KENYA: OFFICE OF THE DATA PROTECTION COMMISSIONER GUIDELINES ON USING ALTERNATIVE DISPUTE RESOLUTION TO RESOLVE DATA PROTECTION DISPUTES
The Office of the Data Protection Commissioner (the ODPC) has released the Alternative Dispute Resolution Framework/Guidelines (ADR Guidelines) (available here). The ADR Guidelines are intended to facilitate parties settling complaints out of court with the assistance of the ODPC or settling disputes without involving the ODPC. Resolving consumer disputes through the ADR Guidelines will be easier, faster, and less expensive than going to court. Parties also have greater autonomy to achieve a settlement on their terms.
Types of ADR expressly recognized
The ADR Guidelines expressly recognize conciliation, mediation, and negotiation as suitable dispute resolution mechanisms which the ODPC is expressly authorized to facilitate under the Data Protection Act, 2019 (the Act) and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (the Regulations).
Parties may submit various disputes against an organization under the Act and the Regulations for resolution including:
- collection and processing of an individual’s personal data by an organisation;
- deletion of an individual’s personal data by an organisation; or
- any other processing of an individual’s personal data by an organisation.
The ADR Process
Initiating ADR
Either party to a dispute may file an application for ADR with the ODPC which sets out:
- the complainant’s contact information;
- the status of the dispute, that is, whether the dispute is lodged with the ODPC, before a court, or has not yet been presented before another forum;
- a brief description of the dispute if it has not already been lodged with the ODPC;
- the grounds for the ADR application; and
- any appeal documents or settlement proposals.
After evaluating the application, the ODPC will notify the parties whether the matter is eligible for ADR. The ODPC will evaluate the eligibility of a matter for ADR based on (i) whether the settlement would contravene the law; (ii) whether issues in dispute involve questions of law; (iii) public interest; (iv) whether ADR would promote compliance; and (v) willingness of both parties to participate in the ADR.
Even where the ODPC decides that the dispute is not eligible for ADR, parties can agree to pursue ADR. An application for a dispute to be referred to ADR may be made at any stage except where the ODPC has issued an Enforcement Notice (see our previous article here on Enforcement Notices).
Facilitation of the ADR process
A matter eligible for ADR will be facilitated by the ODPC. The ODPC will appoint a facilitator (a person to help parties negotiate, mediate, or conciliate). Due to the voluntary nature of the ADR process, parties will be able to present their request for a specific ADR mechanism to the ODPC. The justification can then be set out in the application form under the grounds for ADR section. Alternatively, the facilitator may, on evaluating the circumstances of the dispute, propose that the parties use conciliation, mediation, or negotiation.
From the ADR Guidelines, it is unclear whether the ODPC will have a database of approved external facilitators or will appoint facilitators from among ODPC employees. The fee for the facilitator and any administrative costs of the process, can be catered for by either party or the ODPC. In the event there is an agreement between the parties, the agreement may set out how costs are to be shared. In practice, ADR practitioners agree on the fee arrangement with the parties before commencing the dispute resolution process. We note that if a party fails to pay a facilitator within the stipulated timelines, the ADR proceedings may be terminated.
Once a facilitator is appointed, the ADR process should be concluded within 90 days. Where both parties consent, the deadline may be extended. Parties are however free to pursue other resolution mechanisms without the facilitation of the ODPC, in which case, the 90-day period will not apply.
A party is free to engage a legal advisor or any other professional agent such as an expert or representative to assist the party to submit their case during the ADR process. Parties or their representatives are required to agree on the terms and conditions of the ADR proceedings, contentious and non-contentious proceedings, material facts and documentation relevant to the dispute and timelines for the ADR process. The practice in ADR proceedings is for agreement on these preliminary issues to be documented before the ADR proceedings commence.
The first ADR meeting must be held at least 14 days after the date of an application requesting for ADR. Where a party fails to attend an ADR meeting, the facilitator may adjourn or close the ADR process. The Facilitator may encourage parties to meet without the facilitator (working meetings).
Concluding or terminating the ADR process
Where a party withdraws from the proceedings, the party must notify the ODPC and other parties within 7 days. Other reasons why the ADR process may be terminated include if a party fails to attend 3 consecutive meetings without justification, carry out a reasonable request from the facilitator without justification, pay the facilitator within stipulated timelines, or where the 90-day period has lapsed, and an extension has not been obtained from the ODPC or a court.
Despite termination, parties may request for a matter to be re-admitted to ADR using the process for initiating the ADR process. If the parties fail to resolve the matter, the facilitator must refer the matter back to the ODPC for resolution in accordance with the law.
If parties reach an agreement, the parties will sign a confidential binding ADR agreement setting out the background, issues in contention, the ADR process undertaken, agreed and non-agreed issues, and terms of a settlement. We note that while the ADR agreement is to be confidential, the ODPC is required to maintain an up-to-date register of complaints received. The ODPC is not expressly required to make the register of complaints available to the public and a complainant may request for their identity to be protected. The agreement should also set out any compensation payable, undertakings by a party, agreed payment plan, or award of costs. The agreement is on a without-prejudice basis and does not set a precedent. It will be enforced as a decision of the ODPC. Where a party fails to comply with their obligations, the other party may file an appeal at the High Court.
Conclusion
The publication of the ADR Guidelines is an important step in implementing the role of the ODPC to handle complaints and enforce the Act and the Regulations. Kenyan courts have held that the infringement of the rights of a data subject must find a remedy in one form or another. The ADR Guidelines provide individuals with flexibility in deciding whether to pursue ADR mechanisms to resolve a dispute with an organization within a fixed period and under the umbrella of a fixed framework. Organizations also have access to alternative routes of handling complaints from data subjects.