1

Contents
RESEARCH OUTLINE...............................................................................................................................1
FACTS.................................................................................................................................................1
ISSUE..................................................................................................................................................2
RULE/RATIO.......................................................................................................................................2
APPLICATION.....................................................................................................................................3
PRIVACY AND RIGHTS OF A DATA SUBJECT...................................................................................3
CYBER CRIMES...............................................................................................................................5
DATA PROTECTION........................................................................................................................5
CONCLUSION.....................................................................................................................................5
COPY AND PASTED LAW SECTIONS N ARTICLES.....................................................................................6
Data Protection Act...............................................................................................................................6
72. Offences of unlawful disclosure of personal data..................................................................6
73. General penalty.....................................................................................................................7
Computer Misuse and Cybercrimes Act................................................................................................8
14. Unauthorised access....................................................................................................................8
15. Access with intent to commit further offence.............................................................................9
16. Unauthorised interference..........................................................................................................9
17. Unauthorised interception........................................................................................................10
22. False publications......................................................................................................................10
27. Cyber harassment......................................................................................................................11
Defamation Act, 1970..........................................................................................................................11
OUTLINES AND WRITING PLANS:.........................................................................................................12
IRAC (ISSUE, RULE, APPLICATION, AND CONCLUSION):.......................................................................12
CONTENTS OF A LEGAL OPINION:........................................................................................................14
ANDREA VS DCI....................................................................................................................................14
ANDREA VS TIMONA...........................................................................................................................14
ANDREA VS UNIVERSITY......................................................................................................................15

1
 2

QUESTION 1 (8 MARKS)
Andrea Wakesho, a University student at Wasomi University in Embu stumbled upon some
confidential documents on her university's server. Apparently, the server had not been
secured by the University’s ICT Department. Andrea downloaded the documents onto a flash
drive with the intention of studying them further. The University’s ICT Department had no
idea that Andrea downloaded the documents. However, to date, Andrea is yet to study the
documents.
Unknown to Andrea, her roommate Timona Wandia had been secretly observing her actions
and decided to record a video of her accessing the confidential documents. Timona then
shared the video on several social media platforms accusing Andrea of hacking into the
university's server and stealing sensitive information. Timona on her social media posts
referred to Andrea as ‘an incorrigible hacker and thief’.
Due to Timona’s social media posts, Andrea has been summoned by the Directorate of
Criminal Investigations to shed light on the allegations levelled against her. The University
Senate has also sent a letter to Andrea to show cause as to why she should not face
disciplinary action.
With the above information, draft the following:
a.) A research outline for the matter, (Maximum two (2) A4 pages) and
b.) A legal opinion to Andrea explaining her legal position and options available to her.
(Maximum four (4) A4 pages).

RESEARCH OUTLINE
FACTS
Andrea Wakesho
 A University student at Wasomi University in Embu
 She downloads confidential unsecured documents from her university's server with the
intention of studying them further.
 The University’s ICT Department had no idea that Andrea downloaded the documents.
 However, to date, Andrea is yet to study the documents.
 As a aresult of Timona’s social media posts Andrea has been summoned by the
Directorate of Criminal Investigations to shed light on the allegations levelled against her
and the University Senate has also sent a letter to Andrea to show cause as to why she
should not face disciplinary action.

2
 3

Timona Wandia
 Andreas roommate
 Timona Wandia had been secretly observing her actions and
 She secretely records a video of her accessing the confidential documents.
 Shares the video on social media platforms
 In the video and on social media she accuses Andrea of being an incorrigible hacker and
thief

ISSUE
What are the legal issues
1. Are Andreas actions a breach of the Computer Misuse and Cybercrimes Act offenses?
2. Is Andrea guilty of Data Protection Act offenses?
3. Is Andrea in breach of the Universities rules and regulations?
4. Is Timona guilty of defamation?
5. Is Timona guilty of Data Protection Act offenses?
6. Is Timona gulty of violating Andreas right to privacy?
7. Is Timona guilty of breaching Anreas right to digniy?
8. Is Timona in breach of the rights of a data subject?
9. Is Timona guilty of cyber harassment?

RULE/RATIO
relevant legal rule(s) that apply to the issues
1. Computer Misuse and Cybercrimes Act sections 14, 16, 17, 27?
2. Data Protection Act sections 26, 72 and 73?
3. Defamation as per common law and Defamation Act, 1970
4. 2010 Constitution, article 28 and 31
5. Kenya is a signatory to the Universal Declaration of Human Rights (‘UDHR’) and has
ratified the International Covenant on Civil and Political Rights (‘ICCPR’). Article 17 of
the ICCPR, which reinforces Article 12 of the UDHR, provides that “no one shall be
subjected to arbitrary or unlawful interference with his privacy, family, home or
correspondence, nor to unlawful attacks on his honour and reputation”.

APPLICATION

3
 4

PRIVACY AND RIGHTS OF A DATA SUBJECT

Tumaz and Tumaz Enterprises Limited & 2 others v National Council for Law
Reporting (Miscellaneous Civil Case E144 of 2021) [2022] KEHC 14747 (KLR) (1
November 2022) (Judgment)
http://kenyalaw.org/caselaw/cases/view/244833/
“In a nutshell, in an action for a privacy right violations, a claimant must allege and prove the
following elements:
1. that there was an unwarranted invasion of the individual’s privacy;
2. that there was intentional intrusion on his her private concerns;
3. that publication was without the claimants’ consent, where such written consent is
required; and
4. that the claimant’s name or picture was used for trade or advertising purposes, where
privacy invasion is alleged by publication of one’s name or likeness for trade and advertising
purposes.
It is worth noting that in actions for privacy right violations, truth is not a defence and it is not
necessary to allege or prove special damage. A suit for damages or an injunction where
damages would not adequately redress an injury is sufficient.”

Jessicar Clarise Wanjiru –vs- Davinci Aesthetics & Reconstruction Centre & 2
Others [2017] eKLR where the privacy was defined as follows:“The right of the individual
to be protected against intrusion into his personal life or affairs, or those of his family, by
direct physical means or by publication of information.”[5]In the above sense any intrusion of
personal life by whatever means or form such as photography, written articles or caricatures
may be ground for an action for breach of privacy.”

T.O.S v Maseno University & 3 Others [2016] eKLR where Chemitei J held that;“From the
above reasoning and expositions of the law it is clear that publication or use of the images of
an individual without his consent violates that person’s right to privacy. I say so because a
person's life is a restricted realm in which only that individual has the power of determining
whether another may enter, and if so, when and for how long and under what conditions.”

Coalition for Reform and Democracy (CORD) & 2 others –vs- Republic of Kenya & 10
others [2015] eKLR where it was held that;“Protecting privacy is necessary if an individual is
to lead an autonomous, independent life, enjoy mental happiness, develop a variety of diverse
4
 5

interpersonal relationships, formulate unique ideas, opinions, beliefs and ways of living and
participate in a democratic, pluralistic society. The importance of privacy to the individual
and society certainly justifies the conclusion that it is a fundamental social value, and should
be vigorously protected in law. Each intrusion upon private life is demeaning not only to the
dignity and spirit of the individual, but also to the integrity of the society of which the
individual is part.”

M W K v another v Attorney General & 3 others [2017] eKLR, the court observed as
follows; “Dignity is a founding value of our Constitution. It informs most if not all of the
rights in the Bill of Rights and for that reason is of central significance in the limitations
analysis.
105.The value of dignity in our Constitutional framework cannot therefore be doubted. The
Constitution asserts dignity to contradict our past in which human dignity was routinely and
cruelly denied. It asserts it too to inform the future, to invest in our democracy respect for the
intrinsic worth of all human beings.
106.Human dignity therefore informs constitutional adjudication and interpretation at a range
of levels. It is a value that informs the interpretation of many, possibly all, other rights. This
Court acknowledges the importance of the constitutional value of dignity in interpreting
rights such as the right to equality, the right not to be punished in a cruel, inhuman or
degrading way, and the right to life. Human dignity is also a constitutional value that is of
central significance in the limitations analysis. Dignity is not only a value fundamental to our
Constitution, it is a justiciable and enforceable right that must be respected and protected.”

J W I & another v Standard Group Limited & another [2015] eKLR which the Petitioner
has referred and stated that;“In determining the scope of the right to privacy, the Consultative
Assembly of the Council of Europe has defined Article 8(2) of the European Convention on
Human Rights, which provides for the right to privacy of an individual’s private and family
life, his home and correspondence, as follows;“The right to privacy consists essentially in the
right to live one’s own life with a minimum interference. It concerns private family and home
life, physical and moral integrity, honour and reputation, avoidance of being placed in a false
light, non-revelation of irrelevant and embarrassing facts, unauthorized publication of private
photographs, protection from disclosure of information given or received by the individual
confidentially”.

5
 6

Kenya Human Rights Commission v Communications Authority of Kenya & 4

others [2018] eKLR posited on the right to privacy as follows:“
52.Privacy is a fundamental human right, enshrined in numerous international human rights
instruments. It is central to the protection of human dignity and forms the basis of any
democratic society. It also supports and reinforces other rights, such as freedom of
expression, information, and association. The right to privacy embodies the presumption that
individuals should have an area of autonomous development, interaction, and liberty, a
“private sphere” with or without interaction with others, free from arbitrary state intervention
and from excessive unsolicited intervention by other uninvited individuals. Activities that
restrict the right to privacy, such as surveillance and censorship, can only be justified when
they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the
aim pursued.

CYBER CRIMES

DATA PROTECTION

CONCLUSION

6
 7

COPY AND PASTED LAW SECTIONS N ARTICLES

ARTICLES
31. Privacy
Every person has the right to privacy, which includes the right not to have—
(a) their person, home or property searched;
(b) their possessions seized;
(c) information relating to their family or private affairs unnecessarily
required or revealed; or
(d) the privacy of their communications infringed.

28. Human dignity

Every person has inherent dignity and the right to have that dignity respected
and protected.

UON STUDENT REGULATIONS

General Conduct
All students shall conduct themselves in accordance with the highest standards of
integrity, personal discipline and morality and in particular, shall:-
i. Respect and adhere to the administrative and academic procedures and
structures established by the University of Nairobi Act for the control,
governance and operations of the University,
ii. Respect the rights and privileges of the members of the University
community at all times.
iii. Carry themselves in all public places or fora with such humility and dignity as
befits their status as mature and responsible citizens

Data Protection Act

72. Offences of unlawful disclosure of personal data
(1) A data controller who, without lawful excuse, discloses personal data in any manner
that is incompatible with the purpose for which such data has been collected commits an
offence.
(2) A data processor who, without lawful excuse, discloses personal data processed by the
data processor without the prior authority of the data controller commits an offence.
(3) Subject to subsection (4), a person who—
7
 8

(a) obtains access to personal data, or obtains any information constituting such
data, without prior authority of the data controller or data processor by whom the data
is kept; or
(b) discloses personal data to third party, commit an offence.
(4) Subsection (3) shall not apply to a person who is an employee or agent of a data
controller or data processor acting within the scope of such mandate.
(5) A person who offers to sell personal data where such personal data has been obtained
in breach of subsection (1) commits an offence.
(6) For the purposes of subsection (5), an advertisement indicating that personal data is or
may be for sale constitutes an offer to sell the personal data.

73. General penalty

(1) A person who commits an offence under this Act for which no specific penalty is
provided or who otherwise contravenes this Act shall, on conviction, be liable to a fine not
exceeding three million shillings or to an imprisonment term not exceeding ten years, or to
both.
(2) In addition to any penalty referred to in subsection (1), the Court may—
(a) order the forfeiture of any equipment or any article used or connected in any
way with the commission of an offence; or
(b) order or prohibit the doing of any act to stop a continuing contravention.

26. Rights of a data subject

A data subject has a right—
(a) to be informed of the use to which their personal data is to be put;
(b) to access their personal data in custody of data controller or data
processor;
(c) to object to the processing of all or part of their personal data;
(d) to correction of false or misleading data; and
(e) to deletion of false or misleading data about them.

Computer Misuse and Cybercrimes Act

8
 9

"access" means gaining entry into or intent to gain entry by a person to a program or data
stored in a computer system and the person either—
(a) alters, modifies or erases a program or data or any aspect related to the program or data in
the computer system;
(b) copies, transfers or moves a program or data to—
(i) any computer system, device or storage medium other than that in which it is
stored; or
(ii) to a different location in the same computer system, device or storage medium in
which it is stored;
(c) causes it to be output from the computer in which it is held, whether by having it
displayed or in any other manner; or
(d) uses it by causing the computer to execute a program or is itself a function of the
program;
"interception" means the monitoring, modifying, viewing or recording of non-public
transmissions of data to or from a computer system over a telecommunications system, and
includes, in relation to a function of a computer system, listening to or recording a function of
a computer system or acquiring the substance, its meaning or purport of such function;
"interference" means any impairment to the confidentiality, integrity or availability of a
computer system, or any program or data on a computer system, or any act in relation to the
computer system which impairs the operation of the computer system, program or data;

14. Unauthorised access

(1) A person who causes, whether temporarily or permanently, a computer system to perform
a function, by infringing security measures, with intent to gain access, and knowing such
access is unauthorised, commits an offence and is liable on conviction, to a fine not
exceeding five million shillings or to imprisonment for a term not exceeding three years, or to
both.
(2) Access by a person to a computer system is unauthorised if—
(a) that person is not entitled to control access of the kind in question to the program or data;
or
(b) that person does not have consent from any person who is entitled to access the computer
system through any function to the program or data.

9
 10

(3) For the purposes of this section, it is immaterial that the unauthorised access is not
directed at—
(a) any particular program or data;
(b) a program or data of any kind; or
(c) a program or data held in any particular computer system.

15. Access with intent to commit further offence

(1) A person who commits an offence under section 14 with intent to commit a further
offence under any law, or to facilitate the commission of a further offence by that person or
any other person, commits an offence and is liable, on conviction, to a fine not exceeding ten
million shillings or to imprisonment for a term not exceeding ten years, or to both.
(2) For the purposes of subsection (1), it is immaterial that the further offence to which this
section applies is committed at the same time when the access is secured or at any other time.

16. Unauthorised interference

(1) A person who intentionally and without authorisation does any act which causes an
unauthorised interference to a computer system, program or data, commits an offence and is
liable on conviction, to a fine not exceeding ten million shillings or to imprisonment for a
term not exceeding five years, or to both.
(2) For the purposes of this section, an interference is unauthorised, if the person whose act
causes the interference-
(a) is not entitled to cause that interference;
(b) does not have consent to interfere from a person who is so entitled.
(3) A person who commits an offence under subsection (1) which—
(a) results in a significant financial loss to any person;
(b) threatens national security;
(c) causes physical injury or death to any person; or
(d) threatens public health or public safety, is liable on conviction to a fine not
exceeding twenty million shillings or to imprisonment for a term not exceeding ten
years, or to both.
(4) For the purposes of this section, it is immaterial whether or not the unauthorised
interference is directed at—
(a) any particular computer system, program or data;
(b) a program or data of any kind; or
10
 11

(c) a program or data held in any particular computer system.

(5) For the purposes of this section, it is immaterial whether an unauthorised modification or
any intended effect of it is permanent or temporary.

17. Unauthorised interception

(1) A person who intentionally and without authorisation does any act which intercepts or
causes to be intercepted, directly or indirectly and causes the transmission of data to or from a
computer system over a telecommunication system commits an offence and is liable, on
conviction, to a fine not exceeding ten million shillings or to imprisonment for a term not
exceeding five years, or to both.
(2) A person who commits an offence under subsection (1) which—
(a) results in a significant financial loss;
(b) threatens national security;
(c) causes physical or psychological injury or death to any person; or
(d) threatens public health or public safety, is liable, on conviction to a fine not exceeding
twenty million shillings or to imprisonment for a term not exceeding ten years, or to both.
(3) For the purposes of this section, it is immaterial that the unauthorised interception is not
directed at—
(a) a telecommunication system;
(b) any particular computer system data;
(c) a program or data of any kind; or
(d) a program or data held in any particular computer system.
(4) For the purposes of this section, it is immaterial whether an unauthorised interception or
any intended effect of it is permanent or temporary

22. False publications

(1) A person who intentionally publishes false, misleading or fictitious data or misinforms
with intent that the data shall be considered or acted upon as authentic, with or without any
financial gain, commits an offence and shall, on conviction, be liable to a fine not exceeding
five million shillings or to imprisonment for a term not exceeding two years, or to both.
(2) Pursuant to Article 24 of the Constitution, the freedom of expression under
Article 33 of the Constitution shall be limited in respect of the intentional publication of false,
misleading or fictitious data or misinformation that—
(a) is likely to—
11
 12

(i) propagate war; or

(ii) incite persons to violence;
(b) constitutes hate speech;
(c) advocates hatred that—
(i) constitutes ethnic incitement, vilification of others or incitement to cause harm; or
(ii) is based on any ground of discrimination specified or contemplated in Article 27(4) of the
Constitution; or
(d) negatively affects the rights or reputations of others.

27. Cyber harassment

(1) A person who, individually or with other persons, wilfully communicates,
either directly or indirectly, with another person or anyone known to that person
commits an offence, if they know or ought to know that their conduct—
(a) is likely to cause those persons apprehension or fear of violence to
them or damage or loss on that persons' property; or
(b) detrimentally affects that person; or
(c) is in whole or part, of an indecent or grossly offensive nature and
affects the person.
(2) A person who commits an offence under subsection (1) is liable, on
conviction, to a fine not exceeding twenty million shillings or to imprisonment for a
term not exceeding ten years, or to both.

Defamation Act, 1970

Kenya is a signatory to the Universal Declaration of Human Rights (‘UDHR’) and has
ratified the International Covenant on Civil and Political Rights (‘ICCPR’). Article 17 of
the ICCPR, which reinforces Article 12 of the UDHR, provides that “no one shall be
subjected to arbitrary or unlawful interference with his privacy, family, home or
correspondence, nor to unlawful attacks on his honour and reputation”.
Kenya Information and Communications Act.

12
 13

OUTLINES AND WRITING PLANS:

 For legal writing, create an outline or a writing plan at the outset to save time. An outline
or writing plan prevents back-tracking, repetition and missing of key points.
 For purposes of planning a proper legal document, two paradigms are normally used.
These are IRAC and CREAC.

IRAC (ISSUE, RULE, APPLICATION, AND CONCLUSION):

a) Issue: First, identify the legal issue or question you will be analyzing. Your statement of
the issue should track the question asked at the end of the assignment, otherwise known as
“the call of the question.” It orients the reader to the precise point you are about to discuss
and is typically one sentence. State the issue in its own separate paragraph and particularly in
a single sentence. Include brief important facts giving context to the general issue as it
pertains to your case. The statement of the issue should be succinct. For instance, Whether X
broke into and entered the house at night given that he was arrested in the house just as the
sun was setting.

b) Rule: Next, identify and discuss relevant legal rule(s) that apply to the issue. The rules
may be drawn from Statutes, authorities, etc. This informs the reader of the law pertinent to
the client’s situation. Start with general rules, which are also called umbrella rules. Then, if
applicable, move on to the more specific rules that address the issue at hand within the
general rule. The specific rules are called sub-rules. For e.g., a general rule might read:
“Night” is defined as the time between 30 minutes after sunset and 30 minutes before sunrise.
Paraphrasing the rules helps you understand them and how best they serve your analysis.
Discuss all applicable rules in the Rule section. Don’t add them later in the Application or
Conclusion Sections.
c) Application: This is the most important and usually the longest section of IRAC. Here,
apply the rules to the facts you have been given in order to show the link between the law and
the facts. In doing so, one needs to remember:

i. Substantive arguments: These includes:

13
 14

 being objective: One should analyze the case from both sides, the plaintiff’s and the
defendant’s. Consider all the facts given and the logical inferences that can be drawn from
them. Don’t make up facts or assume facts that have not been given. Demand for more facts
if you need them instead of assuming.
 don’t be too conclusory: Do not state conclusions without telling the reader how you got
there.
ii. Writing Techniques: Mirroring: Organize with paragraphs that follow the rule’s order.
 Analyze each element of the rule separately, in the order stated in the Rule section you
have written.
 If an argument is extensive and fairly evenly weighted for each side, use one paragraph to
discuss each side. In other words, the discussion of each element of the rule will contain two
paragraphs, one devoted to the plaintiff’s argument and one devoted to the defendant’s.
 For each element, present the argument for the weaker side first. End with the discussion
supporting the stronger side, the side you think will prevail on that particular element. Then,
at the end of the discussion on that element, write a sub-conclusion on behalf of the winning
side.
 Keep paragraphs moderately short: Use topic (thesis) sentences to begin each paragraph in
the Application section. Topic sentences introduce the subject matter of a paragraph.
 When doing predictive writing, use hedge words in your topic sentences and conclusions
(unless the outcome is relatively certain).
 Use transitions or signposts whenever you start a new point. They guide the reader through
the analytical structure of your writing and connect succeeding ideas and theses together or
show the relationship between them.
d) Conclusion: In a final paragraph, briefly state the conclusion you have reached as to
whether the elements of the rule have been met. The conclusion should follow from the sub-
conclusions you have reached on each respective element. Never add new information in the
conclusion. It states whether the required element of a complex or simple rule are met or not.
Techniques of outline and writing plan: The following are the techniques which might be
adopted:
a) Read through all your research.
b) Don’t overlook obvious ways of organizing.
c) Talk to a colleague.
d) Consider the reader and purpose: The writer must provide the reader with whatever
information the reader needs to understand what is being written and why.
14
 15

CONTENTS OF A LEGAL OPINION:

The writing process of a legal opinion is called CF – IRAC.
a) Citation: Give the full citation for the case, including the name of the case, the date it was
decided, and the Court that decided it. At times, the page number where the case appears in a
law report.
b) Facts: Always commence the opinion by setting out the facts as presented before you.
c) Issue: Identify and set out the issues arising. What are the issues you are going to propose
answers to?
d) Rule of Law: Identify the legal rules/principles governing the subject area.
e) Application of the rules: Regarding application of the rules: one must very clear on the
exact laws applicable and they must be arranged hierarchically i.e., the principle law first
then the rest.
f) Conclusion: A summary statement of your conclusion.
g) Signature: It is also very important.

ANDREA VS DCI
Possible criminal offences
Computer Misuse and Cybercrimes Act
14, 16, 17
Data Protection Act
72, 73
ANDREA VS TIMONA
Defamation -
Data Protection Act 72, 73
What are the possible consequences of being found liable for civil defamation? Where the
civil claim is successfully established against you, the civil reliefs that can be entered against
you include damages, injunctions, apology, or orders of retraction of defamatory
statement(s). a. Injunction: When publication of a defamatory statement is threatened, the
person about to be defamed is not obliged to wait for the act to occur. The person/entity can
apply to a Court for an injunction to prevent the publication. b. Damages: If the defamatory
statement has already been published and someone/an entity is successful in proving a
15
 16

defamation claim against a journalist, they are entitled to an award of damages as

compensation for the harm to their dignity and reputation. The award of damages in
defamation cases is discretionary. The court may consider such factors as: the gravity of the
libel; the medium in which it is published and the extent of circulation of the offending
publication; any repetition; and the conduct of the defendant after publication and during
trial, including whether there was an apology issued (para 24 C A M v Royal Media
Services Limited [2013] eKLR). c. Retraction and/or apology: An apology given after a
journalist received a complaint or during trial is a ground for mitigating the damages in a
defamation case (section 16, Defamation Act). Where an apology is not given, the court may
order the journalist to issue an apology, usually in equal measure to the size of the
publication. A court may also order a retraction of the offending article, giving the same
prominence as the defamatory article. In other instances, a court may grant damages in lieu of
a retraction or apology, especially when significant time has passed between publication and
when the orders are issued (Lucy M Kambuni v Nation Media Group Limited [2020] eKLR).

ANDREA VS UNIVERSITY

BIBLIOGRAPHY

16