David, Listers,
The only challenge I foresee with this petition is jurisdiction in the first instance.
It was argued in the Huduma Number case by the Data Protection Commissioner, and upheld by the Court, that under the doctrine of exhaustion of administrative remedies, the matter ought to have been filed with the ODPC in the first instance.
Justice Ngaah found that Yash Pal Ghai, the second petitioner in that case, was a natural person and a data subject who ought to have approached the ODPC first.
Katiba Institute, being a non-natural person, had no standing before the ODPC and therefore was allowed to canvass its petition before the High Court.
Being a High Court ruling, it is likely a preliminary objection challenging the jurisdiction of the court to hear the matter could be raised, and the same sent to the ODPC first for determination.
Regards,
JG Mbugua
Data Privacy Consultant/Tech Blogger