Summary

The High Court granted leave to seek a mandamus order compelling the ODPC to admit and determine a complaint arising from Nation Media Group's 2023 publication of a minor's photograph falsely depicting her as deceased during the Mukumu Girls School incident. The ODPC failed to act within the 90-day statutory period under section 56(5) of the Data Protection Act.

Facts

On 27 March 2023, the Saturday Nation newspaper published the name and photograph of the 1st Applicant, Grace Ellah Indoshi, a minor, erroneously depicting her as among those who had died during the Mukumu Girls School incident. The publication was made without the consent of the 2nd Applicant, Felistus Khadi Mukami, who was at the time the legal guardian of the 1st Applicant. Although a public apology was subsequently issued by Nation Media Group on 28 May 2023, the Applicants maintained that their data subject rights under Article 31 of the Constitution and the Data Protection Act, 2019 had been violated — specifically the publication without lawful basis of a minor's identifiable personal data including her name and image.

The Applicants lodged ODPC Complaint No. E0285 of 2025 with the Office of the Data Protection Commissioner. The ODPC initially acknowledged receipt of the complaint and thereafter directed the Applicants to resubmit it using the prescribed DPCI form. Despite re-submitting the complaint both electronically and physically, and complying with all procedural requirements, no substantive action followed from the ODPC. The 90-day statutory period prescribed under section 56(5) of the Data Protection Act lapsed on 26 May 2025 without any determination or substantive communication from the ODPC. The Applicants filed a Chamber Summons on 24 June 2025 seeking leave to apply for a mandamus order compelling the ODPC to admit the complaint and investigate and determine it within sixty days.

The High Court (Chigiti J) considered whether the Applicants had made out a prima facie arguable case warranting the grant of leave under Order 53 Rule 1 of the Civil Procedure Rules. Although the application was unopposed, the court noted that the threshold for leave remains that the applicant must satisfy the court of an arguable, non-frivolous case. The court found that the material before it demonstrated that the Applicants had lodged a complaint, complied with all procedural requirements, persistently sought action within the statutory framework, and that the ODPC had not complied with its statutory obligations under the Data Protection Act. The court accordingly granted leave, closed the leave file, and directed the Applicants to file and serve a substantive Notice of Motion within 21 days.

• Legal Provisions Reviewed

Holding

• Leave is granted to the Applicants to file judicial review proceedings seeking an order of mandamus compelling the Office of the Data Protection Commissioner to admit and act upon ODPC Complaint No. E0285 of 2025, and thereafter to investigate and determine the complaint within sixty days
• The leave file is closed
• The substantive Notice of Motion is to be filed and served within twenty-one (21) days from the date of the ruling

Note: this is a leave ruling only; the substantive judicial review application and the underlying data protection complaint against Nation Media Group PLC and Mukumu Girls School remain pending

Comment

This case is significant on two levels simultaneously. At the procedural level, it adds to the growing body of mandamus jurisprudence against the ODPC for failure to determine complaints within the 90-day statutory window under section 56(5) — a pattern that the courts are increasingly willing to address by compulsion rather than discretion. At the substantive level, the underlying complaint raises questions that have not yet been directly adjudicated in Kenya: the lawful basis for a media organisation to publish an identifiable minor's name and photograph in the context of news reporting, the role of a parent or legal guardian as the appropriate complainant where the data subject is a minor, and whether a subsequent public apology satisfies or merely mitigates data protection liability. The involvement of Nation Media Group — one of Kenya's largest and most prominent media houses — and a public school as interested parties makes this a case to track closely. The substantive hearing, when it comes, may produce the first Kenyan judicial treatment of the intersection between data protection law and press freedom.