10. According to the applicants section 56(5) of the Data Protection Act, is couched in mandatory terms that the respondent shall investigate and conclude its investigations ninety (90) days. 11. The complaint herein was lodged with the respondent on July 20, 2022. It took the respondent about 6 months to investigate and conclude the complaint which was outside its statutory timelines. According to the applicants the respondent ought to have concluded investigation and render it’s determination by October 19, 2022. 12. The applicants further submitted that the respondent’s jurisdiction came to an end by way of euxion of time citing the case of Joint Venture of Lex Oilfield Solutions Ltd & CFAO Kenya Ltd v Public Procurement Administrative Review Board & 4 others (Civil Appeal 022 of2022) [2022] KECA 424 (KLR). The Respondents and the Interested Parties’ Case: 13. In response to the motion the respondent led a replying adavit dated March 15, 2023 and written submission dated March 29, 2023.On her part, the 1st interested party led a replying adavit dated March 16, 2023 and written submissions dated March 31, 2023 while the 2nd interested party led a replying adavit dated March 15, 2023 and written submissions dated March 29, 2023. The Respondent: 14. The ODPC is a regulatory oce established pursuant to section 5 of the Act. The ODPC is mandated with regulating personal data processing, ensuring that the processing of a data subject’s personal data is guided by the principles set forth in section 25 of the Act, protecting individuals’ privacy, establishing a legal and institutional mechanism to protect personal data, and providing data subjects with rights and remedies to protect their personal data from processing that is not in accordance with the Act. 15. In July 2022, the ODPC received a complaint from the applicants against its the interested parties who were its ex-employees. The basis of the complaint is that the 1st interested party allegedly sent condential information from the 3rd applicant to her personal email as well as to a third party, without consent from the data subjects and the applicants. 16. It was alleged that some of the documents shared between the Interested parties included court documents such as pleadings and supporting documents, applications, adavits, submissions, and legal opinions, bank statements, correspondences, invoices, and subscription emails. 17. The respondent at the inception of the matter noted that a large majority of the complaint did not contain any personal data of the applicants but instead were documents relating to the 3rd applicants corporate (not natural persons) clients who on the face of it were not aware that the 3rd applicant was acting on their behalf. 18. The ODPC upon satisfaction that the applicants had adequately ventilated their complaint and the interested parties given a chance to defend the allegations and by virtue of considering the complaint and documents presented it dismissed the complaint on the grounds that the documents provided formed part of the public record, and the parties referred to in some of the documents were companies and not natural persons who are the data subjects specically protected under the Act. 19. The respondent also found that the complainants did not demonstrate that their own personal data had been infringed and did not show that they had the authority to represent any other data subjects referred to in the complaint. kenyalaw.org/caselaw/cases/view/258092/ 8