE DATA PROTECTION COMMISSIONER DATED 25th OCTOBER 2024, IN RESPECT OF ODPC CONSOLIDATED COMPLAINT NO 1159, 1160 AND 1161 OF 2024) Judgment A. Introduction 1. This Appeal challenges the determination of Immaculate Kassait, MBS, Data commissioner dated 25 th October 2024 delivered pursuant to Section 8(f) and 56 of the Data Protection Act, 2019 and Regulation 14 of the Data protection (Complaints handling procedure and enforcement regulations 2021) with respect to ODPC complaint No 1159 of 2024, consolidated with ODCP complaint No 1160 of 2024 and ODCP complaint No 1161 of 2024, where after considering all the facts of the complaint, the evidence tendered and investigations conducted, she did hold that; a. The respondents are found liable. b. The 1 st and 2 nd respondents are hereby ordered to give the complainant access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations, 2021 within 7 days of the date of this determination. c. The respondents are hereby ordered to compensate the complainant Kshs 1,950,000/= (One Million, nine hundred and fifty thousand only) as follows: - The

1 st respondent – Kshs 700,000/= (Seven hundred thousand Kenya shillings Only). The 2 nd respondent-Kshs 700,000/= (Seven hundred thousand Kenya shillings Only). The 3 rd Respondent-Kshs 550,000/= (Five hundred and fifty Thousand Only). d. An enforcement Notice to issue to the 1 st , 2 nd & 3 rd Respondents. e. Parties have a right to Appeal this determination to the high court of Kenya within 30 days. (B) BACKGROUND OF THE COMPLAINT/PLEADINGS 2. The background hereto was that the 2 nd respondent filed three complaints all dated 31 st July, 2024 against the 1 st and 2 nd Appellants and also against the 3 rd Respondent herein (hereinafter referred to as “the complaint”), where he averred that he was the founder CEO of Scan Marketing limited (Scanad), an advertising agency, he established in 1982 and managed to grow it into one of the largest advertising agencies in East Africa. In 2005 following a successful restructuring process, the said company was renamed to Scangroup Plc, a subsidiary of WPP PLC, a British multinational that specialized in communications, advertising, public relations, technology and commerce. The holding company ( WPP Plc ) was headquartered in London, England, and Scangroup Plc was thereafter successfully listed on the Nairobi stock exchange (NSE) in August 2006. Upon listing he was employed as a director and CEO pursuant to a contract of employment dated 5 th December 2005.

3. It was his contention that in 2021, he was unprocedural suspended from his position as chief executive officer of Scangroup Plc following allegations of misconduct and though he was eventually summoned to appear before the disciplinary panel, he opted to resign under duress, as he believed the said process would be unfair and was pre-determined.

4. Further, after his suspension, the 2 nd appellant did contract the 3 rd respondent (CRG) to access and process his personal data, both physically and those backed up on iCloud, including data containing his personal WhatsApp massages, unrelated to his work, which act was done without his knowledge and/or consent . After completion of their task, the 3 rd respondent complied a report, which report was shared with the Capital Markets Authority (CMA), and the 1 st and 2 nd Appellants board. By undertaking this process, the 1 st and 2 nd Appellant had failed to provide a transparent process, which safeguards his personal data and this had resulted in significant professional and personal harm, since his personal data was mishandled and improperly shared amongst several entities during the said investigations.

5. The 2 nd respondent thus lodged his complaint against the respondents alleging breach of his constitutional right to privacy guaranteed under Article 31 of the Constitution and breach of his rights as a data subject as provided in the Data protection Act (the Act), through unlawful and unjustified processing of his personal information. It was his contention that the 2 nd appellant herein as the largest shareholder of Scangroup played a significant role in the governance and decision-making process within the 1 st appellant company, thereby influencing the processing activities of Scangroup, thus effectively acted as a data controller and had to be held accountable for the breaches that occurred.

6. Specifically, the 2 nd Respondents complaint raised against both appellants and the 3 rd respondent could be summarized as follows; (i) Complaint against the 1st Appellant (Scangroup) 7. . The 1 st Appellant had: (a) Denied him access to his personal data without sufficient justification in breach of his right as a data subject – That Scangroup had improperly withheld access to logs and records, claiming inability to comply with the detailed requests for data extraction while citing lack of access to logs and records, failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was being processed. (b) Improper invocation of exemptions and general situations – That Scangroup had based the denial of access to the requested documents and information on the grounds of public interest without having met the required threshold. According to the 2 nd respondent, there was no significant public interest in withholding his personal information as it did not relate to national security, public safety or other critical public concerns and that the public interest exemption should not be used to obscure transparency and accountability in the handling of personal data. (c) Data sharing and third-party disclosures – That CRG commissioned by Scangroup and WPP accessed and

processed his personal data from the company-issued devices including iCloud data and private WhatsApp messages unrelated to company responsibilities, without his consent or lawful basis. The 2 nd respondent relied on the Data Act, the Constitution and European Data Protection Supervisor (EDPS) guidelines on transparency and accountability when accessing employees' personal data to emphasize this point. (d) Unauthorized disclosure to majority shareholder – That Scangroup disclosed his personal data, including details of disciplinary procedures and correspondences with WPP's legal counsel post-employment without obtaining his consent. (e) Lack of transparency and accountability – The 2 nd respondent asserted that Scangroup did not provided clear explanations or documentation to support their decisions to deny him access to specific categories of his personal data and that there was no evidence of proper record keeping or documentation regarding the processing of his personal data. (f) Misapplication of legal privilege, confidentiality and public interest – According to the 2 nd respondent, the Appellants’ invocation of confidentiality and public interest under Regulation 56 as grounds for denial was legally baseless as the requested personal data, especially those contained in investigative reports and communications with external entities such as CRG did not fall within the

scope of legal privilege. The reports were likely to include factual findings based on personal data processed during investigations, which do not inherently involve confidential legal advice or preparation for litigation. (g) Impact on rights and obligation – The 2 nd respondent avers that the denial of access to his personal data and the unauthorized access of his personal data by third parties has had a detrimental impact on his rights. This includes damage to his professional and personal reputation and standing within regulatory bodies such as the CMA based on undisclosed adverse information and potential legal repercussions stemming from Scangroup's mishandling and unauthorized disclosure of his personal data which could affect his future career prospects and personal and family's wellbeing. (ii) Complaint against the 2nd Appellant (WPP) 8. The 2 nd Appellant had allowed; (a) Unauthorized data processing and access – The 2 nd respondent states that WPP commissioned a third party, CRG, to access and investigate his personal data without his express consent nor did they implement measures to segregate personal data from work related data to protect his privacy, thereby disregarding the principles of data minimization and necessity as outlined in the Act. (b) Use of personal data beyond original scope – That his personal data initially collected by Scangroup for employment

purposes was subsequently used by WPP for investigations without informing him or obtaining his consent, and the resultant report was eventually shared with CMA. The usage of his personal data went beyond the original scope of data collection, thus violating the principle of purpose limitation. (c) Denial of access to personal data – That WPP has persistently denied his requests for access to crucial personal data without justification, despite having sent a DSAR, thereby obstructing his right to fully understand how his data had been processed. (d) Improper invocation of exemptions and general situations – That WPP had based the denial of access to the requested documents and information on the grounds of public interest, yet there was no significant public interest in withholding his personal information as it did not relate to national security, public safety, or other critical public concerns. (e) Claims of legal privilege, confidentiality and public interest – That WPP had invoked legal privilege, confidentiality and public interest to deny his access requests to his personal data. The 2 nd respondent stated that the investigation reports and communication with external entities like CRG and CMA likely contain factual findings based on his extracted personal data, which were not inherently covered by legal privilege or involve confidential legal advice or preparation for

litigation. The 2 nd respondent further posited that the process undertaken by WPP was not transparent and that instead of addressing specific confidentiality concerns through redaction or partial disclosure, they had wholly denied his request, further demonstrating the lack of accountability. He further stated that Regulation 55 and 56 should not be used as a blanket exemption from all the provisions of the DPA. The principles of data processing and especially data subject rights must still apply and the appellants had not demonstrated compliance with the said principles even when relying on the exemption. (f) Lack of transparency and accountability – That at no point was he informed of the nature and extent of data sharing and processing conducted by WPP. That the processing was carried out without his explicit consent, violating his rights under Section 26 of the Act. (g) Improper personal data sharing with third parties – That WPP engaged third parties like CRG in processing his personal data without a legal basis. (iii) Complaint against the 3rd Respondent (Control Risks Group (CRG)) 9. The grounds for complaint against the 3rd Respondent were that they; (a) without authority processed, accessed and used his personal data beyond the original scope – That CRG unlawfully accessed and processed his personal data without his consent which included data from his devices and

iCloud storage containing private communications unrelated to his professional responsibilities, which constitutes a severe breach of privacy. (b) Denial of access to personal data – The Complainant asserts that despite his DSAR, CRG did not provide access to crucial personal data, including the investigation report it compiled, which potentially contained adverse information impacting his standing with regulatory bodies. CRG had also failed to respond to specific queries regarding the scope and nature of personal data processing activities, thereby obstructing his right to fully understand how his data was processed. (c) Claims of legal privilege and confidentiality – That CRG had invoked legal privilege and confidentiality to deny his DSAR thereby preventing him from verifying and understanding the personal data CRG processes about him and obstructed his rights as a data subject. It was his further contention that the reports and documents likely contain factual findings arrived at after accessing his personal data, which findings were not inherently covered by legal privilege or involve confidential legal advice or preparation for litigation. (d) Lack of transparency and accountability – The 2 nd respondent avers that CRG had not provided clear documentation or explanations for the processing activities undertaken involving his personal data, and this had resulted in reports

prepared without his explicit consent. 10. . The 2 nd respondent thus urged the data commissioner to find that due to the above breaches elaborated in the complaints filed, his rights as a data subject had been breached, demanded an explanation of data processing activities, cessation of unlawful data processing, deletion of personal data, demanded a formal apology from the Appellants and urged the Data Commissioner to award him compensation for damages suffered. (c) The Response (i) The 1 st and 2 nd Appellants Response to the Complaints filed 11. The 1 st and 2 nd Appellants filed their responses to the complainant and notification letters vide their letters dated 15 th , 27 th and 28 th August 2024, and 12 th September 2024. They raised a preliminary issue, that there was an ongoing litigation between Scangroup, WPP and the complainant being HCCOMM/E147/2024- BHARAT KUMAR THAKRAR VS WPP PLC, WPP SCANGROUP PLC & 7 OTHERS (The suit), where the 2 nd respondent had raised similar issues, and demanded a copy of the investigations report. Therefore, there was an overlap between his claim before the High court and the complaint made in the DSAR, which to them appeared to be a “fishing expedition” to circumvent the proper discovery process in the ongoing civil suit filed. Further it was the appellants contention that If discloses were to be made, it would prejudice them and have detrimental impact on the outcome of the litigation pending before court.

12. On the facts leading to the complaint, the 1 st and 2 nd appellants did aver that sometimes in late 2020 serious allegations were leveled against the 2 nd respondent, that he had engaged in behaviour and practices amounting to gross misconduct, contrary to the terms of Scangroup’s policies and procedures, its code of business conduct and board charter. These allegations were made through a Whistle-blower report of employees and former employees of scangroup using the “Right to speak line”, which allegations were then shared with Scangroup’s board of directors for action.

13. Following the said complaints, on 18 th February 2021, the 1 st Appellant board did suspend the 2 nd respondent to pave way for investigation, which was done by and on the behest of the Appellants by the 3 rd respondent and subsequently the 2 nd respondent was issued with a Notice to show cause (NTSC) dated 16 th March 2021, detailing acts which amounted to gross misconduct and was requested to defend himself against the said allegations. Instead of doing so, the 2 nd respondent opted to resign as director and chief executive officer of the 1 st Appellant on 23 rd March 2021.

14. Further, the Appellant’s posited that their subsequent communication with CMA was made in line with its legal reporting requirement as a listed company pursuant to the Capital Markets Act and corresponding regulations. They had also processed the 2 nd respondent’s data on the basis of the existing employer-employee relationship, while protecting their legitimate interests in the context of the said relationship. Thus all of the referenced documents which were in their possession, had been received during the employment period and processing of the same was carried out in accordance with their right as the 2 nd respondent’s employer.

15. The appellants also urged the court to note that, Section 28 of Data Protection Act, allowed for indirect collection of personal data, where such collection is necessary for the prevention, detection, investigations, prosecution and punishment of crime; and/or for the protection of the interest of the data subject or any other interested party. In context of the disciplinary investigations against the 2 nd respondent, they had a legal basis for not relying on his consent to process his personal data and thus had not acted with malice or bad faith.

16. Further, in specific response to the various grounds of complaint made against them, the Appellants stated as follows; a. Unauthorized data processing and access; the appellants maintained that the information requested for was legally privileged and would prejudice the suit filed by the 2 nd respondent at the high court. Regarding his request for copies of the relevant data protection policies that were in force, between November 2019 and March 2021, the 2 nd respondent being the former CEO of Scangroup, was responsible for signing off and effecting WPP Data Privacy & security charter. He had also attended several data protection and security trainings and was aware of WPP Data Privacy and security charter which applied at group level on all operating entities. Be that as it may, the had on 27 th August 2024, electronically delivered to the 2 nd respondent a soft copy of his redacted HR file. b. Improper invocation of exemptions and general situations; The appellants asserted that they were permitted to rely on the general exemptions provided under Section 51(2)(b) of the Act, Regulation 55(a) and Regulation 56(b)&(d) of the Data Protection (General) Regulations, 2021. The 2 nd respondent’s interpretation of public interest in the context of his DSAR was therefore misguided. c. Data sharing and Third-party disclosures/unauthorized disclosures; Clause 8 of the

2 nd respondents service contract set out how his data was to be handled during the course of his employment and further, WPP Data Privacy & security charter outlined the Appellants rights as regards Data sharing. They also stated that no sensitive personal data of the 2 nd respondent was processed by them in the manner alleged and consequently, his consent was not required in dealing with the same. d. Employment and Investigative data; They asserted that the same was protected by legal privilege and reserved their right in relation to such information. Further without prejudice to the above such information could also be requested through a disclosure request in the ongoing suit file at the High court between the said parties. e. Continued disclosure of adverse personal information; The Appellants reiterated that EDPS relied upon by the 2 nd respondent were not applicable and that they were allowed by the Employment Act to retain an employee’s Data post termination for a period of five (5) years. Additionally, WPP Data handling and Retention policy, set out their data retention policies and practices and that this was undertaken in line with the objectives set out in Clause 8 of the 2 nd respondents service contract. Disclosures to CMA were also done in line with statutory requirements under the Capital Markets Act . f. Lack of transparency and accountability/use of personal

data beyond original scope; The appellants stated that the 2 nd respondent as a former CEO of Scangroup had full visibility of their data protection polices, and referred to the contents of WPP Data Privacy & Security Charter, which outlined their polices and practice in the context of disclosure of employee personal Data. Further, as a licensed company of CMA, Scangroup was under strict legal requirement to maintain its books, records, accounts and Audits and regularly report its affairs to CMA as statutorily required. They thus denied use of the 2 nd respondents’ data beyond the original scope of inquiry. g. Misapplication of legal privilege, confidentiality and public interest; It was the Appellants contention that information sought for was covered by legal privilege, which concept was provided for under Section 134 to 137 of the Evidence Act and was aimed at protecting clients to whom legal services was being provided. They were thus not under any legal obligation to provide an explanation as to why certain information/documents were protected by legal privilege as the attendant confidentiality arose automatically. h. Impact on the 2 nd respondents’ rights and reputation; The Appellants emphasized that at no point did they make any information regarding the 2 nd respondents’ resignation or the suit public. i. Inadequate response to DSAR; The appellants maintained that they

had responded to the DSAR in good faith, but maintained that the 2 nd respondent was on a fishing expedition since the complaint was being used to harass them and was convoluted in purpose 11. The 1 st and 2 nd respondent thus urged the Data commissioner to find that the complaint raised had no merit and urged her to dismiss the same. (ii) The 3 rd Respondent (Control Risk Group) Response to the Complaint 11. The 3 rd respondent herein (CRG) filed various responses dated 19 th August 2024, 16 th September 2024 and 8 th October 2024 to the DSAR filed by the 2 nd respondent. They did point out that the personal data requested for by the 2 nd respondent in the DSAR was processed by them solely in their capacity as Data processor on behalf of Scangroup, who were the Data controller, as defined under the Act. The said data was subject to a suit filed by the 2 nd respondent against the Appellants, being HCCOM/E147/2024 and thus believed that disclosure would seriously prejudice the Appellants rights therein and have detrimental impact on the outcome of the said suit.

12. Be that as it may, CRG stated that on or about the 19 th February, 2021, they entered into a legally binding agreement with Coulson Harney LLP (T/A Bowmans Kenya), who acted as legal counsel to Scangroup to investigate allegations of serious misconduct against the 2 nd respondent, who was a director and CEO of the said company. The said agreement included specific written provisions, including instructions for the processing of personal data, in accordance with Section 42(2)(b) of the Data Act and Regulation 25(3) of the General Regulations. Further, as per the said agreement, they had acted as the data processor on behalf of the Data controller, Scangroup, for processing of personal data as part of the said investigations.

13. Based on the foregoing, the 3 rd respondent denied the 2 nd respondents averment that they had illegally processed his personal data, as the same had been handed over to them by Scangroup, the Data Controller, and was processed solely in the context of investigations undertaken on the 2 nd respondents alleged misconduct. They further asserted that the 2 nd respondent did raise a DSAR against the data controller, Scangroup and thus the DSAR raised against them as data processor was unfounded and misplaced since, they were not vested with the authority to make determinations on restrictions of processed data.

14. They did further contend that their engagement to undertake investigations was with Coulson Harney LLP, acting as legal advisor to Scangroup. All investigative data, communications and reports specifically requested for by the 2 nd respondent were thus subject of legal privilege and confidentiality. Further, as per the definition of sensitive personal data under the Act, personal conversations, WhatsApp and iCloud data were not prima facie sensitive personal data and no breach could be attributed to them for accessing the same.

15. The 3 rd respondent, thus urged the Data commissioner to dismiss the complaint filed in its entirety or in the alternative its determination be suspended pending the outcome of the suit filed in view of the sub judice rule. (d) Determination Of The Data Commissioner 11. The data commissioner did consider all the documents filed by both parties as specified under paragraph 66 and 67 of the determination dated 25 th October 2024 and raised four (4) issues for determination. On the first issue, she held that she had jurisdiction to determine the complaint despite the existence of the High court suit pending as the complaint related to alleged infringement of rights as set out in Section 8(a)&(f) of the Data Protection Act, while the suit centered around contractual and commercial relationship between the 2 nd respondent and the Appellants. Additionally, CRG and was not a party to the suit nor were the 3 rd to 9 th Defendants party to the complaint filed.

12. On the 2 nd issue as to whether, there was infringement of the 2 nd respondents right under the Data Act, the Data commissioner held that; a. The complainant’s right of access was not limited, even if the personal data in question consisted of information in respect of which a duty of confidentiality is owed under legal privilege, Scangroup and WPP were obligated to redact any confidential and/or legally privileged information, without affecting the complainant’s personal data and his right to access it as provided in Regulation 9 of the General regulations. b. Other than the Exemptions set out in Part VII of the Act and the restrictions thereto, there are no other exemptions or limitations to the complainant’s right of access. c. Scangroup and WPP were under no obligation to provide the complainant access to policies, internal agreements and procedures pursuant to a DSAR. d. Scangroup and WPP failed to give effect to the complainants right to access his personal Data related to his employment as CEO and Director of Scangroup. e. The complainant’s right of access to personal data related to the investigations is exempt from the application of the Act in as far as those investigations were carried out to facilitate compliance with the regulatory compliance requirements under the Capital Markets Act , subject to Section 51(1) of the Act.

11. On the third issue as to whether, the Appellants had fulfilled their obligation under the Act, the Data Commissioner did hold that; a. The Appellants did not comply with the principle of lawful processing, while processing the complainants private WhatsApp communications relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act. b. The Appellants did not comply with the principle of Data minimization in processing the complainants private WhatsApp messages relating to alleged sexual relationships and thus did not demonstrate compliance with Section 51(1) of the Act. c. The sharing of the complainant’s personal data between Scangroup, CRG, WPP and Coulson Harney was lawful. d. There was no evidence that the complainant’s sensitive personal data was processed by the respondents.

11. On the remedies available for the breach that had occurred, the Data commissioner did hold that Section 65(1) of the Act provides for compensation to a data subject, who suffers damages by reason of a contravention of a requirement of the Act. She therefor held the Appellants jointly with the 3 rd respondent liable and ordered them to jointly pay the 2 nd respondent herein a sum of Kenya shillings One million, Nine hundred and fifty thousand Only ( Kshs 1,950,000/=) for violation of his right to access his personal data in their custody and for failing to comply with the principles of lawfulness and the principles of data minimization. Of this amount, The 1 st Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only). The 2 nd Appellant was condemned to pay Kshs 700,000/= (Seven hundred thousand only). The 3 rd Respondent (CRG) was condemned to pay Ksh 550,000/= (Kenya shillings five hundred and fifty thousand only) 11. Finally, the Appellants were ordered to give the 2 nd respondent herein access to his personal data related to his employment as CEO & Director at WPP Scangroup in accordance with Section 26(b) and Regulation (9) of the Data Protection (General) Regulations 2021 within 7 days of the said determination. An enforcement notice was to issue. (e) The Appeal 11. The Appellants, being dissatisfied with the said determination, filed their

memorandum of appeal, wherein they raised ten (10) grounds of appeal, namely: - a. That the 1 st Respondent erred in fact and law in finding that the matters in issue raised in the proceedings in HCCOMM/E147/2024-Bharat Kumar Thakrar Vs WPP Plc , WPP Scangroup Plc & 7 Others were dissimilar to the issues raised in the complaints before the 1 st Respondent. b. That the 1 st Respondent erred in law in failing to give effect to and/or the manner of interpreting the right to legal privilege that is provided for under Section 134 to 137 of the law of Evidence Act , Cap 80 in finding that a data controller and/or processor ought to develop mechanism to give effect to the right of access in the context of legal privilege. c. The 1 st Respondent erred in fact and law in finding that Section 51(1) of the Data Protection Act had not been complied with, despite finding that the general exemption under Regulation 56(b) of the Data Protection (General) Regulations, 2021 applied. d. That the 1 st Respondent erred in fact and law in failing to consider evidence tendered by the Appllants to demonstrate their compliance with Section 30(1),(b)(vii) and Section 51(1) of the Data Protection Act as Read with Regulation 5(3) of the Data Protection (General) Regulations, 2021 and thus condemned the Appellants unheard and in a manner that is procedurally unfair e. That the 1 st respondent erred in law

and in fact in finding that the 2 nd Respondent’s personal data related to his employment was provided to him outside statutory timelines and in failing to recognize the fact that the 2 nd respondent’s personal data related to his employment was provided to him by the 1 st Appellant having regard to technical and organizational safeguards and mechanisms to protect the rights of third parties. f. That the 1 st Respondent erred in law in finding that the 2 nd Respondent had an absolute right to be informed that the Appellant would rely on legitimate interest as the lawful basis for processing of personal data for purposes of conducting investigations when there was no such duty to notify the 2 nd Respondent under Regulation 56(b) of the Data Protection (General) Regulations,2021, which Applied. g. That the 1 st Respondent erred in fact and law in finding that the Appellants failed to comply with the principle of data minimization in processing the 2 nd Respondents private WhatsApp massages relating to alleged sexual relations contrary to the evidence on record. h. That the 1 st Respondent erred in fact and law by placing undue emphasis on the contents of an Investigation Report as opposed to the Data handling practices of the Appellants during the investigations process in determining whether the 2 nd Respondent’s personal data has been processed in accordance with his right to

privacy. i. That the 1 st Respondent erred in law by failing to provide reasoned justification upon which the quantum of the compensation order issued against the Appellants was determined. j. That the 1 st Respondent erred in fact and law by disregarding and/or ignoring the totality of the Appellant’s evidence tendered and thereby arriving at a wrong conclusion contrary to the evidence on record leading to a gross miscarriage of justice.

11. The Appellants thus prayed that this appeal be allowed and the determination of the Data Protection Commissioner dated, signed and delivered on 25 th October 2024 in Consolidated ODPC Complaint Nos 1159 of 2024, 1160 of 2024 and 1161 of 2024 be set aside and substituted with an order dismissing each of the complaints with costs. (f) Parties Submissions 11. In considering this appeal, the Court has had the benefit of detailed written submissions filed by the parties. The appellants lodged their submissions on 12 June 2025, the 1 st respondent filed on 22 July 2025, the 2 nd respondent filed on 3 September 2025, and the appellants thereafter filed a rejoinder on 19 September 2025. I summarize the respective positions as follows: i. The Appellants’ Submissions 11. The appellants submit that the determination of the Data Commissioner dated 25 October 2024 was fundamentally flawed and ought to be set aside. They argue that the complaints raised were sub judice, since the 2 nd respondent had already instituted High Court Commercial Case No. E147 of 2024, which raised substantially similar issues, particularly the non‑disclosure of the investigation report. Proceeding with the complaints, they contend, risked conflicting outcomes and undermined the doctrine of sub judice. They rely on Business Partners International Kenya (II) Ltd v Otundo & Another [2022] eKLR, Legal Advice Centre v Communications Authority of Kenya [2015] eKLR, and the Supreme Court Advisory Opinion Ref. 1 of 2017 (Kenya National Commission on Human Rights v Attorney General [2020] eKLR), all of which emphasize that parallel adjudication of the same issue offends judicial comity.

11. The appellants further contend that the Data Commissioner erred in subordinating their right to legal privilege to the 2nd respondent’s right of access. They argue that the investigation report was commissioned through their advocates and therefore fell within the ambit of sections 134–137 and 139 of the Evidence Act , which protect professional secrecy. They rely on Three Rivers District Council v Bank of England [2004] UKHL, Glencore Energy UK Ltd v Kenya Pipeline Co. Ltd [2011] eKLR, NIC Bank Ltd v Odhiambo & Others [2025] eKLR, and Director of Public Prosecutions v Tom Ojienda & Others [2019] eKLR, to underscore that privilege is absolute unless waived or where communications are made in furtherance of crime. They also cited R v Derby Magistrates Court, ex parte B [1995] UKHL and Nelson Havi & Others v Inspector General of Police [2016] eKLR, to reinforce that privilege is a fundamental safeguard of justice and cannot be diluted by statutory access rights.

11. On data processing, the appellants maintain that their handling of the 2nd respondent’s information was lawful, proportionate, and necessary for corporate governance. They argue that the Commissioner failed to properly consider their legitimate interests under section 30 of the Data Protection Act, and misapplied the principles of lawful processing and minimization under sections 25 and 29 of the said Act. They further challenge the award of Kenya shillings One Million, Nine hundred and fifty thousand only (KSHS 1.950,000) compensation under section 62 of the Act, describing it as excessive, unreasoned, and punitive. They urge the Court, as a first appellate court, to re‑evaluate the evidence and set aside the determination, citing Coca Cola East & Central Africa Ltd v Maria Kagai Ligaga [2015] eKLR and Munyu Maina v Hiram Gathiha Maina [2013] eKLR on the threshold for appellate interference. ii. The 1 st Respondent’s Submissions 11. The Data Commissioner opposes this appeal and urged this court to uphold the determination dated 25 th October 2024. She submitted that she had acted within her statutory mandate as provided for under Sections 8(f) and 56 of the Data Protection Act, 2019 , in investigating the complaints lodged by the 2nd respondent. The Commissioner framed the issues for determination as jurisdiction, infringement of data subject rights, compliance with

statutory obligations, and entitlement to remedies. She had found that the complaints were properly before her as the High Court suit raised distinct issues and parties. Further, the appellants had failed to provide a lawful basis for processing the 2 nd respondent’s personal data. Consequently, she was right to order disclosure of personal data under Section 26(b) and Regulation 9 of the General Regulations, and compensation under Section 65 and Regulation 14(3)(e) of the Complaints Handling Regulations.

11. On sub judice, the Commissioner submitted that the doctrine under section 6 of the Civil Procedure Act applies only where the matter in issue is directly and substantially identical in both proceedings. She relied on Republic v Paul Kihara Kariuki, Attorney General & 2 Others ex parte Law Society of Kenya [2020] eKLR, and emphasizes that while there was factual overlap, the High Court suit concerned contractual, fiduciary, and employment claims, whereas the ODPC complaints concerned privacy and data protection rights under Article 31 of the Constitution and the Data Protection Act. She further cited the case of Ngunjiri v Kiambi & Another [2025] KEHC 3793 to stress that exhaustion requires parties to first pursue remedies before the Commissioner in data protection disputes. She further urged this court to find that the presence of different parties in the two proceedings, including Control Risks Group, defeats the “same parties” requirement, and that her jurisdiction was not ousted.

11. On legal privilege, the Commissioner submitted that she correctly balanced privilege under sections 134–137 of the Evidence Act with access rights under section 26(b) of the Data Protection Act. The commissioner emphasized that the Act did not contain an express exclusion for privileged material, unlike the Access to Information Act . Reliance was placed on David Wanyeki Kago v Kenya National Examinations Council [2022] eKLR to argue that statutory interpretation must be holistic and harmonize competing rights. She maintained that privilege was recognized and upheld, but that personal data intertwined with privileged content remains subject to access, with redaction as the appropriate safeguard. She thus was right to reject the appellants’ contention that privilege is absolute, stressing that the determination did not displace privilege but reconciled it with statutory access rights.

11. On lawful processing and minimization, the Commissioner submitted that the appellants failed to comply with provisions of sections 25, 29, and 30 of the Act and regulation 5(3) of the General Regulations. She stressed that reliance on public interest under section 51(2)(b) cannot override the core principles of lawful processing, minimization, and transparency. Reliance was placed on Okiya Omtatah Okoiti v Communications Authority of Kenya [2020] eKLR, Barbulescu v Romania [2017] ECHR, Halford v United Kingdom (1997), and Stengart v Loving Care Agency Inc. (2010), to emphasize that employees retain a reasonable expectation of privacy even when using employer‑issued devices. Further reliance was placed on South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 to argue that legitimate interest requires a strict necessity and balancing test, which the appellants had failed to meet. The Commissioner concluded that she was therefore right to hold that the appellants unlawfully processed private communications, including WhatsApp messages, without necessity or proportionality.

12. On quantum of compensation, the Commissioner defended the award of KES 1.95 million as proportionate and reasoned. Reliance was placed on the case of Ol Pejeta Ranching Ltd v David Wanjau Muhoro [2017] eKLR and Penina Waithira Kaburu v L.P [2019] eKLR, noting that appellate courts could only interfere with damages awarded where erroneous principles were applied. She emphasizes that the award was based on the nature and sensitivity of the data, the severity of the violation, and the harm suffered, in line with section 65 of the Act and regulation 14(3)(e). The Commissioner thus urged this Court to dismiss the appeal in its entirety. iii. The 2nd Respondent’s Submissions 11. The 2nd respondent opposed this appeal and supported the Commissioner’s determination. On the issue of sub judice, he submitted that the complaints before the ODPC were distinct from the issues raised in High Court Commercial Case No. E147 of 2024. He relied on section 6 of the Civil Procedure Act , which codifies the rule, and the Supreme Court’s Advisory Opinion in Kenya National Commission on Human Rights v Attorney General [2020] KESC 54 (KLR), which set out the test for sub judice. He also cited Republic v Paul Kihara Kariuki, Attorney General & 2 others ex parte Law Society of Kenya [2020] eKLR and Wainaina v Waibara & Another [2024] KEHC 9501 (KLR), to argue that the High Court suit concerned contractual and fiduciary claims, while the ODPC complaints were grounded in Article 31 of the Constitution and the Data Protection Act, 2019 .

11. He further stressed that the parties concern were not identical, pointing to the presence of Control Risks Group in the ODPC proceedings and additional directors in the High Court suit, and cited Madison Insurance Co. Ltd v Khatika [2023] KEHC 27016 (KLR) to emphasize the “same parties” requirement. He thus urged this court to uphold the Commissioner’s interpretation that the complaints raised were not sub judice.

11. On legal privilege, the 2 nd respondent submitted that the appellants’ reliance on the same was misplaced, since the Data Protection Act does not contain exemptions equivalent to those under the Access to Information Act , and that any claimed privilege must be strictly construed against the data subject’s fundamental rights. He relied the ODPC decision in Harrison Kisaka v Faulu Microfinance Bank Ltd [2023] ODPC Complaint No. 0586, which held that blanket refusals to DSARs are unlawful. He acknowledged that Sections 134–137 of the Evidence Act protect advocate–client communications, but stressed that privilege did not extend to raw factual findings or use of personal data without consent. Reliance was placed on the decision of Three Rivers District Council v Bank of England [2004] UKHL 48 to distinguish between legal advice and underlying factual material, and submitted that the appellants had failed to provide a privilege log or specific justification. He further urged the court to note that Control Risks Group’s investigative report contained personal data that did not automatically attract privilege, and that the Commissioner had rightly rejected the appellants’ generalized assertions.

11. On lawful processing and minimization, the 2nd respondent submitted that the appellants failed to demonstrate a valid legal basis under section 30(1) of the Act and regulation 5(3) of the General Regulations. He argued that communication of the lawful basis must precede processing, yet the appellants only raised it after the DSARs were issued. He cited Google Spain SL v Agencia Española de Protección de Datos (C‑131/12) from the CJEU to emphasize the balancing of legitimate interests against privacy rights. Further reliance was placed on Regulation 23 of the General Regulations, which requires controllers to publish a data policy, noting that the appellants had failed to do so despite transferring data abroad.

11. On data minimization, he invoked Digital Rights Ireland (C‑293/12), arguing that indiscriminate collection of private WhatsApp messages was disproportionate and unnecessary for the stated investigative purposes. He concluded that the Commissioner had thus correctly found violations of lawfulness, transparency, and minimization, and that the award of compensation under section 62 of the Act was proportionate and justified.

11. He thus urged this court to find that this Appeal has no merit and be pleased to dismiss the same. iv. The Appellants’ Rejoinder Submissions 11. The appellants reiterate their initial submissions and responded to the arguments advanced by the 1st and 2nd respondents. On sub judice, they maintain that both the High Court Commercial Case No. E147 of 2024 and the ODPC complaints arose from the same factual substratum — namely the conduct of investigations, non‑disclosure of the investigation report, and alleged invasion of privacy. They argue that the doctrine of sub judice looks to the “matter in issue” rather than the reliefs sought, and that overlap in factual background suffices to trigger the rule. They relied on Republic v Paul Kihara Kariuki, Attorney General & 2 Others ex parte Law Society of Kenya [2020] eKLR, Legal Advice Centre v Communications Authority of Kenya [2015] eKLR, In the Matter of the Interim Independent Electoral Commission [2011] eKLR, and Gichana v Drivers Universe Motor Co. Ltd [2022] eKLR, to emphasize that multiplicity of suits on the same issues risks inconsistent findings and abuse of process. They also cited Auto Terminal Japan Ltd v Directorate of Criminal Investigations [2021] eKLR to stress that the Commissioner ought to have stayed the complaints pending the outcome of the High Court suit.

11. On legal privilege, the appellants challenged the Commissioner’s finding that subject access rights under the Data Protection Act are absolute. They argue that privilege is a fundamental safeguard protected under sections 134–137 and 139 of the Evidence Act , Article 50(4) of the Constitution , and common law. They emphasize that the Data Protection Act did not amend the Evidence Act , as it is not listed under Schedule 2, and therefore cannot displace privilege. Reliance was placed on Three Rivers District Council v Bank of England [2004] UKHL 48, Balabel v Air India [1988] WL 622777, Glencore Energy UK Ltd v Kenya Pipeline Co. Ltd [2011] eKLR, Mweha Enterprises Ltd v Kenya Trade Network Agency [2017] eKLR, NIC Bank Ltd v Odhiambo & Others [2025] eKLR, and Director of Public Prosecutions v Tom Ojienda [2019] eKLR, to argue that privilege extends to lawyer‑directed work product and third‑party investigations commissioned by counsel. They also cite Dande & Others v Inspector General, National Police Service [2023] eKLR and Nelson Havi & Others v Inspector General of Police [2016] eKLR to reinforce that privilege cannot be eroded by statutory construction or redaction obligations.

11. Finally, the appellants argued that the Commissioner’s approach risks distorting the development of Kenya’s nascent data protection jurisprudence. They submitted that requiring disclosure of privileged material, even in redacted form, would impose onerous obligations on advocates and undermine the protective shield of privilege. They further stress that only two exceptions to privilege exist — crime/fraud or waiver — and that none applied here. They thus urge the Court to set aside the determination, emphasizing that the Commissioner misdirected herself on sub judice, misconstrued the law on privilege, and awarded compensation without reasoned justification. (g) Analysis And Determination 11. I have considered the entire record of Appeal and pleadings filed, the grounds of appeal raised, the elaborate submissions filed by the parties hereto, and the cited authorities. As settled by the numerous authorities both by this court and the superior courts, the duty of this court as the first appellate court is to revisit the evidence on record, evaluate it and reach its own conclusion in the matter. Further, this court ought not to ordinarily interfere with findings of fact by the trial court unless they were based on no evidence at all, or on a misapprehension of it or the Court is shown demonstrably to have acted on wrong principles in reaching the findings. (See Mwanasokoni – versus- Kenya Bus Service Ltd. (1982-88) 1 KAR 278, Kiruga –versus- Kiruga & Another (1988) KLR 348, Selle v Associated Motor Boat Co Ltd & Others [1968] EA 123) & Peters Vs Sunday Post Limited (1968) EA 123.

11. A first appellate court is also the final court of fact and litigants are entitled to full fair independent consideration of the evidence. The parties have a right to be heard both on issues of fact and issues of law, and the court must address itself to all issues raised and give reasons thereof. While considering the entire scope of Section 78 of the civil procedure Act a court of first appeal can appreciate the entire evidence and come to a different conclusion. See Kurian Chacko Vs Varkey Ouseph AIR 1969 Kerala 316.

11. Having considered the entire record of Appeal, I do find that the issues that arise for determination is Whether; a. The complaint filed was Sub judice. b. The ODPC erred in law by failing to properly apply the principle of legal privilege and public interest exemption in assessing the Appellants obligations under Data Protection Act. c. The Appellants irregularly/unprocedural processed the 2 nd respondent’s personal data and/or if they had legitimate grounds to do so. d. The 1 st respondent erred in law by awarding compensation without providing sufficient justification for awarding the same. e. Who should bear the costs of this Appeal (i) Whether the Complaint filed was Sub- judice.

51. The Appellants did bring it to the attention of the Data commissioner, the existence of a prior suit filed by the 2 nd respondent in the High court, being HCCOMM/E147/2024-Bharat Kumar Thakrar Vs WPP Plc , WPP Scangroup Plc & 7 Others, wherein identical issues were raised to what was being sought in the DSAR’s. It was the Appellants view therefore that the complaints filed were sub judice, and their determination should be stayed or alternatively be dismissed pending the outcome of the High Court suit earlier filed.

52. In response, the 2 nd respondent did argue that the Appellants invocation of the sub judice rule hinged on superficial reading of paragraph 31 of the plaint, where he had merely pleaded that the 2 nd Appellant had refused to supply him with the investigations report. Be that as it may, it was to be noted that the High court suit was founded entirely on different legal grounds, including breach of contract claims, inducement and tortious interference with contractual relations, discrimination in employment, breach of fiduciary duties by individual directors and claims for damages arising from defamation and reputational harm.

53. The said claims (filed in the High court) were thus totally distinct and separate from the complaint filed before the ODPC, which complaints were centered on unauthorized access to the 2 nd respondent’s personal data, denial of Data subject access request (DSAR) rights and breaches of data protection principles. Further, the parties before both proceedings were not identical as the 3 rd respondent herein (CRG) was not a party In the High court, and also seven individual directors sued in the High court proceedings (the 3 rd to 9 th defendants), were also not parties in the ODPC complaint. The 2 nd respondent thus urged this court to uphold the Data commissioner’s finding that the sub judice rule did not apply.

54. Having considered both rival arguments, the Data commissioner did hold that the complaint raised against the Appellants were properly before her for determination, the parties involved in High court were not all involved in the complaint filed before her and further that the remedies sought in the plaint were distinct and not within the realm of the remedies envisaged under the Data Act and regulations thereto. She thus held that the complaint was not sub-judice and dismissed this ground of attack.

55. The doctrine of sub judice is found under Section 6 of the Civil Procedure Act , CAP. 21 which provides as follows: “ No court shall proceed with the trial of any suit or proceeding in which the matter in issue is also directly and substantially in issue in a previously instituted suit or proceeding between the same parties, or between parties under whom they or any of them claim, litigating under the same title, where such suit or proceeding is pending in the same or any other court having jurisdiction in Kenya to grant the relief claimed.

56. The sub judice rule, like other maxims of law had a salutary purpose. The basic purpose and the underlying object of sub judice rule, was to prevent the courts of concurrent jurisdiction from simultaneously entertaining and adjudicating upon two parallel litigations in respect of same cause of action, same subject matter and the same relief. That was to pin down the parties to one litigation so as to avoid the possibility of contradictory verdicts by two courts in respect of the same relief and was aimed to prevent multiplicity of proceedings.

57. Explaining the intent of the sub judice rule in Kenya Bankers Association v Kenya Revenue Authority [2019] KEHC 12178 (KLR), Mativo, J. (as he then was) correctly observed that: “ 30. The basic purpose and the underlying object of Section 6 is to prevent the courts of concurrent jurisdiction from simultaneously entertaining and adjudicating upon two parallel litigations in respect of same cause of action, same subject matter and the same relief ….

31. The words “directly and substantially in issue” are used in contradistinction to the words “incidentally or collaterally in issue.” Therefore, Section 6 would apply only if there is identity of the matter in issue in both the suits, meaning thereby, that the whole of the subject- matter in both the proceedings is identical. 31. …. The test for applicability of Section 6 is whether on a final decision being reached in the previously instituted suit, such decision would operate as res-judicata in the subsequent suit. However, when the matter in controversy is the same, it is immaterial what further relief is claimed in the subsequent suit. …. 37. … the principle of sub judice does not talk about the “prayers sought” but rather “the matter in issue.” 58. The Supreme Court of Kenya in Kenya National Commission on Human Rights v Attorney General; Independent Electoral & Boundaries Commission & 16 others (Interested Parties) had the occasion to pronounce itself on the subject of sub judice, and aptly stated that: - (67) The term ‘sub-judice’ is defined in Black’s Law Dictionary 9th Edition as: “Before the Court or Judge for determination.” The purpose of the sub-judice rule is to stop the filing of a multiplicity of suits between the same parties or those claiming under them over the same subject matter so as to avoid abuse of the Court process and diminish the chances of courts,

with competent jurisdiction, issuing conflicting decisions over the same subject matter. This means that when two or more cases are filed between the same parties on the same subject matter before courts with jurisdiction, the matter that is filed later ought to be stayed in order to await the determination to be made in the earlier suit. A party that seeks to invoke the doctrine of res sub-judice must therefore establish that; there is more than one suit over the same subject matter; that one suit was instituted before the other; that both suits are pending before courts of competent jurisdiction and lastly; that the suits are between the same parties or their representatives.

59. Thus, for the doctrine of sub judice to apply, the following principles ought to be present: a. existence of two or more suits filed consecutively; b. The matter in issue in the suits or proceedings had to be directly and substantially the same; c. The parties in the suits or proceedings had to be the same or had to be parties under whom they or any of them claimed and they had to be litigating under the same title. d. The suits had to be pending in the same or any other court having jurisdiction to grant the relief claimed. ( Also See; Judicial Review 45 of 2020; Republic Vs Paul Kihara Kariuki, Attorney General & 2 Others, Ex Parte Law Society of Kenya, Judicial Review case Number 472 of 2014; Legal Advice Centre aka Kituo cha sheria Vs Communication Authority of Kenya (2015) eKLR 60. It is common ground that before filing his complaints before the Data commissioner on 31 st July 2024, the 2 nd respondent had proceeded to file a suit before the high court vide his plaint dated 22 nd March 2024 being; HCCOMM/E147/2024-Bharat Kumar Thakrar Vs WPP Plc, WPP Scangroup Plc & 7 Others were at paragraph 16 and 31 of the said paint, he did specifically plead to issues concerning investigations conducted into his alleged misconduct, the non-disclosure of the investigations report and the alleged breach of privacy and ultimately sought damages for the various breaches pleaded therein.

61. The question, which that then arises is if the matters raised in the suit were directly and/or substantially the same as those raised before the ODPC and secondly if it involved the same parties. The material test is whether the two proceedings posed the same questions in two different forums and/or whether the adjudication of one matter would overlap and have a bearing on the other case pending determination.

62. In paragraph 16 of the plaint filed in the High Court, the 2 nd respondent pleaded that, “The plaintiffs further cause of action is for breach by the 1 st and 2 nd defendants of their duty of care not to act in such a manner as would cause the plaintiff financial loss, loss of reputation and invasion of his privacy in his capacity as a founder shareholder, director and CEO of the 2 nd Defendant.

63. In paragraph 25 of the said plaint, the 2 nd respondent challenged the manner and lawfulness of the investigations and pleaded that, “The Plaintiff avers that the said suspension was allegedly as a result of a surreptitious investigations undertaken by the 1 st and 2 nd Defendants ( Appellants herein) using unlawful means and on the basis of which the board of the 2 nd Defendant comprising the 3 rd to 9 th Defendants endorsed a resolution to suspend the plaintiff from his position as CEO allegedly to allow for further investigations into the allegations against him.” 64. Further in paragraph 26 of the plaint, the 2 nd Respondent pleaded that the investigation Report was withheld from him and in particular pleaded that; “the allegations against the plaintiff emanated from a draft report prepared by an entity known as Control Risk Group, which had been contracted by the 1 st Defendant to undertake the said Investigations and which draft report, to the plaintiff’s knowledge, had only been made available to the directors appointed by the 1 st Defendant.

65. Finally in paragraph 46,49,51 and 53 of the said plaint, the 2 nd Respondent pleaded that the particulars of the Appellants involvement in his ouster on the basis of the investigations commissioned against him, which he termed as unlawful and unfair. He thus sought damages on various heads predicated on the conduct of these unlawful investigations, and its outcome.

66. Without doubt therefore, the High court was being called to decide the lawfulness of, (a) the conduct of the investigations; (b) the status, disclosure and use of the Investigations Report, (C) the alleged invasion of the 2 nd Respondents privacy and (d) subsequently to issue monetary compensation arising from the said chain of events. Before the ODPC the cause of action as outlined by the 2 nd respondent was that it related to unauthorized access to his personal data, breach of data protection principles and unauthorized processing activities.

67. Looking at the pleadings and issues arising therefrom, it is clear beyond peradventure that both suits were fulcrumed on similar facts, raise similar questions on the validity of the investigations carried out, non-disclosure of the investigations report and the alleged invasion of the 2 nd Respondents privacy. If the High court was to find that the investigations were lawful, the resultant report was privileged or was legitimately withheld, the processing or disclosure was lawful and thus there was no invasion of the 2 nd Respondent’s privacy, such a determination would directly affect the outcome of the complaint filed before the ODPC. Conversely if the High court were to hold in the 2 nd respondents favour on the same issues, the said finding would effectively determine the same issues and leave little or nothing for the Data commissioner to determine.

68. Similarly, the determination dated 25 th October 2024, would also unavoidably overlap and risked contradicting the High court findings on the same factual matrix, which situation cannot be left unchecked given that the High court case was filed first.

69. It is therefore my finding and holding that central issues for determination in the suit filed before the High court and before the ODPC were intricately intertwined and posed the same questions for determination in two different forums. A definite finding by the High court would render such issues to be res judicata in the subsequent forum and thus find that the High court suit filed and the complaint filed before the ODPC concerned the “same subject matter”.

70. Finally, as to whether the two suits involved the same parties, the 3 rd Respondent herein and the Appellants directors are agents/representative of the main parties herein and are parties under whom they directly or indirectly claimed. It was therefore an error for the Data commissioner to hold that the suits filed involved different parties.

71. As the High court suit was filed first, it should have been heard first. The Data commission therefore arrived at the wrong finding that the subsequent complaint filed was not sub judice and her holding therefore is an error in law, which then has to be set aside Ex dibito justicea. See ; Petition No E297 OF 2021, Auto Terminal Japan Limited Vs Directorate of Criminal Investigations & Another (2021) Eklr, & Judicial Review 45 of 2020 Republic Vs Paul Kihara Kariuki, Attorney General & 2 Others, Ex parte, Law Society of Kenya (2020) Eklr; Where it was held that “ The multiplicity of suits is unnecessary and impermissible. It would amount to unfairly burdening a Respondent by requiring them to defend the same suit twice which is an affront to the doctrine of Sub judice. It amounts to imprudent use of the courts valuable time.” 72. Having so determined, it is not necessary to determine the merits of the other grounds of Appeal raised. (II) Costs 73. Though, the proviso of Section 27(1) of the Civil Procedure Act , Cap 21 holds that costs follow the event, considering background of the dispute, the long/fruitful business relationship the parties had before the fall out, and the fact that the 1 st Respondent is publicly financed, I find that it would be equitable that each party do bear their own Costs of this Appeal. H. Conclusion & Disposition 74. Consequently, based upon

elaborate analysis of the issues raised, this court proceeds to make the following orders: - a. That this Appeal has merit and is Allowed. b. The complaints filed (ODCP Complaint No 1159 of 2024, Consolidated with ODPC Complaint No 1160 of 2024 and ODCP Complaint No 1161 of 2024 (together, the Complaints), raised issues that were all sub judice and the decision of the Data commissioner dated 25 th October 2024 is hereby set aside in its entirety. c. That the consolidated complaints; (ODCP Complaint No 1159 of 2024, Consolidated with ODPC Complaint No 1160 of 2024 and ODCP Complaint No 1161 of 2024 (together, the Complaints) are hereby Struck out and are Dismissed. d. That Each party will bear their own costs of this Appeal.

75. It is so Ordered. DATED, SIGNED, AND DELIVERED THROUGH CTS/EMAIL THIS 17TH DAY OF AUGUST 2026.

FRANCIS RAYOLA OLEL

JUDGE DELIVERED ON THE VIRTUAL PLATFORM, TEAM THIS …17TH……DAY OF AUGUST 2026. In the presence of: - ……………………N/A……………………………..Appellant ………………………N/A…………………………. Respondent ………………………JARSO……………………….Court Assistant