Summary: On 27 March 2025, the High Court delivered a pivotal ruling in Samuel Maina Ngunjiri v. Faith Kiambi & Joseph Mutharia reinforcing the requirement to exhaust administrative remedies under the Data Protection Act before seeking redress in the High Court on all matters pertaining to data protection.
BACKGROUND
The petitioner, Samuel Maina Ngunjiri, brought a constitutional petition against his neighbor (1st respondent) and landlord (2nd respondent), alleging a violation of his constitutional right to privacy under Article 31. He claimed that a CCTV camera was installed facing his residence without his consent, capturing the private activities of his family. Ngunjiri sought:
- declarations;
- injunctive relief;
- compensation for the alleged breach; and
- total destruction of the captured footage.
The respondents objected to the petition on procedural grounds, specifically invoking the doctrine of exhaustion of remedies. They argued that the petitioner should have first lodged a complaint with the Office of the Data Protection Commissioner as prescribed under the Data Protection Act, 2019, rather than approaching the High Court directly.
THE COURT’S KEY FINDINGS
The High Court, while acknowledging it had the constitutional jurisdiction to hear and determine fundamental rights violations, ruled that this jurisdiction must be exercised in line with statutory mechanisms established by legislation – in this case, the Data Protection Act.
Justice Mugambi held that the petitioner’s primary grievance—unlawful collection of personal data via CCTV surveillance—squarely fell within the purview of the Data Protection Act which already has an established administrative mechanism through the Office of the Data Protection Commissioner (ODPC) to handle complaints relating to privacy breaches, including surveillance.
Unless exceptional circumstances exist, parties are required to exhaust available statutory remedies before turning to the courts. Since no such exceptions were demonstrated, the petition was deemed premature and thus struck out for failure to exhaust the alternative dispute resolution mechanisms provided under the Data Protection Act.
KEY TAKEAWAYS
- Privacy Complaints Must Start with the ODPC: All disputes relating to data privacy must first be handled through the ODPC’s complaints mechanism before going to court.
- Emphasis on the Doctrine of Exhaustion: This decision reinforces the doctrine that statutory dispute resolution mechanisms—such as those under the Data Protection Act—must be pursued before initiating constitutional litigation in the High Court.
- Re-emphasis of the ODPC’s Enforcement Powers: The ruling clarifies that the Office of the Data Protection Commissioner (ODPC) is the proper forum for first-instance adjudication of disputes involving surveillance, personal data processing, and potential privacy breaches.
HOW WE CAN HELP
At Barizi Data Privacy Service, we specialise in the Kenyan data protection law. If your organisation uses technology or processes personal data, this ruling has direct implications for your compliance strategy. Contact us today to review your policies or get assistance with ODPC complaint procedures.
Telephone: +254 112 774 227
Email: info@bdps.co.ke
Website: www.bdps.co.ke
Disclaimer: This alert is for informational purposes only and does not constitute legal advice. For specific guidance related to your situation, please consult with a qualified advocate.
