Judicial Review Decision on Data Protection Violations

Background of the Case

In the case Gichuhi & Others v Data Protection Commissioner; Waigwa & Another (Interested Parties), the applicants, including Allen Waiyaki Gichuhi, Charles Wambugu Wamae, and their law firm, sought judicial review orders following a determination by the Data Protection Commissioner (DPC). The applicants alleged that the DPC failed to investigate their complaint regarding unauthorized disclosure of sensitive data, breaching confidentiality, intellectual property rights, and professional privileges. The complaint was directed at two former employees accused of sharing the firm’s trade secrets with third parties without consent.

The DPC declined to admit the complaint, citing lack of jurisdiction under the Data Protection Act (DPA). The applicants sought judicial intervention, asserting violation of their constitutional and statutory rights, particularly the right to privacy under Article 31 of the Constitution.

Issues for Determination

1. Whether the DPC violated the applicants’ right to fair administrative action.
2. Whether the applicants were entitled to judicial review orders, including mandamus to compel the DPC to investigate.
3. Whether the complaint was res judicata.

Court’s Analysis

Principles and Jurisdiction

The court analyzed the scope of the DPC’s mandate under the DPA and its regulations, focusing on:

• Definition of Personal Data: The DPA limits “personal data” to information relating to natural persons, excluding corporate entities like the applicants’ law firm.
• Jurisdictional Boundaries: The DPC’s role is confined to regulating the processing of personal data of identifiable natural persons, not addressing issues of confidentiality or intellectual property which fall under other legal frameworks, including the Advocates Act.

Res Judicata Doctrine

The court acknowledged that the applicants had previously lodged similar complaints, which were adjudicated and dismissed. The repeated filing, albeit under constitutional grounds, was found to contravene the principles of res judicata, as the matters raised could have been addressed in the earlier proceedings.

Right to Fair Administrative Action

The court noted that the DPC conducted a preliminary review as per its mandate and communicated its decision to decline the complaint, satisfying the procedural fairness requirements under Article 47 of the Constitution and the Fair Administrative Action Act.

Mandamus

The court reiterated that mandamus could not compel an authority to act outside its statutory jurisdiction. Since the DPC lawfully declined the complaint for lack of jurisdiction, granting such an order would be inappropriate.

Determination and Orders

The court dismissed the application, affirming the DPC’s decision. It held that:

• The applicants’ complaint was outside the DPC’s jurisdiction.
• The filing of similar complaints constituted an abuse of court processes.
• Costs were awarded to the respondents.

Implications of the Case

This decision underscores the strict interpretation of the DPC’s jurisdiction under the DPA, emphasizing that:

1. Corporate entities cannot lodge complaints as data subjects under the DPA.
2. The proper forums for addressing breaches of professional privilege and intellectual property rights are outside the DPC’s purview.
3. Res judicata bars relitigation of matters already determined or capable of being raised in prior proceedings.

This case serves as a critical precedent for clarifying the limits of the DPA and the DPC’s mandate. It also highlights the necessity for litigants to fully exhaust available remedies within the appropriate statutory frameworks.