Republic v Data Protection Commissioner; Pande & another (Exparte); Credit Bank PLC (Interested Party) [2024] KEHC 14698 (KLR)

Republic v Data Protection Commissioner; Pande & another (Exparte); Credit Bank PLC (Interested Party) (Judicial Review E142 of 2023) [2024] KEHC 14698 (KLR) (Judicial Review) (25 July 2024) (Judgment)

Neutral citation: [2024] KEHC 14698 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Judicial Review

Judicial Review E142 of 2023

JM Chigiti, J

July 25, 2024

Between

Republic

Applicant

and

The Data Protection Commissioner

Respondent

and

Chantal Marissa Pande And Joel Kunga

Exparte

and

Credit Bank Plc

Interested Party

Judgment

1. The applicants filed Motion dated 27th September 2023 to the following Orders;a.That an Order of certiorari be granted to remove into this Honorable Court and quash the decision of the Data Protection Commission dated 18th September 2023,in respect of the Reference No ODPC/CONF/1/5/VOL 1(316), ODPC Complaint No 1050 of 2023 as consolidated with complaint 1051 of 2023 Chantal Marissa Pande And Joel Kunga-vs- Credit Bank PLCb.That an order of mandamus be issued and directed at the Respondent to readmit for fresh investigations the complaint by the Applicants dated 20th June 2023 and investigate and determine the complaint in compliance with Regulations 11,13 and 14 of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations 2021, The Data Protection (General) Regulations 2021 and documents provided to the Respondent within 90 days from the date of readmission.

2. The application, is grounded upon the statutory statement dated 25th September 2023, and verifying affidavits of Joel Kunga and Chantal Marissa Pande, sworn on even date.

3. The Application is strenuously opposed vide Replying Affidavits sworn by Oscar Onyango Otieno (on behalf of the Respondent) and Wainaina Francis Ngaruiya (on behalf of the Interested Party), on 19th January 2024 and 15th January 2024, respectively.

4. The Interested Party also filed grounds of opposition dated 15th January 2024.

The Applicants’ case; 5. The Applicants allege that the Respondent ignored the mandatory possession of Regulations 11, 13 and 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (hereinafter referred to as "the Enforcement Regulations").

6. The Applicants argue that the Respondent expressly excluded them from hearing, thus violating their right to a fair hearing under Article 50 of the Constitution of Kenya, 2010.

7. The Applicants further argue that the Respondent's decision demonstrates apparent bias as against them, as it failed to hear their evidence; and thus, in violation of the principles of natural justice and Fair Administrative Action principles.

The Respondents case; 8. It is the Respondents' case that it complied with the procedure stipulated in the Constitution, the Act and the attendant regulations in admitting, investigating and determining the complaint.

9. The Respondent further submits that the Applicants have not tendered proof of violation of their right to fair hearing, arbitrariness of the Respondent's decision, as well as the basis of each of their other grievances.

10. It is the Respondent's case that no evidence has been adduced to qualify the said violations. All matters generally relating to evidence are within the purview of the Evidence Act, cap. 80, Laws of Kenya.

11. To this end, Sections 107(1), (2) and 109 of the Evidence Act, require whoever desired any court to give judgement as to any legal right or liability and depended on the existences of facts, he or she had to prove that those facts existed.

12. This position was upheld by the courts in M'Bita Ntiro v Mbae Mwirichia & another (2018) eKLR and Pastoli -vs- Kabale District Local Government Council and others [2008] 2 EA 300.

13. It is its case as clearly pointed out at paragraphs 11,12,13 and 14 of the Replying Affidavit, the Applicants have simply listed alleged violations at paragraphs 3 to 8 of their Verifying Affidavits sworn on 25th September 2023without elaborate particulars of the said violations.

14. The latter discursive allegations must equally fail for lack of proof and/or evidence to substantiate their invoking.

15. It is further not lost to the Respondent that, if a decision-maker has determined that a particular consideration is relevant to its decision, it is entitled to attribute to it whatever weight it thinks fit, and the courts will not interfere unless it has acted in a "Wednesbury unreasonable"manner [per Mativo J. (as he then was) in Republic v Public Procurement Administrative Review Board & 2 others Ex-Parte Pelt Security Services Limited [2018] eKLR at paragraph 64]. The test of Wednesbury unreasonableness has umpteen times been stated to be that the impugned decision must be "objectively so devoid of any plausible justification that no reasonable body of persons could have reached it"[Bromley London Borough Council vs Greater London Council (1983)1 AC 768 (at [821]] and that the impugned decision had to be “verging on absurdity” in order for it to be vitiated. [Puhlhofer v Hillingdon London Borough Council [1986]1 AC 484]. Mativo J., further put across the propositions on what constitutes unreasonableness in Republic v Kenya Revenue Authority & another; Shapi & 3 others (Ex-parte) (Judicial Review E038 of 2021) [2021] KEHC 401(KLR) (16 December 2021) (Judgment) at paragraph 89.

16. According to the Respondent, no justifiable reasons have been advanced by the Applicants to demonstrate that the Respondent acted in a Wednesbury unreasonable manner in the determination dated 18th September 2023.

17. Based on the foregoing, the Respondent submits that it complied with the procedure stipulated in the Constitution, the Act and the attendant regulations in admitting, investigating and determining the complaint.

18. The Respondent further submits that the object and purpose of ODPC under Regulation 3(a) of the Enforcement Regulations is to facilitate the fair, impartial, just, expeditious, proportionate and affordable determination of complaints lodged, without undue regard to procedural technicalities.

19. The latter position mirrors Article 159(2)(d) of the Constitution of Kenya, 2010. To this end, the Respondent invites this Honourable Court to disregard the strictures the Applicants purportedly impose in their statutory statement and in their Verifying Affidavits, in light of the right of access to justice and promotion of the rule of law under Article 10(2) of the Constitution.

20. It is its case that the operative word under Section 57 of the Act and Regulation 13 of the Enforcement Regulations is may, indicating that the latter does not bestow a mandatory provision, and the Respondent was open to investigate the complaint in any of the stipulated options.

21. It is against that backdrop that the Respondent incorporated Regulation 13 (1)(d) of the Regulations in investigating the documents produced in the Applicants' complaints dated 20th June 2023 and the Interested Party's response dated 10th July 2023.

22. To this end, Courts have umpteen times adopted a purposive approach in interpreting statutes. For instance, the Supreme Court of India in Reserve Bank of India v Peerless General Finance and Investment Co. Ltd., 1987 SCR (2)1 expressed the need for a statute being looked at with the glasses of the statute-maker to ensure that no part of a statute and no word of a statute can be construed in isolation.

23. The Respondent invites this Honourable Court to read Section 57 of the Act and Regulations 13 of the Enforcement Regulations conjunctively and give them their purposeful meaning within the prevailing context, contrary to the Applicants' arguments.

24. The same vein, the Respondent submits that that contrary to the grounds put across by the Applicants in their application dated 27th September 2023,the statutory statement dated 25th September 2023 and their verifying affidavits sworn on even date, the procedure followed in the investigations and determination of the Applicants' complaint complied with Articles 47 and 50 of the Constitution, Section 4 of the Fair Administrative Action Act, and Regulations 6, 11, 13 and 14 of the Data Protection (Complaints Handling Procedure and Enforcement)Regulations, 2021.

The interested party’s case; 25. The Interested Party opposes the Ex-Parte Applicants' Application dated 27th September 2023 including their Notice of Motion, Statutory Statement and Verifying Affidavit on the following grounds, inter alia:

26. The Respondent followed the necessary procedure as mandated by the Data Protection (Complaints Handling and Enforcement Procedure) Regulations 2021 from the admission of the complaint to its determination.

27. Regulation 13 of the Data Protection (Complaints Handling and Enforcement Procedure) Regulations 2021 is not a mandatory provision.

28. The Interested Party was not liable for the alleged infringement of the Data Protection Act 2019.

29. Granting the Ex Parte Applicants' application will be double jeopardy to the Interested Party as it will be required to go through the same vexatious process twice with no obvious benefit.

30. In the grounds of opposition, it argues that the Respondent followed the necessary procedure as mandated by the Data Protection (Complaints Handling and Enforcement Procedure) Regulations 2021 from the admission of the complaint to its determination.

31. Regulation 13 of the Data Protection (Complaints Handling and Enforcement Procedure) Regulations 2021 is not a mandatory provision. It provides that the Respondent may conduct investigations in the various ways enumerated in that Regulation.

32. It believes that the Respondent, in this case opted to conduct investigations as provided under Section 57(b) of the Data Protection Act 2019 and Regulation 13(1)(d) of the Data Protection (Complaints Handling and Enforcement Procedure) Regulations 2021, that is, by requiring the Interested Party to produce documents and information.

Analysis and determination 33. The Respondent admits that it incorporated Regulation 13 (1)(d) of the Regulations in investigating the documents produced in the Applicants' complaints dated 20th June 2023 and the Interested Party's response dated 10th July 2023.

34. While the Applicant is of a contrary view, the Respondent’s believes that it complied with the procedure stipulated in the Constitution, the Act and the attendant regulations in admitting, investigating and determining the complaint.

35. The Applicants argue that the Respondent expressly excluded them from hearing, thus violating their right to a fair hearing under Article 50 of the Constitution of Kenya, 2010.

36. To my understanding, these regulations call or give the commissioner of the data protection the discretion to decide how the investigations are going to be conducted.

37. In order to be said to have complied with the dictates of fair hearing and Article 50 of the Constitution, a party who is likely to be affected by the outcome of the investigations, must be informed as of right,the method or the form of hearing or the investigations that the commissioner has decided to adopt under Regulation 13(1).

38. The person affected or like to get a back affected by the outcome of the investigation, must be informed in clear terms by the decision maker of the form of the hearing.

39. Regulation 13(1) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 provides that in investigating a complaint, the Data Commissioner may, subject to section 57 of the Act;a.issue summons in Form DPC 4 set out in the Schedule requiring the attendance of any person at a specified date, time and place for examination;b.examine any person in relation to a complaint;c.administer an oath or affirmation on any person during the proceedings;d.require any person to produce any document or information from a person or institution; ande.on obtaining warrants from the court, enter into any establishment or premises and conduct a search and may seize any material relevant to the investigation.(2)Upon completion of the investigation, the Data Commissioner shall prepare an investigation report.

40. In the process of exercising discretion under Regulation when it comes to deciding the approach to adopt in determining the claim under Regulation 13, the commissioner must communicate and inform the parties that are likely to get affected by her decision in very clear terms the method she is going to adopt in the determination of the complaint. The parties must not be left guessing. This goes towards promoting the right to fair hearing under Article 47 and 50 of The Constitution.

41. I have looked at the communication sent by the data commissioner to the applicants and I do not find anywhere where the data commission informed the applicant that it’s going to embrace the investigation method, under Regulation 13 which does not call for their attendance submissions or arguments or highlighting.

42. There is a possibility that the Applicants would have preferred that the hearing was conducted differently. In effect, this left the applicants in an uncertain state when it comes to the procedure to be adopted by the Commissioner and it is no wonder they have moved this court.

43. A court, a tribunal or commission or any decision making administrative body that fails to inform the person who is likely to be adversely affected by a decision of the procedure to be adopted where there are many options like in the case of Regulation 13(1) is a sham. Such a procedure is illegal and unacceptable since it offends the rule of law as guaranteed under Article 10 of the Constitution. It goes without saying that a decision that is arrived at the result of such procedure is illegal. This information should be sent out prior to or at a very early stage in the trial stage.

44. The importance of informing the person who is under investigation of the approach that the Commissioner has decided to adopt is cannot be gainsaid. It informs the subject of how they will prepare for the hearing the documents they will present the investigations, the money which will cross examine the form of highlighting the want to embrace. This cannot be taken away.

45. In Republic v Cabinet Secretary, Ministry of Agricultures, Livestock & Fisheries; Cabinet Secretary, Ministry of Industry, Trade & Co-operatives (Interested Party) Tanners Association of Kenya (Suing through its Chairman Robert Njoka Ex Parte Applicant [2019] eKLR, the Court stated as follows at paragraph 23 of the judgment:“Safeguarding legality is the most important purpose for the judicial review of administrative actions. Thus, a person seeking judicial review of an administrative decision must be able to persuade the court that there are grounds for review in order for the legality of the administrative decision to be judicially challenged. In one sense, there must always be the premise of “want of legality.” Differently stated, in response to a challenge to the legality of administrative action, courts generally need to consider the compliance with both substantive and procedural legal rules. This is because any administrative decision-making process involves the exercise of legally conferred powers and the observation of legally prescribed procedures.”

46. Section 4(3) provides as follows: Where an administrative action is likely to adversely affect the rights or fundamental freedoms of any person, the administrator shall give the person affected by the decision-prior and adequate notice of the nature and reasons for the proposed administrative action, an opportunity to be heard and to make representations in that regard;

47. I have placed Regulation 13 in the scale of Section 4 of the Fair Administrative action act and it is my finding that regulation 13 is not in conformity with section 4 (3) of the fair administrative action act in so far as the requirement for prior and adequate notice of the nature and reasons for the proposed administrative action is concerned.

48. The Respondent sent a letter to the bank, raising the concerns in the complainant. The letter is very clear in terms of the mandate of the commissioner. The power to investigate and the potential consequences for noncompliance with the demand is set out in the letter. The letter does not inform the parties of the form of hearing that the respondent will embrace and Regulation 13.

49. The right to fair hearing is evidently closely intertwined with fair administrative action. The often cited case of Ridge vs. Baldwin [1964] AC 40 restated the right to fair hearing as a rule of universal application in the case of administrative acts or decisions affecting rights. In his speech to the House of Lords in 1911, Lord Loreburn aptly put is as a ‘duty lying upon everyone who decides anything’ that may adversely affect legal rights.

50. Halsbury Laws of England, 5th Edition 2010 Vol. 61 at para 639 on the right to be heard states that:“The rule that no person is to be condemned unless that person has been given prior notice of the allegations against him and a fair opportunity to be heard (the audi alteram partem rule) is a fundamental principle of justice. This rule has been refined and adapted to govern the proceedings of bodies other than judicial tribunals; and a duty to act in conformity with the rule has been imposed by the common law on administrative bodies not required by statute or contract to conduct themselves in a manner analogous to a court.”

51. In the case of Pastoli vs Kabale District Local Government Council & Others, (2008) 2 EA 300, that:“In order to succeed in an application for Judicial Review, the applicant has to show that the decision or act complained of is tainted with illegality, irrationality and procedural impropriety: See Council of Civil Service Union v Minister for the Civil Service [1985] AC 2; and also, Francis Bahikirwe Muntu and others v Kyambogo University, High Court, Kampala, Miscellaneous Application Number 643 of 2005 (UR).Illegality is when the decision-making authority commits an error of law in the process of taking the decision or making the act, the subject of the complaint. Acting without Jurisdiction or ultra vires, or contrary to the provisions of a law or its principles are instances of illegality….Irrationality is when there is such gross unreasonableness in the decision taken or act done, that no reasonable authority, addressing itself to the facts and the law before it, would have made such a decision. Such a decision is usually in defiance of logic and acceptable moral standards: Re An Application by Bukoba Gymkhana Club [1963] EA 478 at page 479 paragraph “E”.Procedural impropriety is when there is failure to act fairly on the part of the decision-making authority in the process of taking a decision. The unfairness may be in non-observance of the Rules of Natural Justice or to act with procedural fairness towards one to be affected by the decision. It may also involve failure to adhere and observe procedural rules expressly laid down in a statute or legislative Instrument by which such authority exercises jurisdiction to make a decision. (Al-Mehdawi v Secretary of State for the Home Department [1990] AC 876).”

Disposition: 52. The applicants have made out a case for the grant of the orders sought.

53. Order:1. An Order of certiorari is hereby granted to remove into this Honorable Court and quash the decision of the Data Protection Commission dated 18th September 2023, in respect of the Reference No. ODPC/CONF/1/5/VOL 1(316), ODPC Complaint No 1050 of 2023 as consolidated with complaint 1051 of 2023 Chantal Marissa Pande And Joel Kunga-vs- Credit Bank PLC.2. An order of mandamus is hereby issued and directed at the Respondent to readmit afresh the complaint by the Applicants dated 20th June 2023 and determine the complaint within 30 days from the date of readmission within the framework of Section 4(3) of The Fair Administrative Action Act.3. Costs to the Applicant.

DATED, SIGNED, AND DELIVERED VIRTUALLY THIS 25ND DAY OF JULY, 2024CHIGITI J (SC)JUDGE