← Muchangi Patrick Published Work
⇩ Download PDF
Muchangi Patrick & Co. Advocates logo Muchangi Patrick & Co. Advocates ← Back to the Blog

Case Note

Case Notes & Commentary
ODPC & High Court, Kenya
One ruling, digested on its own — the facts, the holding, and the practice point
[2026] KEHC 1281

A family business is ordered to stop using a relative's KRA PIN without his knowledge

Savla v Maralal Energy Limited & 2 Others

Declarations granted Case Note Data Protection · Administrative Law
By the Editorial Board, Muchangi Patrick & Co. Advocates

A petitioner alleged systemic denial of access to his own salary and employment information, unauthorised use of his KRA PIN to file statutory returns, and non-compliance with binding directives of the Commission on Administrative Justice, all across three family-owned companies. The respondents argued the dispute was purely commercial and that the petitioner lacked capacity to sue. The Court held the burden of proving incapacity rested on the respondents and was not discharged by a single medical report, that the doctrine of constitutional avoidance did not apply because the primary claim was denial of information the petitioner had a constitutional right to access, that the right to information under Article 35 extends to private entities where needed to protect a right, and that using someone's KRA PIN to file statutory returns without their knowledge violates Article 31.

Practice pointArticle 35 access-to-information rights are not confined to public bodies — and using a relative's or associate's statutory identifiers (KRA PIN, ID number) for filings without their knowledge is a live Article 31 privacy violation, separate from any data-controller relationship under the Act.
Cite this page: Muchangi Patrick & Co. Advocates, "A family business is ordered to stop using a relative's KRA PIN without his knowledge: Savla v Maralal Energy Limited & 2 Others" (dataprivacyadvocates.co.ke, 2026) <https://dataprivacyadvocates.co.ke/case-savla-v-maralal-energy-limited-and-2-others.html>.
How this touches a live ODPC matter

Whether you are defending a complaint, appealing a determination, or bringing a privacy claim of your own, the forum you choose and the procedural record you build early usually decide the outcome.

Muchangi Patrick & Co. Advocates represents complainants and respondents before the Office of the Data Protection Commissioner and on appeal, judicial review and constitutional petition before the High Court.

Continue reading
← A small college's financial hardship does not excuse missing the appeal window
All Case Notes on the Blog
The High Court's data protection jurisdiction is "staggered," not absent →