| Authority: | High Court |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya |
| Type: | Review |
| Outcome: | Application Struck Out |
| Started: | 5 February 2024 |
| Decided: | 24 October 2024 |
| Published: | Yes |
| Fine: | N/A |
| Parties: | Ceres Tech Limited v Commissioner, Office of the Data Protection Commissioner |
| Case No.: | Judicial Review Application 25 of 2024 [2024] KEHC 12833 (KLR) (Judicial Review) |
| Appeal: | N/A |
| Original Source: | Kenya Law Reports |
| Original contributor: | MZIZI Africa |
Ceres Tech Limited was accused of sending unsolicited promotional messages by three complainants. The ODPC investigated, found Ceres Tech liable for data protection violations, and awarded compensation to the complainants. Ceres Tech sought judicial review but failed to first appeal the decision as required by the Data Protection Act. The High Court struck out the application due to lack of jurisdiction.
Three complainants (David Owuor, Dennis Mwenda, and Richard Abongo) filed complaints with the Office of the Data Protection Commissioner (ODPC) on 9th and 22nd November 2023.
The complaints centred around Ceres Tech Limited sending unsolicited promotional messages and calls related to loan applications. The complainants alleged that Ceres Tech Limited had violated their data privacy rights by using their phone numbers without consent.
The ODPC acknowledged receipt of the complaints and initiated an investigation into the matter. They notified Ceres Tech Limited about the complaints on 9th and 22nd November 2023, giving the company 14 days to respond. The ODPC consolidated the three complaints due to their similarity.
Following an investigation and consideration of the evidence presented, the ODPC found Ceres Tech Limited liable for violations of the Data Protection Act.
<aside> 💡
Link to the original ODPC ruling:
</aside>
Ceres Tech filed this judicial review application against the ODPCs order to the High Court.
The High Court found that Ceres Tech Limited did not follow this process and instead directly sought judicial review, bypassing the established appeal route. The Court emphasised that jurisdiction is fundamental, and it could not entertain a case where proper legal procedures had not been followed.
Section 64 of the Data Protection Act provides a mechanism for appealing the Data Commissioner's decisions to the High Court.