| Authority | High Court of Kenya at Nairobi (Milimani Law Courts) — Judicial Review Division |
|---|---|
| Jurisdiction | Kenya |
| Relevant law | Constitution of Kenya, 2010: Arts. 10(2), 31, 50; Data Protection Act, 2019: ss. 37, 56(5), 64; Data Protection (General) Regulations, 2021: reg. 12; Fair Administrative Action Act, 2015: ss. 9(2), 9(3), 9(4) |
| Type | Appeal / Review — Judicial Review (Preliminary Objection Ruling) |
| Outcome | Struck out — Preliminary Objection upheld |
| Started | 2 August 2024 (Notice of Motion filed) |
| Decided | 16 June 2025 |
| Published | Yes |
| Fine | N/A (underlying ODPC award of KES 750,000 — not stayed; suit struck out) |
| Parties | Talanta Institute (Applicant) vs. Office of the Data Protection Commissioner (Respondent); Toivo Kiai Muhuga (Interested Party) |
| Case No. | [2025] KEHC 8530 (KLR) — Judicial Review E165 of 2024 |
| Underlying ODPC Determination | ‣ |
| Appeal | N/A — suit struck out; section 64 appeal pathway remains available |
| Original Source | Kenya Law Reports |
| Original Contributor | MZIZI Africa |
Talanta Institute, a TVET institution, sought judicial review to quash an ODPC determination finding it liable for unauthorised commercial use of a former employee's image and ordering KES 750,000 compensation. The High Court struck out the application, holding the correct route was a statutory appeal under section 64 of the Data Protection Act, not judicial review.
The interested party, Toivo Kiai Muhuga, a former employee of Talanta Institute, filed a complaint before the ODPC alleging that the Institute had used his image for commercial purposes without authorisation and had failed to remove it upon request. The ODPC determined the complaint on 30 June 2024, finding Talanta Institute liable for unauthorised commercial use of the interested party's image contrary to section 37 of the Data Protection Act, 2019, and for failing to remove it in violation of Regulation 12 of the Data Protection (General) Regulations, 2021. The ODPC ordered compensation of KES 750,000.
Rather than appealing the determination under section 64 of the Data Protection Act, Talanta Institute filed a Notice of Motion in the Judicial Review Division of the High Court on 2 August 2024, seeking certiorari to quash the ODPC's determination, prohibition restraining its enforcement, and mandamus compelling the ODPC not to enforce the determination. The grounds relied upon included alleged violation of Article 50 of the Constitution (fair hearing), alleged contravention of sections 37 and 56(5) of the Data Protection Act, illegality, irrationality, and unreasonableness. The Applicant also contended that the determination was a nullity as the timelines under section 56(5) had not been clearly applied.
The ODPC filed a Notice of Preliminary Objection dated 12 February 2025, arguing that the High Court lacked jurisdiction to hear the matter in the first instance because the Applicant had failed to exhaust the statutory appeal mechanism under section 64 of the Data Protection Act, and that the application offended the doctrine of exhaustion under sections 9(2) and 9(4) of the Fair Administrative Action Act, 2015. The ODPC relied on Ceres Tech Ltd v Commissioner, Office of the Data Protection Commissioner [2024] KEHC 12833 (KLR), Swara Acacia Lodge v ODPC [2025] KEHC 7 (KLR), and the Court of Appeal's decision in Speaker of National Assembly v Karume [2008] 1 KLR 425.
The High Court (Chigiti J) upheld the Preliminary Objection in full. The court found that the Applicant had not demonstrated any exceptional circumstances that would justify bypassing the section 64 appeal mechanism, had not sought leave from the court to file the judicial review proceedings, and had not shown that the High Court lacked the capacity or jurisdiction to offer adequate redress through a statutory appeal. The court held that the time spent filing judicial review proceedings should have been used to prosecute a section 64 appeal. The suit was struck out with costs.