When the constitutional right to privacy under Article 36 has been violated, the victim, in the zeal to pursue compensation, has to approach the correct forum. In what seems to be competing interests between the jurisdiction of the High court in determination of disputes involving violation and/or threat of constitutional rights under Article 165 [3b] and the place of the Office of the Data Protection Commissioner[ODPC], the Court in the case of Maingi v Nairobi Java House Ltd [2026] KEHC 12902 (KLR) delivered on 18th August 2026 has settled this position.
The main question is whether the victim can bypass the ODPC and proceed to the High Court under the guise of a Constitutional Petition. The court answered in the negative, holding that the existence of a constitutional right does not necessarily determine the forum in which the claim must first be heard.
The crux of the dispute
The Petitioner was a former employee of the Respondent; Java House having left the premises in July 2021. Sometime in December 2021, he discovered that the Respondent was using his photograph-image and name in advertising, in which photograph he had donned the company-branded merchandise. The Respondent published his image and name globally without his consent. Vide a constitutional petition, he approached the High Court seeking a declaration that the Respondent violated the Petitioner’s rights to privacy, dignity, publicity and information and an award of compensation in the form of general damages.
The Outcome
Suo Moto, Justice Aburili while noting the centrality of the judicial authority addressed the doctrines of constitutional avoidance and exhaustion. First, the Court affirmed the jurisdiction of the High Court to hear and determine a claim of denial, violation, infringement or threat of a right or fundamental freedom in the Bill of Rights under Article 163, 22 and 23 of the Constitution.
The Court further noted that, however, this overarching jurisdiction does not go unlimited. It is only preserved for matters where no statutory mechanism exists to provide a complete remedy. This means that by virtue of these doctrines, the court is called upon to preserve its time and resources for real constitutional controversies and leave the determination of the disputes that can be resolved on non-constitutional grounds to other mechanisms. The doctrine also serves to ensure that the such disputes are resolved by those with the technical competence to deal with them.
The Court consequently held that whereas it retains the ultimate supervisory jurisdiction, it lacks the initial jurisdiction over the issues on violation of the right to privacy. The first port of call is the ODPC. In any case, a party aggrieved by the Data Commissioner’s findings can always appeal to the High Court.
The Petition was struck out.
Why this matters for data processors and data subjects
In the wake of Artificial intelligence and the cross-sectional concern on data privacy, it is imperative for both the data processors and data subjects to discern the first port of call to address its breach and remedies. The judgment is a reminder that disguising the dispute as a constitutional petition pegged on Articles 22, 23 and 163 of the Constitution is not a leeway to bypass the Office of the Data Protection Commissioner. The ODPC is the first stop.
