Safaricom PLC v Simon Billy Kinuthia, Brian Wamatu Njoroge & Benedict Kabugi Ndungu [2021] KEHC 13014 (KLR)

REPUBLIC OF KENYA

IN THE HIGH COURT OF KENYA AT NAIROBI

CIVIL DIVISION

CIVIL SUIT NO. 194 OF 2019

SAFARICOM PLC................................................PLAINTIFF/APPLICANT

VERSUS

SIMON BILLY KINUTHIA.......................1ST DEFENDANT/RESPONDENT

BRIAN WAMATU NJOROGE.................2ND DEFENDANT/RESPONDENT

BENEDICT KABUGI NDUNGU...............3RD DEFENDANT/RESPONDENT

RULING

1. The application for consideration is the plaintiff’s Notice of Motion dated 19th September 2020, brought under Section Article 31(c)of the constitution of Kenya, Section 3,3A & 63(e)of theCivil Procedure Act Cap 21 order 40 Rule 2 of the Civil Procedure Rules. The application seeks the following orders:

i.Spent

ii.Spent

iii.A temporary injunction be and is hereby issued, pending the hearing and determination of the suit, restraining the 1st,2nd and 3rd defendants, their agents, servants, employees, or anyone acting under their instruction from publishing disseminating, sharing electronically or in print media, transferring, selling or offering for sale or in any other way whatsoever disclosing the personal subscriber data of any of the plaintiff’s subscribers and of any of the alleged 11,5 million subscribers.

iv.The costs of this application be awarded to the plaintiff against the defendants jointly and severally.

The application is supported by the following summarized grounds:

i. The 1st and 2nd defendants were hitherto the Plaintiff’s employees holding the positions of senior Manager, Networks and M-Pesa systems auditor and Head of Regional expansion respectively. The 1st defendant, in his position as senior Manager, Network and M-Pesa systems auditor, was entitled to access and did in fact access confidential subscriber data to enable him discharge his duties.

ii. The 1st defendant together with the 2nd defendant, in breach of their contractual and statutory duty to keep the data so accessed confidential, decided to offer the data for sale to the highest bidder.

They enlisted the help of the 3rd defendant who was said to be capable of organizing the sale of the data to a leading sports betting company.

iii. The plaintiff, on learning of the breach of statutory duty, lodged a complaint with the Directorate of criminal investigations (DCI) which arrested and charged the 1st and 2nd Defendants in Nairobi Chief Magistrate’s Court criminal case No. 962 of 2019; Republic –V- Simon Billy Kinuthia and Brian Wamatu Njoroge and Nairobi Chief Magistrate Court criminal case No. 979 of 2019; Republic –V- Benedict Kabugi Ndungu.

iv. The plaintiff has through the DCI obtained an extract of conversation between the 1st and 2nd defendants demonstrating how the illegal access to subscriber data was affected.  It has further learnt that the unlawfully accessed data was obtained from its servers and sent to a google drive controlled by the 1st defendant who then shared with 2nd and 3rd defendants who downloaded it to their personal laptops.

v. A Mr. Charles Njuguna Kimani who was said to be involved had his personal laptop seized and safely stored by the DCI. The personal laptops owned by the 2nd and 3rd defendants have yet to be secured.

vi. Further, the plaintiff has not been able to obtain access to the google drive operated by the 1st defendant nor has it been able to remotely access and delete the subscriber data contained in the said google drive. The said subscriber data could be transferred, sold or disseminated to other third parties.

vii. That unless the 1st, 2nd and 3rd defendants are restrained by injunction as sought here, they will continue with their unlawful activities thus causing the following irreparable injury to the plaintiff and the general public;

a) They will disclose confidential data of millions ofsubscribers this exposing the plaintiff to numerous lawsuits.

b) The plaintiff may be subjected to regulatory action under domestic statutory provisions.

c) The personal and confidential data of millions of the plaintiff’s subscribers may be disclosed in the violation of their rights under Article 31 (c) of the Constitution.

2. The application is further supported by two affidavits sworn on different dates by Daniel M. Ndabaa the senior Manager litigation, of the plaintiff.     In the affidavit sworn on 9th September 2019 he has averred to all the facts stated in the supporting grounds.

3. He has deponed that the plaintiff/applicant does not have access to personal laptops which availed access to the google drive and whose data could be transferred, sold or disseminate to third parties. He confirms that Charles Njuguna Kimani’s laptop was confiscated.

4. Further, he avers that unless the 1st, 2nd and 3rd defendants are restrained by an injunction they will cause irreparable injury to the plaintiff and the public including disclosure of confidential data of millions of subscribers in violation of their rights and the plaintiff/applicant will be subjected to regulatory action and numerous law suits.

5. In the further affidavit sworn on 20th January 2020 by Mr. Ndaba, avers that the 3rd defendant/respondent was approached by persons known as Mark and Charles with a request to help sell the data. That there was a handwritten statement of Charles Njuguna Kimani making an admission that the source of data was the 1st and 2nd defendants, and their text messages between them confirmed that it was sent to the google drive through texts.

6. He deponed that the 1st defendant has filed a petition no.248 of 2019 challenging the manner in which the watsapp texts were obtained. The plaintiff upon becoming aware of the said petition filed an application to be enjoined as an interested party, and there’s no stay stopping the use of the said texts and that the said evidence is fundamental to facilitate the ends of justice.

7. The plaintiff/applicant believes that if the 1st, 2nd and 3rd defendants indeed do not have the data as they want this honourable court to believe, they would not be resisting the grant of the injunction as much as they are doing.  He adds that there is nothing that stops criminal and civil matters running concurrently.

8. In opposition to the application, the 1st and 2nd defendants, (Mr. Simon Billy Kinuthia and Mr. Brian Wamatu Njoroge), swore a replying affidavit on the 2nd day of October 2019. They deposed that the plaintiff/applicant failed to meet the fundamental threshold for granting injunctive orders by this court.   That they did not demonstrate a prima facie case with a probability of success nor that they would likely suffer irreparable harm if an injunction is not granted.

9. They deposed that they never offered for sale confidential subscriber data to any party nor had any discussion with anyone for the sale of safaricom confidential subscriber data.  They admitted having been arrested and that the 1st defendant/respondent was subjected to torture and inhumane treatment.   The same is the subject of adjudication in the constitutional petition.   They aver that it would be prejudicial, unfair, unjust and against the principles of subjudice for this honourable court to rely on impugned documents to make a determination in this matter.

10. Further, they have denied having any confidential subscriber data in their possession outside their official duties as safaricom employees which have been in their safaricom issued laptops that they surrendered upon termination of employment. They state that the plaintiff/applicant came to this court with unclean hands and does not deserve equitable remedies as it seeks to subvert the course of justice.

11. In the 3rd defendant’s replying affidavit sworn on 26th November 2019, he avers that he was approached by two individuals who identified themselves as Mark and Charles and represented themselves as employees of safaricom.  They had in their possession subscribers’ data of at least eleven million subscribers and they sought his assistance to link them up with the management of a leading betting company as they intended to sell the data.

12. He deposed that after realizing that the data was irregularly and unlawfully obtained he reported it to the Central police station under OB number 80/22/5/2019 as a cybercrime incident.  Through various communication with the plaintiff/applicant’s senior management he was requested to continue with the deal in order, to help the investigating officers identify the individuals involved in the crime.  Mark and Charles were eventually arrested.  He does not however state who Mark and Charles are.

13. He denies ever owning a laptop that allows him to disseminate the subscriber’s data as alleged by the plaintiff/applicant and that the application herein is scandalous and vexatious and a mere strategy to defeat the ongoing proceedings in Nairobi Petition No.247 of 2019 where he has sought orders to advertise the petition to all persons who may be affected.   He accuses the plaintiff/applicant of making false allegations against him.

14. Further, he avers that if the plaintiff/applicant had a legitimate claim against him in relation to the injunctions sought it would have pursued them in the proceedings pending in the said petition since that court has the jurisdiction to grant the injunction reliefs pursuant to article 23(3) of the constitution.

15. The application was canvassed by both written and oral submissions while highlighting his written submissions, Mr. Munge for the plaintiff/applicant emphasized that this is a case of breach of contractual duties and he relied on Section 27 (a) (ii) c of Kenya Information Communication Actthat data must be protected and the defendants had violated it. That Section 27 (a) (iv)KICA provides for the sentence/fine as penalty as follows;

“Any person who contravenes any regulation made under this section commits an offence and shall be liable on conviction to a fine not exceeding three hundred thousand shillings, or to imprisonment for a term not exceeding three years, or to both.”

16. In the written submissions Mr. Munge has given an introduction of all the parties which information is contained in the affidavits filed.   The duties performed by the defendants/respondents have also been well highlighted.   Reports were received against the defendants/respondents which reports were forwarded to the (DCI) vide a letter dated 30th May 2019 (annexture DNI).

17. The investigations culminated in the filing of Nairobi Chief Magistrate’s Criminal Case No. 962 of 2019 and Nairobi Chief Magistrate Criminal Case No. 979 of 2019 where the defendants/applicants are the accused (DN2(a) & (b)).   Annexture “DN-3” is part of the investigations, showing how links were created and data accessed.

18. Counsel has referred to section 27(A)(2)(c) of the Kenya Information & Communication Act (KICA) which gives the plaintiff/applicant the statutory duty to keep subscribers information secure and confidential.   That the 1st and 2nd defendants as employees of the plaintiff/applicant were duty bound to comply with this provision.  Any breach of it attracts a penalty of upto Kshs 5 million (Section 31 of KICA).

19. Counsel has submitted that the material in the affidavits confirms that the 1st and 2nd defendants/respondents breached Section 27(A)(2)(c) of the KICA and that the 3rd defendant/respondent was involved.Referring to the replying affidavit by the 3rddefendant/respondent and in particular paragraphs 9, 11, 18, 22, 23, 26 Counsel submits that the deponent has admitted having had the data complained of and what he was doing or planning to do with it.   The said replying affidavit also confirms the involvement of the 1stand 2nddefendants/respondents.   Counsel has also referred to Annexture DN1 (supplementary affidavit) to support the above as concerns the 11,500,000 subscribers.

20. Mr. Munge while referring to Articles 28 and 31 of the constitution and the cases of Okiya Omtata Okoiti vs Communication Authority of Kenya & 8 others [2018] eKLR (ii) Petition No. 361 of 2016 – Rashanara Ebrahim v Ashleys Kenya Ltd & 3 othersstressed on the sanctity of the rights to privacy and dignity, as enshrined in the constitution.   He submitted that the plaintiff/applicant has established a prima facie to warrant the issuance of the orders sought in prayers 3 of the application dated 9th September 2019.

21. In highlighting the submissions Mr. Munge for the plaintiff/applicant also stressed that at stake is confidential data of the list of subscribers.   He pointed out that the submissions by the defendants/respondents contradict what is in the 3rd defendant’s replying affidavit.  Compensation in any event would not be adequate as there is even a risk of suits being filed against the plaintiff and it could even be subjected to regulatory discipline.   Counsel submitted that criminal and civil proceedings can proceed simultaneously contrary to the defendants/respondents’ submissions.

22. The 1st and 2nd defendants/respondents filed joint submissions dated 2nd June 2020 by both their counsel in which they gave facts of the case.   They set out what is required to be proved before an order of injunction is granted as set out in the case of Giella vs Cassman Brown [1973 E.A. 358.   On the issue of establishment of a prima facie case counsel relied on the cases of Mrao Ltd vs First American Bank of Kenya Ltd & 2 others (2003) KLR 125; Microsoft Corporation v Mitsumi Garage Ltd (2001) E.A. 129; American Cyanamid vs Ethicon Ltd (1975) AC 396.   They referred to the plaintiff/applicant’s supporting affidavits and submitted that the evidence in possession of the plaintiff/applicant was irregularly obtained as they contravene sections 65(5)(i)(6)(8) and 106(B) of the Evidence Act.

23. Counsel have referred to the case of John Lokitare Lodinyo vs I.E.B.C & 2 others [2018] eKLR (paragraphs 54 & 55) and Richard Nyagaka Tong’i vs IEBC & 2 others [2013] eKLR(para 27).   They raised issue on the admissibility of the unsworn statement of Charles Njuguna Kimani DN relied on by the plaintiff/applicant.  On this they referred to the case of Nancy Kajuju & 4 others v Republic [2009] eKLR among others.   They have argued that Section 163 of the Evidence Act was not adhered to and so the statement (DN-4) should not be considered.

24. Counsel submitted that for a prima facie to be established the plaintiff needed to establish that indeed the 1st and 2nd defendants were in possession of the alleged subscriber data.   On this counsel referred to the case of Winfred N. Maina vs Peterson Onyiego Gichana[2015] eKLRwhere it was held:

“I am concerned mostly with the evidential burden which initially rests upon the party bearing the legal burden which initially rests upon the party bearing the legal burden, but as weight of evidence given by either side during the trial varies, so will the evidential burden shift to party who would fail without further evidence ….Therefore ,the applicant must first lay a prima facie evidence against the respondent if evidential burden is to be created on the shoulders of the Respondent”

25. Counsel have also argued that the 1st and 2nd defendants’ rights to privacy have been interfered with by the plaintiff’s actions.    Secondly that any injunctive orders issued would highly prejudice the said defendants as they would impute guilt on them in Criminal Case No. 969 of 2019.   Relying on the case of Kuria & 3 others vs Attorney General [2002] 2 KLR 69counsel have submitted that the normal procedure in the co-existence of civil and criminal proceedings is to stay the civil proceedings; as issuance of any injunctive orders would prejudice the defendants and cause them untold hardship and suffering.   This to them is a higher risk of injustice compared to that to be suffered by the plaintiff if any.    Referred to is the case of Amir Suleiman v Amboseli Resort Limited [2004] eKLR.

26. Counsel have further submitted that the plaintiff/applicant is indeed seeking for a quia timet injunction whose conditions it has not met.   They have also submitted that this matter is res judicata as the 3rd defendant has instituted constitutional Petition No. 247 of 2019 citing the plaintiff’s contravention of the subscribers rights to privacy.  To them the issue in that said Petition and this suit are the same.

27. Finally it was counsel’s submissions that the court should be guided by the remarks of Onyango Otieno, Nambuye & Karanja JJA inStephen Mbugua Mwagiru and another v Tatu City Limited & another (2012)where it is held interalia:

“We were being asked to issue an injunction based on anticipatory future speculative conduct of counsel for the respondent, in our view, this is not plausible. Temporary injunctions by their own nature are meant to prevent defendants/respondents from defined conduct for a specified or set of period of time. They cannot be issued where the defendant /respondent’s action is only speculated; where it is not even known whether the defendant/respondent will engage in the conduct in question and if so when he may be inclined to do so”

They urged the court to disallow the application.

28. The 3rd defendant/respondent’s submissions dated 6th April 2020 were filed by M/s Sigano & Omollo LLP advocates.   Counsel have given a background to this matter and raised four (4) issues for determination as follows:

(a) Whether the application as against the 3rd defendant herein is sub judice having regard to the Nairobi High Court Constitutional Petition No. 247 of 2019; Benedict Kabugi Ndungu v Safaricom PLCand the effect thereof.

(b) Whether the Application as against the 3rd defendant is an abuse of process of this Honourable Court and the effect thereof.

(c) Without prejudice to the sub judice arguments above, whether the plaintiff/applicant has satisfied the conditions for grant of interlocutory injunction as against the 3rd defendant/respondent in the circumstances herein and the effect(s) thereof.

(d) Whether the plaintiff should be awarded costs of the application having regard to its conduct herein.

29. On the first issue he has referred to Section 6 of the Civil Procedure Act which provides:

“No court shall proceed with the trial of any suit or proceeding in which the matter in issue is also directly and substantially in issue in a previously instituted suit or proceeding between the same parties, or between parties under whom they or any of them claim, litigating under the same title, where such suit or proceeding is pending in the same or any other court having jurisdiction in Kenya to grant the relief claimed.”

30. Counsel goes on to submit that there is Petition No. 247 of 2019 (Benedict Kabugi Ndungu v Safaricom PLC filed on 21st June 2011 by the 3rd defendant before the Constitutional and Human rights division of the High court.   He argues that the issue in the said petition and present suit is the same, which is the irregular disclosure of subscriber data of 11,500,000 people.   He contends that this suit is sub-judice and should not be allowed to proceed against the 3rd defendant.  See Thiba Min Hydro Co. Ltd v Josphat Karu Ndwiga [2013] eKLR; Republic v Kenya Revenue Authority exparte CMC Di Ravenna (Kenya) [2019] eKLR; Standard Chartered Bank Ltd vs Jenipher Atieno Odok HCCC No. 120 of 2003.

31. On the second issue counsel has submitted that the application against the 3rd defendant/respondent is an abuse of the process of this court.   The reason he gives is that it is the 3rd defendant who was aggrieved by the irregular and unlawful disclosure of the confidential data and instituted the Petition No. 247 of 2019.   He argues that the plaintiff/applicant’s pleadings herein differ from its averments in the above mentioned petition.   To buttress this, counsel referred to the case of Muchanga Investments Ltd v Safaris Unlimited (Africa) Ltd & 2 others [2009] eKLR,saying abuse of process of court entails knowingly and dishonestly using the legal process to accomplish an ulterior purpose other than the pursuit of justice.

32. On the 3rd issue counsel has submitted that no cause of action has been  disclosed against the 3rd defendant/respondent as required by the law.  He  cited the 3 conditions set out in the Giella Cassman Browncase(1973)  EA 358.   He adds that no prima facie case has been established by the  plaintiff/applicant against the 3rd defendant/respondent as settled in the  cases of (i) Mrao Ltd v First American Bank of Kenya Ltd & 2 others  [2003] eKLR (ii)  Nguruman Limited v Jan Bonde Nielsen & 2 others  [2014] eKLR.

33. Counsel argues that according to the Nguruman case (supra) the plaintiff/applicant in seeking an injunction ought to demonstrate that it has a right against the 3rd defendant which has been threatened with violation.   According to him no such claim has been made by the plaintiff against the 3rd defendant/respondent.   That the rights claimed are those of breaching the rights under Article 31 which are the subject of Petition No. 247 of 2019 and are therefore subjudice.

34. It is Counsel’s submission that the plaintiff/applicant will not suffer irreparable injury if the injunction is not granted.   Referring to ground No. 13 of the application counsel submits that the only injury shown is exposure to numerous law suits and regulatory action under domestic statutory provisions.   He argues that this is not irreparable as the damage is quantifiable, and that would be sufficient compensation.

35. On the 4th issue he has submitted that the award of costs is covered under section 27(1) of the Civil Procedure Act and is a discretionary exercise.   Referring to several authorities he argued that the plaintiff/applicant failed to demonstrate that the 3rd defendant/respondent condoned the actions by the 1st and 2nd defendants/respondents as alleged or at all.   He finally urged the court to dismiss the application against the 3rd defendant/respondent.

Analysis and determination

36. Upon considering the notice of motion, affidavits, annextures,  submissions and authorities by counsel for all parties, I find this  application to be raising the following issues for determination:

a)  Whether on the evidence and material placed before court, the plaintiff/applicant has satisfied the conditions upon which a temporary injunction can be granted.

b)  Who should pay costs.

37. The conditions for consideration for granting an injunction were well settled in the case of Giella vs. Cassman Brown & Company Limited (1973) E A 358. They were stated to be as follows:

"First, an applicant must show a prima facie case with a probability of success.  Secondly, an interlocutory injunction will not normally be granted unless the applicant might otherwise suffer irreparable injury, which would not adequately be compensated by an award of damages.  Thirdly, if the Court is in doubt, it will decide an application on the balance of convenience."

38. Order 40 Rule 1 of the Civil Procedure Rules which deals with grant of a temporary injunction provides:

“a proof that any property in dispute in a suit is in a danger of being wasted, damaged or alienated by any party to the suit or wrongfully sold in execution of a decree or that the defendant threatens or intends to remove or dispose the property, the court is in such situation enjoined to grant a temporary injunction to restrain such acts.”

In the instant case the subject at stake is subscribers’ data which was given to the plaintiff by subscribers and which has to be handled in confidence.

39.  From the outset I wish to state that the matter I am handling now, is an application for an injunction and not the entire suit.   Counsel for the defendants have written submissions addressing all the issues in the case as if it was finalized.   I am only going to restrict myself to the issue at hand as delving into other issues will make it appear as if this court is making a final determination of the suit and other similar ones.

40.  A right to a fair hearing and due process of the law is enshrined in Article 50 of the constitution.   In the case of Thomas Edison Ltd v Bathock1912 15 C.L.R 679 it was held thus:

“There is a primary precept governing administration of justice that no man is to be condemned unheard and therefore, as a general rule no order should be made to the prejudice of a party unless he has the opportunity of being heard in defence,  but instances occur where justice  could not be done unless the subject matter of the suit is preserved and, if that is in danger of destruction by one party or if irremediable by one party interim orders may issue to give room for the court to determine the dispute on  the merits.”

It therefore means there are instances where an interim order for preservation of a subject may issue to await the full hearing of the matter.

41. On whether the plaintiff/applicant has established a prima facie case, it  is clear that a complaint was raised over the interference with subscribers  data in the possession of the 1st and 2nd defendants who were the  plaintiff’s employees.   The role played by the 3rd defendant has also been  explained. I will not get into the details as the matter has been  investigated and the defendants are facing criminal charges in the  Nairobi Chief Magistrate’s court. The subscribers whose data is  affected by the access complained of are 11,500,000. This is not  something to be taken lightly.

42. The court in the case of Moses C. Muhia Njoroge & 2 others v Jane W. Lesaloi & 5 others[2014] eKLRwhile citing Mrao Ltd (supra) defined a prima facie case as follows:

"A Prima facie case in a civil application includes but not confined to a genuine and arguable case.  It is a case which on the material presented to the court, a tribunal properly directing itself will conclude there exists a right which has apparently been infringed by the opposite party as to call for an explanation or rebuttal from the later”.

43.  The material presented before this court in form of affidavits, in particular the replying affidavit by the 3rd defendant/respondent and the annextures reveals the need for an investigation into the matter which has already been done hence highly disclosing the need for the subscribers data to be preserved and protected.

44.  An issue has been raised by the 3rd defendant/respondent in respect to Petition No. 247 of 2019 at the Constitutional & Human Rights Division.   The said Petition does not involve the 1st and 2nd defendants herein who are said to have been employees of the plaintiff and in possession of the subscribers’ data by virtue of their employment.

45. The filed affidavits have explained how the 3rd defendant comes into the picture and that is not something for discussion now.  The issue of the said petition and this suit cannot be sorted out at this point through this application. It will be dealt with when the pre-trial conferences in the two matters are done and directions given on the way forward.

46. Another issue raised by the defendants/respondents is whether criminal and civil proceedings can be undertaken simultaneously.   My answer to this is YES.   There is nothing on record to show how these proceedings will interfere with the criminal cases facing the defendants.   All these cases including Petition No. 247 of 2019 were filed in the year 2019.  Whoever alleges a fact must prove it.  The 3rd defendant has not shown any malice or ill will against him in this suit.   See Republic v Chief Magistrate Cr division & anor Exparte Mildred Mbuya Joel [2014] eKLR.

47. What is clear is that a case can be both criminal and civil in nature depending on what the evidence reveals.  Furthermore the standard of proof of each category is different and that’s why witnesses will testify and be cross-examined in each case.   I therefore find no merit in this argument by the defendants/respondents.

48. The upshot is that the plaintiff/applicant has satisfied this court of the need to issue a temporary injunction to protect its subscribers’ data which appears to have landed in wrong hands.   I therefore grant prayer no. (iii) of the notice of motion dated 9th September 2019.

Costs shall be in the cause.

Orders accordingly.

DELIVERED ONLINE, SIGNED AND DATED THIS 7TH DAY OF JUNE 2021 IN OPEN COURT AT NAIROBI.

H. I. ONG’UDI

JUDGE