Nancy Karanu recently represented the Office of the Data Protection Commissioner (ODPC) in a constitutional petition challenging the Commission’s authority to hear and determine complaints under the Data Protection Act. The Petitioner argued that the ODPC lacked jurisdiction, asserting that it was neither a court nor a tribunal and therefore could not adjudicate such disputes.

Our legal team’s strategy focused on the doctrine of exhaustion, emphasizing that the Petitioner had failed to utilize the dispute resolution mechanisms available under the Data Protection Act. We also relied on the provisions of the Fair Administrative Action Act, demonstrating that the ODPC’s processes align with the principles of lawful, reasonable, and procedurally fair administrative action.

After hearing submissions from all parties, the Court upheld the ODPC’s position and dismissed the petition, reaffirming the Commission’s mandate to investigate and determine complaints in line with its statutory functions.

This decision reinforces the integrity of Kenya’s data protection framework and affirms the ODPC’s critical role in safeguarding data subjects’ rights.

📨 Connect with Nancy Karanu on LinkedIn: https://www.linkedin.com/in/nancykaranu