Vishaal Shah & Others vs Cyprian Nyakundi

1. Introduction

Parties:

• Complainants: Vishal Shah, Keval Shah, Roshni Shah, Shrikunj Shah, Madhup Dokania
• Respondent: Cyprian Nyakundi (blogger)

Core Issue: Unauthorized publication of personal data on a blog under Kenya’s Data Protection Act, 2019.

2. Background of Complaint

Incident Details:

• Respondent published complainants’ names and phone numbers on his website (cnyakundi.com)
• No prior consent obtained from complainants
• Multiple complaints filed April 2023
• Content remained publicly accessible during investigation

3. Key Violations Found

1. Unauthorized Data Processing:
   • Publication of personal identifiers without consent
   • Failure to establish proper legal basis for processing
2. Non-Compliance with DPA:
   • Violation of Section 25 data protection principles
   • No valid claim to journalistic exemption
3. Regulatory Defiance:
   • Dismissive response to ODPC inquiries
   • Public mockery of investigation process

4. Respondent’s Response

• No substantive response to allegations
• Public statements dismissing ODPC authority:
  • “You guys are too idle” (email response)
  • Twitter posts mocking the investigation
• No evidence of consent from complainants
• No demonstration of compliance measures

5. ODPC’s Determination

Legal Findings:

• Section 25: Processing violated data protection principles
• Section 52: Journalistic exemption not applicable (respondent not accredited)
• Section 59: Grounds for criminal investigation established

Key Conclusions:

• No evidence of public interest justification
• Respondent not recognized as journalist by Media Council of Kenya
• No membership with Bloggers Association of Kenya (BAKE)

6. Final Ruling

1. Case referred to Directorate of Criminal Investigations (DCI)
2. No immediate enforcement notice issued
3. Parties retain right to appeal to High Court

7. Significance of the Case

This ruling establishes important digital media precedents:

• Blogger Accountability: Clarifies limits of journalistic exemptions for non-accredited online publishers
• Public Interest Test: Reinforces need for substantive justification when publishing personal data
• Enforcement Boundaries: Demonstrates ODPC’s referral authority to criminal investigators
• Digital Content Regulation: Sets expectations for Kenya’s growing blogger ecosystem
• Due Process: Maintains balance between privacy rights and freedom of expression