Background
The dispute between a Nairobi law firm and its former associates took a turn with a decision of the Data Commissioner last weekend. In ODPC Complaint 677 of 2022 Allen Gichuhi & another v Florence Mathenge & another, filed in July 2022, the law firm accuses two former associates of sharing confidential information in their emails and with each other. The data included court pleadings, submissions, and legal opinions.
In January 2023, the Data Commissioner dismissed the complaint stating that the law firm was not a data subject. The Data Commissioner also found that the documents complained of were court documents forming part of the public record and that parties were companies and not natural persons who are the data subjects under the Act. Nor was there any showing by Complainants that their data had been infringed or that they could represent other data subjects mentioned in the complaint. The Commissioner also found no supportive facts because the law firm failed to provide copies of the documents allegedly shared.
High Court decision expanding the meaning of data subject
In May 2023, the law firm won a judicial review application of the Commissioner’s decision. Allowing the complaint in Gichuhi & 2 Others v Data Protection Commissioner; Mathenge & Another (Interested Parties) [2023] KEHC 17321 (KLR), the High Court (Chigiti J) remitted the complaint to the Data Commissioner for fresh investigations in 30 days.
The court also read “data subject” to include both natural and legal persons. Section 2 of the Act defines “data subject” as ‘an identified or identifiable natural person who is the subject of personal data’). See, Republic v Joe Mucheru, Cabinet Secretary Ministry of Information Communication and Technology & 2 others; Katiba Institute & another (Exparte); Immaculate Kasait, Data Commissioner (Interested Party) [2021] KEHC 122 (KLR)
On Friday, 16 June 2023, while declining a request to stay the Gichuhi decision pending appeal, the High Court directed the Data Commissioner to deliver her ruling latest Saturday, 17 June 2023. That is the context for the Data Commissioner’s decision delivered on Saturday evening.
Data Commissioner delivers new decision re-dismissing the law firm’s complaint.
On Saturday, 17 June 2023, the Data Protection Commissioner dismissed the law firm’s complaint afresh. Citing Joe Mucheru, the Data Commissioner reiterated that the Act deals with personal data as any information relating to an identified or identifiable natural person. And the data subject is identifiable as a natural person, while personal data breaches concern personal data breaches. As to the complaint, the ODPC first found no complaint by a natural person (the law firm is not a data subject). Further, one cannot complain about information already available in the public domain. The ODPC then analysed all the listed documents and found they were either public documents or contained no personal information.
Significance of the Decision for data protection in Kenya
This decision clarifies Kenya’s rapidly evolving data protection regime. Many privacy practitioners, including those here at Bond Advocates LLP, have considered clarifying the meaning of data subject necessary after Gichuhi. The argument is that allowing non-natural persons like companies or government offices to complain about personal data is incompatible with the Acts’ objects. The ODPC’s explanation that companies and businesses can only notify data breaches under section 43 of the Act is helpful.
