| Authority | High Court of Kenya at Nairobi (Milimani Law Courts) — Constitutional and Human Rights Division |
|---|---|
| Jurisdiction | Kenya |
| Relevant law | Constitution of Kenya, 2010: Arts. 23(1), 31(c) & (d), 59(2)(e), 159(2)(c), 162, 165(3)(b), 169(1); Data Protection Act, 2019: ss. 5, 8(1)(f), 56, 58, 64, 65; Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021: reg. 14(5); Fair Administrative Action Act, 2015: s. 9(2) |
| Type | Constitutional Petition (Appeal / Review layer) |
| Outcome | Dismissed — Petition without merit |
| Started | 2 February 2025 |
| Decided | 12 August 2025 |
| Published | Yes |
| Fine | N/A |
| Parties | Harry Stephen Arunda (Petitioner) vs. Office of the Data Protection Commissioner (1st Respondent); Office of the Attorney General (2nd Respondent); Data Privacy and Governance Society of Kenya (Interested Party) |
| Case No. | [2025] KEHC 12262 (KLR) — Constitutional Petition E010 of 2025 |
| Appeal | N/A |
| Original Source | Kenya Law Reports |
| Original Contributor | MZIZI Africa |
An advocate petitioned the High Court arguing the ODPC unconstitutionally exercises judicial powers under section 56 of the Data Protection Act and Regulation 14(5), usurping the High Court's exclusive Bill of Rights jurisdiction. The court dismissed the petition, upholding the ODPC's quasi-judicial mandate as constitutionally valid and requiring exhaustion of ODPC remedies first.
The petitioner, an advocate of the High Court of Kenya, filed a constitutional petition challenging the jurisdiction of the ODPC to investigate and adjudicate complaints involving alleged breaches of the right to privacy under Article 31 of the Constitution. He sought declarations that section 56 of the Data Protection Act, 2019 and Regulation 14(5) of the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 were unconstitutional, on the grounds that they vest the ODPC — an executive agency — with powers equivalent to those of a court of law. He argued that only the High Court, under Articles 23(1) and 165(3)(b) of the Constitution, has jurisdiction to determine whether a fundamental right has been violated, and that the ODPC's power to make enforceable determinations including compensation awards impermissibly confers judicial authority on a non-judicial body contrary to the doctrine of separation of powers. He further argued that the ODPC's mandate unlawfully overlapped with that of the Kenya National Human Rights and Equality Commission (KNHREC) under Article 59(2)(e). Notably, the petitioner had neither lodged a complaint with the ODPC nor sought exemption from the exhaustion requirement before filing the petition directly in the High Court.
The ODPC, the Attorney General, and the Data Privacy and Governance Society of Kenya as Interested Party all opposed the petition. They argued that the ODPC was established under section 5 of the Act to give effect to Article 31(c) and (d), that its functions are administrative and quasi-judicial rather than judicial in nature, and that section 64 of the Act preserves the High Court's appellate jurisdiction as a constitutional safeguard. They relied on comparative jurisprudence from South Africa, where the Information Regulator under POPIA performs similar functions subject to judicial review, and on Nubian Rights Forum & 2 Others v Attorney General & 6 Others [2020] eKLR, which endorsed the ODPC's institutional role. They also invoked the doctrines of exhaustion and constitutional avoidance.
The High Court (Mwamuye J) dismissed the petition on all four issues. On the jurisdictional question, the court held that while Article 23(1) confers original jurisdiction on the High Court, not every dispute involving a constitutional right must originate there, and that the existence of appellate recourse to the High Court under section 64 of the Act ensures constitutional fidelity. The court found that the ODPC does not issue final declarations of constitutional violations — it operates as a quasi-judicial regulator performing a complementary role within the larger legal framework. On the constitutionality of section 56 and Regulation 14(5), the court applied a purposive interpretation and held that these provisions authorize administrative and regulatory functions in furtherance of Article 31, not judicial functions. On exhaustion, the court found the petitioner had prematurely approached the High Court without engaging the ODPC's mechanism or demonstrating exceptional circumstances. On the KNHREC overlap question, the court held the mandates of the two bodies are distinct and complementary, not contradictory.