The Data Commissioner must inform all parties likely to be affected by a determination, in clear terms, of the method or procedure that will be applied in determining a complaint.
Background
- The Applicant claimed that the Office of the Data Protection Comissioner failed to follow the provisions of Regulations 11, 13 and 14 of the Data Protection (Complaints Handling and Enforcement) Regulations when hearing and determining the complaint.
- Specifically, they contended that the ODPC did not consider or hear the evidence they had submitted, thereby violating their right to a fair hearing under Article 50 of the Constitution of Kenya, 2010.
- In response, the Data Protection Commissioner maintained that the complaint had been duly admitted, investigated, and determined in accordance with the Data Protection Act. The Commissioner further argued that the Applicants had not demonstrated any violation of their right to a fair hearing or any arbitrariness in the decision reached.
- The Data Commissioner also urged the court to adopt a purposive approach when intepreting the Data Protection Act and its attendant regulations.
High Court Decision
The Court held as follows:
- The Data Protection (Complaints Handling and Enforcement) Regulations 2021 gives the Data Commissioner the discretion to determine how to conduct investigations into a complaint.
- Regulation 13 (1) of the Complaints Handling Procedure and Enforcement Regulations provides that, subject to section 57 of the Act, the Data Commissioner may:
- issue summons in Form DPC 4 set out in the Schedule requiring the attendance of any person at a specified date, time and place for examination;
- examine any person in relation to a complaint;
- administer an oath or affirmation on any person during the proceedings;
- require any person or institution to produce any document or information; and
- upon obtaining warrants from the court, access any establishment or premises, conduct a search and may seize any material relevant to the investigation.
- To comply with the requirements of a fair hearing under Article 50 of the Constitution, any party likely to be affected by the outcome of an investigation must, as a matter of right, be clearly informed of the method or procedure that the Data Commissioner has chosen to adopt under Regulation 13(1).
- When determining a claim under Regulation 13, the Data Commissioner must clearly communicate to all parties likely to be affected the specific procedure that will be applied in resolving the complaint. Parties must not be left to guess or speculate about the process.
- A court, tribunal, commission, or any administrative body that fails to inform a person likely to be adversely affected by a decision of the procedure to be adopted, particularly where multiple options exist, as under Regulation 13(1), conducts a process that is a sham. Such a procedure is illegal as it offends the rule of law guaranteed under Article 10 of the Constitution. Any decision arising from it is therefore invalid.
- This information must be provided to the parties prior to or at a very early stage in the trial stage.
- The importance of informing the person under investigation of the approach that the Data Commissioner has decided to adopt cannot be gainsaid. It allows the party to know how to prepare for the hearing, the documents to present, how the investigations will be conducted, and the manner in which arguments or crossexamination will take place. This right cannot be taken away.
- Consequently, the Court issued an order of certiorari, quashing the decision of the Data Commissioner dated 8th September 2023 in Reference No. ODPC/CONF/1/5/VOL 1(316), ODPC Complaint No. 1050 of 2023 (as consolidated with Complaint No. 1051 of 2023: Chantal Marissa Pande and Joel Kunga v Credit Bank PLC)
- The Court further issued an order of mandamus directing the Data Commissioner to re-admit the Applicants’ complaint dated 20th June 2023 and to determine it afresh within 30 days of readmission, in accordance with Section 4(3) of the Fair Administrative Action Act.
