Ondieki v Maeda (Petition E153 of 2022) [2023] KEHC 18290 (KLR) (Constitutional and Human Rights)
In the recent case of Ondieki V Maeda (Petition E153 of 2022), the High Court rendered a judgment declaring that installation of CCTV cameras in a residential area is a violation of a person’s constitutional right to privacy.
Case Analysis
The Respondent in this case, installed CCTV cameras on her premises for security purposes. Aggrieved by the Respondent’s actions, the Petitioner, an adjacent neighbour of the Petitioner, lodged a Petition claiming that the CCTV camera installation breached his constitutional right to privacy. The Petitioner stated that the cameras were positioned in a manner that could spy, monitor, and record the images of his property. The Petitioner deponed that he had tried to resolve the issue amicably with the respondent, however, the Respondent was not co-operative. The Petitioner then put up a barricade to block the camera, but the Respondent uninstalled and reinstalled the cameras above the barricade and continued to spy, record, and monitor the Petitioners compound.
In response, the Petitioner averred that the CCTV cameras were installed for her family’s security, which was informed by the breaking into their premises by thieves earlier in the year.
Legislative Analysis
In determining the matter, the High Court stated that the right to privacy is envisaged under article 31 of the Constitution of Kenya, 2010, and is operationalized by the Data Protection Act, 2019 (the Act).
Article 31 of the Constitution of Kenya, states that “Every person has the right to privacy, which includes the right not to have-
- their person, home or property searched;
- their possessions seized;
- information relating to their family or private affairs unnecessarily required or revealed; or
- the privacy of their communications infringed.”
Section 25 of the Act states that “Every data controller or data processor shall ensure that personal data is—
- processed in accordance with the right to privacy of the data subject…”.
Analysis
The Court held that as per Act, the Respondent was deemed a data controller processing personal data through her CCTV of the Petitioner as a data subject. As such, the Respondent was required to be registered with the Office of the Data Protection Commissioner (the ODPC) and ought to have sought the Petitioner’s consent to collect data through the CCTV cameras. Ultimately, the High Court, in allowing the claim made a declaratory order that the actions of the Respondent violated the Petitioner’s rights under Article 31 of the Constitution and his rights as a data subject under the Act and ordered the Respondent to uninstall the CCTV camera accessing, spying, monitoring, and recording images in the Petitioner’s property.
The Court failed to acknowledge the exemptions for processing personal data by an individual during a personal or household activity under the Act. Section 51 (2) (a) of the Act stipulates that individuals processing personal data during a personal or household activity shall be exempt from complying with data protection principles relating to lawful processing, minimisation of collection, data quality, and adopting security safeguards to protect personal data.
Additionally, the Court relied on consent as the only lawful basis for processing personal data by a data controller or data processor and ignored indirect collection of personal data by the Respondent as prescribed in Regulation (6)(1)(c) of the Data Protection (General) Regulations, 2021.
Importance of the decision
This decision re-affirms the importance of getting consent from affected parties prior to obtaining personal data, or installing systems which could potentially breach their right to privacy.
If you have any queries relating to the above, data protection and privacy law, please do not hesitate to contact James Wairoto. Please note that this e-alert is meant for general information only and should not be relied upon without seeking specific subject matter legal advice.
By: James Wairoto and Najmah Khan
