On 19th July 2022, the High Court at Naivasha delivered a ruling in Petition E003 of 2021: John Mwangi and Another v Naivasha County Hotel T/A Sawela Lodges. The court upheld a preliminary objection by the Respondents and struck out the entire petition, which alleged that the respondent violated the constitutional rights of the petitioners under Article 2(1) & 2, 10 (2) (b), 19, 20, 22, 23 (3), 28, 29, 31, 165, 258 & 259 (1) of the Constitution and the Data Protection Act of 2019 by taking photographs of them during a team-building exercise and posting them on various social media platforms to promote their products.

The Respondent raised a preliminary objection claiming that the petition had been ill-placed before the high court, which lacked the jurisdiction to hear the issues raised. The Respondent contended that the issues raised fell under the jurisdiction of the Data Commissioner established under the Data Protection Act of 2019 and that the matter was of a civil nature between private persons to be determined as a tort. The court ruled that the Respondent had met the standard provided in the cited cases and that the preliminary objection was sustainable.

The court also addressed the doctrine of exhaustion and concluded that the issues raised were anchored on the use of personal data without the consent of the data subjects, which matters fall under the Data Protection Act of 2019. It further indicated that the Petitioners had the right under the DPA to appeal an adverse decision to the High Court as provided under Section 64 of the DPA. The Petitioners failed to demonstrate why the petition should be exempted from the doctrine of exhaustion, and the court barred the Petition on that arm.

The court determined that the nature of grievances raised in the petition were between private parties and failed to meet the threshold for a constitutional issue. As a result, the High Court limited its jurisdiction to entertain disputes relating to the right to privacy under Article 31 of the Constitution, and privacy and data protection complaints should be primarily decided by the Data Commissioner in line with the Data Protection Act of 2019, unless they meet the exceptions to the doctrine of exhaustion as outlined above.