Held 1. From a reading of section 56 of the Data Protection Act, a mechanism for internal dispute resolution had been provided to a data subject who was aggrieved by a decision of any person under the Act. Such person could lodge a complaint with the Data Commissioner. The form the complaint took, the manner in which it could be lodged and procedure for the resolution of the complaint were all matters that had been catered for in sections 56 and 57 of the Data Protection Act. 2. Whether there was a remedy alternative to judicial review, which was equally convenient, benecial and eective was one of the factors that a judicial review court would consider in exercising its discretion to grant or not to grant orders for judicial review. The alternative remedy could take several forms, one of which was the right of appeal which was the right in section 56(1) of the Data Protection Act. One could only lodge a complaint to the Data Commissioner only when aggrieved by a decision made under the Act. The complaint in that context would be an appeal against the decision by which the data subject was aggrieved. 3. Where there was an alternative remedy and Parliament had prescribed a particular form of procedure for resolution of a complaint, that procedure ought to be followed. Section 9(2) of the implied that where there existed internal mechanisms for resolution of the dispute which, inevitably, would yield an alternative remedy, it was no longer a matter of the court’s discretion to entertain, let alone grant, an application for judicial review. In that event, the court would not review the administrative action until the internal mechanism had been exhausted. 4. The mechanism set up in sections 56 and 57 of the Data Protection Act would qualify as one of those internal mechanisms for appeal or review and all remedies available under any other written law which the Legislature had in mind in section 9(2) of the Fair Administrative Action Act and which had to be exhausted in any particular case before one invoked the jurisdiction of a judicial view court. 5. The internal mechanism under the Data Protection Act was available only to data subject of which the 1st applicant was not. The 1st applicant was a constitutional research, policy and litigation institute established to further implementation of Kenya’s Constitution and generally to seek the development of a culture of constitutionalism in Kenya. Not being a data subject, the burden upon the 1st applicant was to demonstrate how it was aected by a decision by any person under the Data Protection Act. 6. Sucient interest was in practice a broad, exible concept. What was a sucient interest was a mixed question of fact and law. The determination of any issue as to whether the claimant had a sucient interest to bring the challenge in question would depend on consideration of the relationship between the claimant and the matter to which the claim related, having regard to all the circumstances of the case. Individuals have been recognised as having standing not only where their rights or interests were aected but in a broad range of situations where in some way they were aected by a decision. A public spirited citizen raising a serious issue of public importance could be recognised as possessing standing. The courts had increasingly recognised that a wide range of pressure groups have standing to bring challenges in matter which concern their areas of interest or expertise. 7. The 1st applicant might not have been a public-spirited citizen raising a serious issue of public importance but it was, for all intents and purposes, a public-spirited entity raising an issue of public interest. It could also be recognised as a pressure group in the implementation of Kenya’s Constitution and which generally sought the development of a culture of constitutionalism in Kenya. The 1st applicant lacked standing to lodge a complaint to the Data Commissioner under section 56 of the Data Protection Act, but it certainly had the necessary locus to lodge the instant proceedings because of suciency of interest. 8. The 2nd applicant’s position was shaky, he was bound to comply and follow the prescribed procedure set out in in the Data Protection Act. He could have had good reasons to avoid those procedures but it was for that reason that section 9(4) of the Fair Administrative Action Act provided a window for kenyalaw.org/caselaw/cases/view/220495/ 4