In Gichuhi & 2 others v Data Protection Commissioner; Mathenge & another (May 2023), the High Court at Nairobi reviewed a complaint brought by Allen Waiyaki Gichuhi and Charles Wambugu Wamae against Florence Mathenge and Ambrose Waigwa. The complaint stemmed from the Data Protection Commissioner's (ODPC) dismissal of their complaint regarding data sharing.
The applicants argued that the ODPC's determination violated their right to a fair hearing, exceeded its jurisdiction by surpassing statutory timelines, and lacked procedural fairness. The High Court upheld the applicants' appeal, quashing the ODPC's determination. It ordered a fresh investigation and determined that the ODPC must issue a decision within 30 days.
The case addressed crucial issues such as jurisdiction, timelines, locus standi, fair hearing, and procedural fairness under the Data Protection Act and constitutional provisions. It clarified that statutory timelines are essential for jurisdiction and emphasized the right to a fair hearing and administrative action. The court's decision underscores the importance of procedural compliance and adherence to timelines in data protection complaints.