Enforcement Of The Data Protection Laws: The Rising Role Of The ODPC

The enactment of the Data Protection Act, 2019 (The Act) has led to a rapid change in how courts handle cases of infringement of data rights. This is because the Act has established the Office of Data Protection Commissioner (ODPC) with the primary mandate of enforcing Data Protection Laws.

In discharging this mandate, the ODPC has been exercising its power to issue penalty notices to ensure compliance with Data Protection Laws.

ODPC Fines Regus Kenya and Whitepath KES 10m For Breaching Data Protection Laws

On 11 April 2023, Whitepath and Regus Kenya became the latest entities to be penalised by the Office of the ODPC for mishandling their client’s data.

The penalty notices issued against the two companies are a clear indication that there is now a need for both corporations and individuals who handle personal data to not only have an appreciation of the Data Protection Laws but also handle personal data entrusted with them in accordance with the Data Protection Laws.

Moving forward, companies should take the initiative to comply with the Data Protection Laws as their failure to do so could plunge them into economic strains even for the “smallest” mistakes. The road to compliance includes key well-thought-out steps that companies must follow. 

To ensure compliance with Data Protection Laws, the ODPC also has the power to award damages where the rights of data subjects are infringed.  

High Court Declines to Hear a Data Privacy Breach Petition and Refers Complainant to ODPC

On 31 March 2023, the High Court in MERCY MWIKALI MWANZIA -V- ALLAN J. RHODES (CONSTITUTIONAL PETITION NO. E115 OF 2022) [2023] declined to hear a petition filed before it, by a petitioner alleging infringement of her Constitutional right to privacy.

The backdrop of the petition was the alleged degrading publication of the petitioner and her child’s images by the respondent in his social media accounts without the petitioner’s consent was in breach of her right to privacy, hence sought compensation for this breach.

The landmark judgment saw the court examine the Data Protection Act, finding that the primary purpose of enacting the Act was to safeguard the Constitutional right to privacy of persons and acknowledged that the Act established the ODPC with the power to receive and investigate complaints on violation of rights of data subjects. The court stated that where an infringement is found to have occurred, the ODPC can make an award of compensation to the victims, hence having established this, saw the need to refer the complainant to the ODPC for determination.

Having established the enforcement roles played by the ODPC, it is important to understand who can file complaints before the ODPC.

High Court: Only Natural Persons Can Lodge Complaints with the ODPC

On 12 May 2023, the High Court in GICHUHI & 2 OTHERS -V- DATA PROTECTION COMMISSIONER; MATHENGE & ANOTHER (INTERESTED PARTIES) (JUDICIAL REVIEW NO. E028 OF 2023) reaffirmed the statutory position that only natural persons could lodge complaints with the ODPC.

The decision came after a law firm based in Nairobi lodged a complaint with the ODPC alleging that on diverse dates the respondents had shared their client’s personal and sensitive data. The ODPC in dismissing the complaint held that the information shared formed part of the public record, and the data subjects referred to in the complaint were companies and not natural persons who were specifically protected under the Act.

Aggrieved by the decision, an appeal was filed before the High Court. The court was primarily tasked with determining two fundamental questions of law: Firstly, whether the ODPC’s decision was void for having been rendered outside the statutory time limit, and secondly, whether legal persons could lodge complaints with the ODPC.

On the first issue, the high court agreed with the appellants that the decision reached by the ODPC was a nullity on the grounds that it was rendered after 180 days of filing the complaint which was outside the 90 days’ time provided under the Act. In determining the issue of whether legal entities could file complaints with the ODPC for data breaches. The High Court relying on provisions of the Act, settled at the finding that only natural persons could file complaints before the ODPC for their data rights.  

This decision has reiterated the need for them to receive, investigate and conclude complaints within 90 days of being lodged.

From these decisions, it is evident that there is a need for legal entities that handle personal data to comply with Data Protection Laws to avoid being the subject of complaints before the ODPC, which could culminate in the payment of hefty fines and or damages.

The CMS Kenya | Daly Inamdar Advocates Data Protection Team comprising certified privacy professionals is happy to come on board as your resource partners in supporting your compliance efforts. For more information on data protection please click here.

This alert serves the purpose of general guidance and is not intended to constitute specific legal advice.

For legal advice with respect to this alert, please contact our Partner, Collette Akwana at Collette.Akwana@CMS-DI.com.  

*Contributors

Wilson Mrima - Associate