In a landmark judgment in Harry Arunda v Office of the Data Protection Commissioner (ODPC), the High Court has affirmed that Kenya’s data protection regulator has the constitutional authority to investigate, adjudicate, and issue remedies for violations of data privacy rights.
The Challenge
The Petitioner had argued that Section 56 of the Data Protection Act (DPA) and Regulation 14(5) of the Complaints Handling Regulations unlawfully granted judicial powers to the ODPC—powers reserved exclusively for the High Court under Articles 23 and 165 of the Constitution.
The Court’s Findings
The Court dismissed the petition and clarified that:
- ODPC is a specialized regulator – Its powers are administrative and quasi-judicial, not judicial. Its decisions remain subject to appeal before the High Court.
- Section 56 and Regulation 14(5) are constitutional – These provisions enable ODPC to enforce compliance, issue corrective orders, and even recommend compensation, all within the bounds of administrative justice.
- Doctrine of exhaustion applies – Complainants must first pursue their grievances before the ODPC before approaching the courts, unless they can show the mechanism is inadequate.
- ODPC and KNHREC are complementary – While the Kenya National Human Rights and Equality Commission (KNHREC) addresses broad human rights violations, ODPC brings technical expertise to the fast-evolving field of digital privacy.
Why This Matters
This ruling strengthens the ODPC’s position as Kenya’s primary data protection watchdog, giving citizens a direct and specialized forum to seek remedies for privacy violations. It also aligns Kenya with global best practices, where regulators like South Africa’s Information Regulator play a frontline enforcement role.
For businesses, the decision sends a clear warning: compliance with the Data Protection Act is no longer optional. With judicial backing, the ODPC now has stronger authority to act decisively, and non-compliance could result in enforceable orders and penalties.
Looking Ahead
By upholding the ODPC’s mandate, the Court has ensured that the right to privacy under Article 31 of the Constitution is more than just a principle—it is a practical guarantee. This ruling cements the ODPC’s role in shaping Kenya’s digital rights landscape at a critical time, as the country grapples with issues of data sovereignty, state surveillance, and the growth of the digital economy.