The High Court has dismissed a petition by Mulla Pride Ltd, a digital lending company that owns KeCredit and FairKash, which challenged a KSh 2.98 million penalty imposed by the Office Data Protection Commissioner (ODPC) for violating data protection laws.
- •The court ruled that the petition, filed under the guise of constitutional violations, was procedurally misplaced.
- •Justice Chacha Mwita held that the Data Protection Act of 2019 clearly spells out an appeal path to the High Court for aggrieved parties.
- •Since that route remains available, the court found no justification for bypassing it via a constitutional petition.
“Section 64 of the Data Protection Act gives a party aggrieved by the ODPC’s decision the right of appeal to the High Court. However, despite this provision of the law, the petitioner (Mulla Pride Ltd) filed a constitutional petition arguing that its rights were violated, which ODPC argued should not have been the case,” Chacha Mwita said.
“The law has long been settled that where a statutory remedy exists, a party should pursue that remedy rather than invoking a different jurisdiction other than the available remedy,” he added.
The dispute with the digital lender stemmed from complaints reaching the ODPC beginning in late 2022. These included allegations of unauthorized access to users’ contacts, aggressive reminders to third parties, and data sharing violations. The ODPC initiated multiple inquiries, issuing an enforcement notice in August 2023 with prescribed corrective actions, followed by a penalty notice in September demanding the fine. Though ODPC notified Mulla Pride of its right to appeal, the company opted for a constitutional petition instead.
In its petition, the lender insisted it had complied with corrections outlined by the ODPC including staff training and a referee verification mechanism. The company claimed the ODPC neither verified those steps nor sought additional clarification before issuing the fine. Mulla Pride alleged that ODPC’s actions trampled constitutional protections such as the rights to fair administrative action and hearing.
In response, the ODPC emphasized that its investigative actions were grounded in credible complaints ranging from unauthorized mobile access and harassing repayment demands to improper sharing of personal data. It asserted that the August enforcement notice and the subsequent September penalty notice adhered to statutory norms, with clear instructions on remedial requirements and the offender’s right to appeal.
Justice Mwita warned that invoking constitutional jurisdiction to evade ordinary procedures is an abuse of court process. Rejecting the notion that constitutional intervention is justified, the judge noted that Mulla Pride had neither shown that the appeal route the company ought to have followed would be ineffective.
“There must be a delineating boundary between violation of rights and fundamental freedoms in the Bill of Rights and decisions from administrative bodies which are appealable through the normal appellate channel where the law has clearly provided for that avenue,” Justice Mwita said.
