Procedure for accessing information in Kenya explained with appeals, refusals & exceptions. Learn your rights—Book our team of data protection lawyers today.

Introduction

The right of access to information is underpinned under the Constitution of Kenya 2010, Access to Information Act, 2016 (Section 8-15,23) andthe Access to Information (General) Regulations,2023 (8,13-27). Public bodies and private entities under certain circumstances are mandated to provide information to members of the public upon request in line with Constitutional values and Principles of governance such as:-Transparency and Accountability. However, the right to access information is subject to certain demonstrated exceptions such as national security.

The Legal Process for Accessing Information in Kenya

The procedure for accessing information from a public body is as follows: –

1. An application to access information shall be made in writing in English or Kiswahili to the Information Access Officer. In case of illiteracy or disability that makes the applicant unable to make a written request, the information officer shall reduce to writing the request on behalf of the applicant. A public officer shall make a decision on an application within twenty-one days of receipt of the application unless a request involves a large amount of information. Where the information sought concerns the life or liberty of a person, the information officer shall provide the information within forty-eight hours of the receipt of the application.
2. An Information Access Officer may, not later than five days from the date of receipt of an application, transfer the application, to another public entity, if the information requested is held by that other public entity. The applicant shall be notified of the same within seven days from the date of receipt of the application and a decision shall be made within twenty-one days from when the application was first received.
3. Upon the Information Access Officer making a decision as to whether to provide access to information, he or she shall immediately communicate the decision to the requester; the reasons thereof; and the way forward.
4. Where a decision is taken to provide the information applied for, an Information Access Officer shall send to the applicant a written response within fifteen working days of receipt of the application, advising: – that the application has been granted and the details of any fees or further fees to be paid for access,
5. Upon receipt of the fee payable, an Information Access Officer shall provide the information to the applicant not later than two working days from the date of receipt of the payment.

NB: The same process is applicable to private bodies with the necessary modification to an application for access to information.

Review/Appeal to Refusals (Section 14 and 23 of the Act)

• If a public or private entity refuses to grant an applicant access to information, the applicant may apply in writing to the Secretary of the Commission on Administrative Justice (Commission) requesting a review of the decision. Such an application shall be made within thirty days, or such further period as prescribed by the Commission from the day on which the decision is notified to the applicant.
• A person dissatisfied with the decision of the Commission may appeal to the High Court within twenty-one days from the date of the decision of the Commission.
• The Commission may, if satisfied that there has been an infringement of the provisions of this Act, order: –

(a)the release of any information withheld unlawfully;

(b)a recommendation for the payment of compensation; or

(c)any other lawful remedy or redress.

• An order of the Commission as listed above may be filed in the High Court by any party and such party shall give written notice of the filing of the order to all other parties within thirty days of the date of the filing of the order.
• If no appeal is filed, the party in favour of whom the order is made by the Commission may apply ex-parte by summons for leave to enforce such order as a decree, and the order may be executed in the same manner as an order of the High Court.

Exceptions (Section 6 of the Act).

There are circumstances in which the right to access information as provided under Article 35 of the Constitution of Kenya shall be limited namely, where the information is likely to: –

(a)Undermine the national security of Kenya, such as military strategy;

(b)impede the due process of law;

(c)endanger the safety, health or life of any person;

(d)involve the unwarranted invasion of the privacy of an individual, other than the applicant or the person on whose behalf an application has, with proper authority, been made;

(e)substantially prejudice the commercial interests, including intellectual property rights, of that entity or third party from whom information was obtained;

(f)cause substantial harm to the ability of the Government to manage the economy of Kenya;

(g)significantly undermine a public or private entity’s ability to give adequate and judicious consideration to a matter concerning which no final decision has been taken and which remains the subject of active consideration;

(h)damage a public entity’s position in any actual or contemplated legal proceedings; or

(i)infringe professional confidentiality as recognized in law or by the rules of a registered association of a profession.

Some factors to be taken into consideration include: –

• If requested information reveals a serious public safety or environmental risk, both the unwarranted invasion of privacy and prejudice of commercial interests of third parties shall not be prohibited.
• Despite the limitations outlined, a public entity or private body may be required to disclose information where the public interest in disclosure outweighs the harm to protected interests as shall be determined by a Court.
• A public entity is not obliged to supply information to a requester if that information is reasonably accessible by other means
• Unless the contrary is proved by the public entity or private body, information is presumed not to be exempt if the information has been held for a period exceeding thirty years.

Courts’ decisions

In the case of Khalifa & another v Principal Secretary, Ministry of Transport & 4 others; Katiba Institute & another (Constitutional Petition E032 of 2019) (2022), the petitioners had requested for agreements, contracts, and memorandum of understanding in relation to the SGR project. The respondents had refused to give the information citing national security reasons. The High Court held that, restrictions on information based on national security should have a genuine purpose and demonstrable effect of protecting legitimate national security interests. Additionally, the restriction should be prescribed by law. Consequently, the court issued a declaration that the failure by the respondents to provide information was a violation of the right to access information.

The case of Edwin Harold Dayan Dande and 3 others v The Inspector General, National police Service and 5 others (2022) was before the Supreme Court and it touched on private entities. One of the issues of determination in the appeal was distinguishing between the right to access to information held by a public body vis-a-vis a private person.It was the appellants’ contention that the Court of Appeal adopted a narrow interpretation of the right to access to information held by a private body. They also posited that the only test to be met under Article 35 is for a person to demonstrate that the information is required for the exercise or protection of a right or fundamental freedom under the Constitution. They argued that the information sought was necessary and a prerequisite for the realization of the right to dignity which is the foundation of other rights.

However, the Supreme Court in agreeing with the respondents held that, despite the appellants citing several rights that they sought to protect using the information, they failed to demonstrate any nexus between the information sought and the rights to be protected. Additionally, failure by the appellants to establish the connection between the rights to be protected and the information requested meant that if they were to be granted that information, there would be unwarranted invasion of the privacy of other third parties thus causing substantial prejudice to their commercial interests.

In summation, the Supreme Court was simply saying that in order to request information from private entities, by virtue of Article 35(1) b of the Constitution and Section 4 of the Act a requester has to demonstrate:

a. The right that seeks to be protected; and

b. That access to the information is required to exercise or protect that right.

Conclusion

To sum up, it is evident that refusal to provide information to members of the public should be accompanied by genuine and demonstrable reasons which are prescribed by the law. Additionally, in seeking information from private entities, members of the public should be keen to state the right which they want to protect and demonstrate a link between the information sought and the rights to be protected.

In an era where personal data is as valuable as currency, ensuring its protection is not just a legal obligation but a fundamental responsibility. As Kenya strides into a new age of data privacy, the Data Protection Act, 2019 isn’t just about following rules—it’s about safeguarding trust, maintaining integrity, and securing the future of your business in a digital landscape. At F.M. Muteti and Company Advocates, we understand that data protection can seem daunting amidst ever-evolving regulations and technological advancements. That’s why we’re here to demystify compliance, turning complex legal requirements into straightforward strategies tailored to your business needs.

Kenya’s Constitution guarantees privacy rights, and the Data Protection Act, 2019, enforces these rights by regulating how personal data is handled. This comprehensive framework establishes the Office of the Data Protection Commissioner (ODPC) and outlines strict requirements for data processing and management. Companies/Companies must adhere to several key obligations under the Data Protection Act and Regulations, which are crucial for ensuring compliance:

1. Registration: Companies involved in the processing of personal data must register with the ODPC if they meet certain thresholds. Specifically, entities with an annual turnover exceeding KES 5 million or those employing more than 10 individuals must complete this registration.
2. Compliance Principles:
   1. Lawful Processing: Data must be processed in a way that is legal, fair, and transparent. Companies must have a clear legal basis for processing personal data, which could include obtaining consent from the data subject for fulfilling a contractual obligation.
   1. Purpose Limitation: Data should only be collected for specific, legitimate purposes and not used for other unrelated purposes.
   1. Data Accuracy: Personal data must be accurate, complete, and kept up to date.
   1. Data Security: Adequate measures must be implemented to protect personal data from unauthorized access, breaches, or loss. This includes both technical safeguards (like encryption) and organizational measures (such as access controls and staff training).
   1. Data Retention: Personal data should be kept only for as long as necessary to fulfil the purposes for which it was collected. Once the data is no longer needed, it should be securely deleted or anonymized.
   1. Data Transfer: Transferring personal data outside Kenya is subject to strict regulations.
3. Appointment of Data Protection Officer (DPO): Companies must appoint a Data Protection Officer (DPO) to oversee compliance, advise on data protection practices, conduct impact assessments, and act as a liaison with the ODPC. This role can be filled by an internal employee or an external expert.
4. Consequences of Non-Compliance: Failure to comply with the Data Protection Act can lead to significant legal and financial consequences. Penalties include fines up to KES 3 million or imprisonment for up to ten years for severe breaches. Additional fines of up to KES 5 million can be imposed for not adhering to ODPC enforcement notices. Non-compliance can also damage your Company’s reputation and erode customer trust.

We offer specialized services to ensure your Company complies with all aspects of the Data Protection Act, including:

• Compliance Audits: We conduct thorough audits to assess your current data protection practices and identify areas needing improvement.
• Registration Support: Our team helps with the registration process with the ODPC, ensuring that your Company meets all legal requirements.
• Policy Development: We assist in drafting and updating data protection policies and procedures tailored to your business needs.
• DPO Services: We can act as your outsourced Data Protection Officer, offering expert advice and handling interactions with the ODPC on your behalf.
• Legal Representation: In the event of compliance issues or disputes, our experienced lawyers offer robust representation to safeguard your interests.

At F.M. Muteti and Company Advocates with a team of top data privacy lawyers, we bring a deep understanding of data protection laws and a commitment to providing personalized legal solutions. Our goal is to help you navigate the regulatory landscape efficiently and protect your Company from potential penalties and reputational damage. Ensure your business is compliant with Kenya’s data protection regulations. Contact us today to schedule a consultation and learn how we can support your data protection need

Disclaimer

The information provided in this article is intended for general advice and does not constitute a legal advisory. Bearing in mind each legal issues has its unique features; we advise prospective clients to get in touch with us for more pointed and contextualized legal advice.