Ceres Tech Limited v Commissioner, Office of the Data Protection Commissioner [2024] KEHC 12833 (KLR)

Ceres Tech Limited v Commissioner, Office of the Data Protection Commissioner (Judicial Review Application 25 of 2024) [2024] KEHC 12833 (KLR) (Judicial Review) (24 October 2024) (Ruling)

Neutral citation: [2024] KEHC 12833 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Judicial Review

Judicial Review Application 25 of 2024

JM Chigiti, J

October 24, 2024

Between

Ceres Tech Limited

Applicant

and

The Commissioner, Office of the Data Protection Commissioner

Respondent

Ruling

1. The application that is before this court for determination is the one dated 5th February, 2024 where the Applicant seeks the following orders;1. Spent …2. That this Honourable Court be pleased to grant the Ex parte Applicant leave to apply for an order Certiorari to bring into this Honourable Court for purposes of being quashed the ultra-vires decision of The Commissioner Office of the Data Protection Commissioner for award of compensation of combined Kshs. 2,600,000. 00 against the Applicant contained in determination dated 5th January,2024. 3.That this Honourable Court be pleased to grant the Ex-parte Applicant leave to apply for an order of Certiorari to bring into this Honourable Court for purposes of being quashed the Enforcement Notice issued on 6th January 2024. 4.That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of Prohibition to prohibit the Respondent by themselves, agents, employees or whomsoever from taking any steps, actions and/or measures to enforce or implement their decisions contained in the letters dated the 5th January 2024 award for compensation of combined Kshs. 2,600,000. 00 and 6th January Enforcement Notice as against the ex-parte Applicant.5. That this Honourable Court be pleased to grant leave to the Applicant to apply for an order of certiorari and Prohibition to prohibit the Respondent from effecting Regulation 14 (3) e which empowers the Data Commissioner to make an order for compensation as no pecuniary limit has been set by statute and such power is prone to abuse.6. That this Honourable Court be pleased to grant leave to the Applicant to apply for any other Judicial Review orders which it deems fit.7. That the leave sought do operate as a stay of impugned decisions of The Commissioner Office of the Data Protection Commissioner made on the 5th and 6th day of January 2024 respectively.8. That cost of this Application be provided for.

The Applicant’s Case: 2. On 9th and 22nd November, 2023, the Respondent received a notification of complaint from three complainants, namely; David Owuor, Dennis Mwenda and Richard Abongo.

3. The complaint allegedly involved sending of unsolicited promotional messages and calls with view of inducing them to take a loan with a mobile loan application.

4. The Respondent sent a Responses to the Data Commissioner dated 4th December 2023.

5. The Applicant furnished the Respondent with the following to demonstrate its unwavering commitment to protection of personal data and strict adherence to data Protection Act:i.The standard contract between Ceres Tech Limited and consumers.ii.How to fulfill their duty under section 29 of the Data Protection Act as provided under clause 21 of our Data Protection Privacy Policy.iii.Technological and organizational mitigation to prevent reoccurrence of the complaint.iv.An opt out mechanismv.Their Data Protection Policy demonstrating our level compliance with the Act more so clause 13 on how data subjects can explore their rights.vi.The Data Protection Impact Assessment (DPIA).

6. On 5th January 2024 the Respondent arrived at the following determination:a.The Respondent is hereby found liable;b.An enforcement notice to issues to the Respondent,c.An award for compensation is issued to the complainants as follows:i.The 1st Complainant- KES 950,000. 00ii.The 2nd Complainant-KES 700,00. 00iii.The 3rd Complainant-KES 950,000

7. This was followed with an enforcement notice dated 6th January 2024 giving the Respondent giving me 30 days to comply which the Respondent.

8. It is the Applicant’s case that the determination and the notice are tainted with malice, illegality and bad faith because according to the Applicant provided a comprehensive response and disputed the ownership of mobile phone numbers used to contact the complainants.

9. It argues that the Respondent acted ultra-vires and it is unfair, procedurally wrong and excessive use of public power for the Respondent to impose such a punitive damage issued through extra-constitutional powers in awarding financial damages without backing of well-laid evidentiary rules which includes strict proof of damages especially on unquantifiable claims such as emotional distress.

10. It is its case that it was the Ex-parte Applicant's legitimate expectation that the Respondent, having approved its Data Protection Policies was testament to its effectiveness and efficiencies. It is therefore unfair and punitive for the Respondent to renege and callously make unexplainable, unreasonable and unjustifiably exorbitant award against the Applicant.

11. It is its case that fines and compensation can only be awarded by courts once guilt has been established and therefore the decision of the Respondent tantamount to self-delegation of authority.

12. The Respondent's action offends Article 10 (2) (d) of the Constitution of Kenya 2010 more specifically on the issue of transparency and accountability.

13. It is its case that the Respondent's decisions and or actions offends the principles set out in Article 47 Constitution of Kenya 2010.

14. It is his argument that the Respondent is denying the Applicant the equal benefit and equal protection of the law as outlined under Article 27 of the Constitution of Kenya because Company's Act 2015 and also the right to challenge any evidence against the Applicant.

Respondent’s case: 15. The Application dated 5th February 2024 is opposed by the Respondent who makes a case that it was established in 2019 under Section 5 of the Data Protection Act,2019 (the Act) as the institutional framework to give effect to the right to privacy as envisaged in Article 31 (c) and (d) of the Constitution of Kenya,2010.

16. Pursuant to section 56 of the Act, the Respondent received three complaints; - from David Owuor dated 10th October 2023, Dennis Mwenda dated 10th October 2023 and Richard Abongo dated 7th November 2023.

17. They alleged that they had been receiving unsolicited calls and messages from the Applicant. Pursuant to regulation 9 (1) (a) of the Data Protection (Complaints Handling and Enforcement) Procedure Regulations 2021 (hereinafter "the Regulations), the Respondent consolidated the complaints as they all raised similar issues against the Applicant.

18. The Respondent notified the Applicant of the Complaints filed against it via letter dated 9th November 2023 (ODPC/CONF/1/5 VOL 1(541) and 22nd November 2023(ODPC/CONF/1/5 VOL 1(582) giving it 14 days to respond to the allegations.

19. It conducted an exhaustive investigation of the allegations and considered all the evidence adduced by the respective parties in line with Regulation 13 after which the Applicant was found liable for offending numerous provisions of the Data Protection Act.

Analysis and Determination: 20. Upon perusing the application, affidavits the parties’ submissions the court finds the following to be the issues for determination;1. Whether this court has jurisdiction?2. Whether the Applicant is entitled to the orders sought?3. Who will bear the costs of the suit?The 1st Issue:Whether this court has jurisdiction to hear and determine this suit.

21. In Samuel Kamau Macharia & Another v. Kenya commercial Bank & 2 Others, Application No. 2 of 2011 [2012] eKLR, the supreme court pronounced itself on jurisdiction thus [paragraph 68]:“(68)A Court's jurisdiction flows from either the Constitution or legislation or both. Thus, a Court of law can only exercise jurisdiction as conferred by the constitution or other written law. It cannot arrogate to itself jurisdiction exceeding that which Is conferred upon it by law. We agree with counsel for the first and second Jurisdiction to entertain a matter before it, is not one of mere procedural Court cannot entertain any proceedings. This Court dealt with the question of jurisdiction extensively in, Commission (Applicant), Constitutional Application Number 2 of 2011. Where they cannot expand its jurisdiction must operate within the constitutional limits. It confers power upon Parliament to set the jurisdiction of a Court of law or tribunal, court or tribunal by statute law." (Emphasis provided) where it quoted with approval the oft cited case of Owners of Motor Vessel 'Lillian S' v Caltex In Re The Matter of the Interim Independent Electoral Commission where the Court stated:-(29)Assumption of jurisdiction by Courts in Kenya is a subject regulated by the Constitution, by statute law, and by principles laid out in judicial precedent. The classic decision in this regard is the Court of Appeal decision in Owners of Motor Vessel 'Lillian S' v. Caltex Oil (Kenya) Limited [1989] KLR 1, which bears the following passage (Nyarangi, JA at p.14):“I think that it is reasonably plain that a question of jurisdiction ought to be raised at the earliest opportunity and the Court seized of the matter is then obliged to decide the issue right away on the material before it. Jurisdiction is everything. Without it, a Court has no power to make one more step."(underlining supplied)(30)The Lillian 'S' case establishes that jurisdiction flows from the law, and the Recipient-Court is to apply the same, with any limitations embodied therein. Such a Court may not arrogate to itself jurisdiction through the craft of interpretation, or by way of endeavors to discern or interpret the intentions of Parliament, where the wording of legislation is clear and there is no ambiguity. In the case of the Supreme Court, Court of Appeal and High Court, their respective jurisdictions are donated by the Constitution."

22. The Applicant is challenging “the Respondent’s decision to make an award for compensation of Kshs. 2, 600, 000. 00 which is purportedly is termed as an illegal compensation that is unreasonable, irrational, awarded in bad faith, and that it constitutes an abuse of power, is in breach of the rules of natural justice, evidentiary laws and is in breach of the Applicant’s legitimate expectation and invites the Honourable Court to intervene in this matter.”

23. Section 64 of the Data Protection Act provides that a person against whom any administrative action is taken by the Data Commissioner, including in enforcement and penalty notices, may appeal to the High Court.

24. The Applicant did not lodge an appeal in the High Court.

25. What the Applicant has presented before this court amounts to content that should have been advanced through an appeal. The Applicant did not exhaust the available statutory appeal mechanisms under the Data Protection Act.

26. The Applicant has not demonstrated that he made an attempt to lodge an appeal and he could not.

27. It is this court’s finding that the application offends the doctrine of exhaustion. Section 9(2) and (4) of Fair Administrative Actions Act stipulates that:“(2)The High Court or a subordinate court under Sub section (i) shall not review an administrative action or decision under this Act unless the mechanisms including internal mechanisms for appeal or review and all remedies available under any other written law are first exhausted.(4)notwithstanding sub section (3), the High Court or a subordinate court may, in exceptional circumstances and on application by the Applicant, exempt such person from obligation to exhaust any remedy if the court considers such exemption to being the interest of justice.”

28. In the case of Clifford Keya v Jackline Ingutiah & 5 others; Atieno Aoko & 3 others (Interested Party) [2022] eKLR;“The doctrine of exhaustion is applicable to constitutional Petitions. If successfully raised, it is a complete bar and a Court will not move an inch ahead. There are, however, instances where the doctrine will be inapplicable.The doctrine of exhaustion traces its origin in Article 159(2)(c) of the Constitution which recognizes and entrenches the use of alternative mechanisms of dispute resolution.The doctrine is further entrenched in Section 9 of the Fair Administrative Action Act; 2015 which provision forbids the High Court from assuming jurisdiction in matters where a party does not exhaust internal remedies except where exceptional circumstances for exemption are proved to exist.”

29. The suit is not properly before this court.The 2nd and the 3rd issues;Whether or not the Applicant is entitled to the orders sought.

30. Having found that this court lacks jurisdiction, this court cannot determine the other issues and I so hold. I am guided by the Court of Appeal decision in Owners of Motor Vessel 'Lillian S' v. Caltex Oil (Kenya) Limited [1989] KLR 1, which bears the following passage (Nyarangi, JA at p.14):“I think that it is reasonably plain that a question of jurisdiction ought to be raised at the earliest opportunity and the Court seized of the matter is then obliged to decide the issue right away on the material before it. Jurisdiction is everything. Without it, a Court has no power to make one more step."(underlining supplied).

Disposition: 31. This court lacks jurisdiction to determine this suit as a result of failure on the part of the Applicant to lodge an appeal under Section 64 of the Data Protection Act.Order:This suit is hereby struck out with costs to the Respondent.

DATED, SIGNED AND DELIVERED AT NAIROBI THIS 24TH DAY OF OCTOBER, 2024. ………………………………………J. M. CHIGITI (SC)JUDGE