Data Protection: ODPC had no jurisdiction until the accent of the DPA Regulation

Caroline Wambui Ndirangu v Nation Media Group Limited & Joseph Kanyi HCCC E149 of 2020 (2024 Ruling)

Whether a case touching on a breach of image rights and privacy rights filed at the High Court before the operationalisation of the Data Protection Act (DPA) should be referred to the Office of the Data Protection Commissioner?

The Defendants filed a Preliminary Objection (PO) that the Plaintiff (our Client) had filed her case in total disregard of the Fair Administrative Action Act and s 64 of the DPA, therefore, the suit ought to be struck out as the doctrine of exhaustion was not achieved by the Plaintiff.

The Honourable Court, based on the Plaintiff’s submissions, disagreed with the Defendant’s arguments since at the time the Plaintiff’s case was being filed, the DPA was yet to be operationalised. The DPA, which was assented to the law on November 25, 2019, was operationalised on January 14, 2021; therefore, there was no mechanism for the Plaintiff to seek remedial action for the breach by the Defendants. As a result, the Defendant’s PO was dismissed with costs in favour of the Plaintiff.