Legal experts examine recent trends in Data Protection and Intellectual Property law in the region

Recent legal cases on data protection & Intellectual property

Recent decisions by the Courts in Kenya, Uganda and Tanzania have clarified a number of issues around Data Protection and Intellectual Property Rights.  The analysis below is reproduced with kind permission of the authors, law firm Bowmans.  We are grateful to the firm for their contribution to this issue of our newsletter and in particular to:

• Ariana Issaias, Of Counsel, Bowmans Kenya – issaias@bowmanslaw.com
• Brian Manyire, Senior Associate, Bowmans Uganda – manyire@bowmanslaw.com
• Francis Kamuzora, Senior Associate, Bowmans Tanzania – kamuzora@bowmanslaw.com
• John Syekei, Head of IP and Technology, Bowmans Kenya – syekei@bowmanslaw.com

Data Protection Act in Kenya: The “Huduma Namba Decision”

The High Court in Kenya recently delivered a clear message that the Constitutional right to privacy must be respected, observed and protected and this right has been in existence since the Constitution was implemented and did not first arise with the enactment of the Data Protection Act 2019 (“DPA”).  Any subsequent legislation is intended to give effect to the already existing Constitutional right and is clearly important in order to ensure that a legal framework exists, however the absence of such legislation does not mean that these rights can be ignored.

The Huduma project

In January 2019 (prior to the enactment of the DPA), the Kenyan government announced the launch of a national identity card system—the National Integrated Identity Management System (NIIMS), popularly known as “Huduma Namba”—requiring the personal and biometric information of all ID-holders to be entered into a centralised national database.  Several legal challenges were filed and in January 2020, shortly after the enactment of the DPA in November 2019, the High Court ordered the Government to delay its implementation until a comprehensive regulatory framework under the DPA could be put in place to address, amongst other factors, the data privacy issues arising from the collection and processing of personal data and sensitive personal data.  The Government proceeded to process the collected data and continue with the roll-out of the cards on the basis that it had fulfilled the requisite requirements.  The High Court has now declared this roll-out to be unlawful on the grounds that it conflicts with the provisions of the DPA.

The ruling has provided some interesting food for thought:

The retrospective effect of the DPA

In its reasoning, the Court observed that the DPA was enacted to give effect to the Constitutional right to privacy and that the DPA was intended to apply retrospectively to such an extent or to such time as to cover any action taken by the State or any other entity or person that may affect the right to privacy.

The Court further criticised the lack of foresight by the Government stating that “it would have been prudent” for the State to ensure that the legal framework for the protection of the right to privacy was in place before taking any actions that would be likely to infringe such Constitutional right.

The Court stated that there now existed legislation against which the Government’s actions must be weighed irrespective of when such acts occurred on the basis that it affected the individual’s Constitutional right to privacy.

According to the Court, the provisions in the DPA setting out the requirements for the conduct of a data protection impact assessment (“DPIA”) did not impose any more obligations or duties on the State than that which already existed.

From our perspective, this reasoning does raise concerns particularly as regards any processing activities carried out prior to the enactment of the DPA and the draft Data Protection (General) Regulations (which are still under review and include a template form of DPIA).  Even where the Constitutional right to privacy was recognised and protected in the context of any pre-DPA processing activities, without a legal framework outlining the form of the assessment that data controllers and data processors are expected to have followed, what were such entities expected to do during this period in the absence of any such guidelines?

Data Protection Impact Assessments

The Court held that a DPIA should have been carried out prior to the collection and processing activities and issued an order mandating the conducting of a DPIA in accordance with the provisions of the DPA before the continued processing of data and rolling out of the Huduma cards.

The Court recognised that whilst DPIAs should usually be carried out prior to the processing of personal data and that a significant number of Huduma cards had already been issued, a fresh DPIA should nonetheless be carried out.  The assessment will now assist in determining whether or not additional safeguards or processes need to be put in place in respect of the processed and stored data.

In its Guidance Note on DPIAs, the Office of the Data Protection Commissioner (ODPC) clarified that the carrying out of a DPIA is only mandatory where processing is “likely to result in a high risk to the rights and freedoms of data subjects” and where it is not clear whether or not a DPIA is required, the ODPC recommends carrying out a DPIA nonetheless.

Whilst the draft Data Protection (General) Regulations are not yet in force and the template form of DPIA may be varied, in light of this recent decision, where you determine that a DPIA is required, we would recommend following the template form available in the draft Regulations and the Guidance Note in the interim.

The decision serves as a reminder to ensure that any processing activities that commenced prior to the enactment of the DPA and which are continuing currently comply with the DPA (including storage and use of such personal data).  In the event of an investigation by the ODPC, taking steps now to rectify any areas of non-compliance may go some way to show the ODPC what measures your organisation has taken (whether as a data controller or data processor) to ensure compliance with the DPA.  This extends beyond the carrying out of a DPIA and includes compliance with notification requirements, technical and security safeguards and organisational systems and procedures.

The Government has issued a press statement announcing that it will move to the Court of Appeal to challenge the High Court’s decision.  We will be keeping an eye on developments in this case and the implications arising from the decisions of the courts.

Tanzania: Godrej Case – Re-Examining the Jurisdiction of the Commercial Court

On 27^th April 2021 the High Court of Tanzania (Commercial Division) (the ‘Commercial Court’), in Godrej Consume Products Limited v Target International (T) Limited (Commercial Case No 60/2019), once again re-affirmed its own competence to entertain trademark cases. This decision comes 21 years after the decision in Kibo Match Group Limited v Mohamed Enterprises (T) Limited (Civil Case No 6/1999 (unreported)), in which the Commercial Court’s jurisdiction to entertain trademark disputes was questioned for the first time.

The Kibo Match case

The Kibo Match case was instituted shortly after the establishment of the Commercial Court, which was established with the objective of trying commercial cases.  The plaintiff instituted a suit against the defendant, alleging infringement of its KANGAROO trademark. The defendant raised an objection that the Commercial Court had no jurisdiction to entertain such a dispute since the procedural rules in force at the time did not encompass trademarks in the list of actions constituting a “commercial case”. The judge held that trademark disputes ought to be categorised among the commercial disputes that the Commercial Court was established to entertain and overruled the preliminary objection.

The Godrej case

The Godrej case, 21 years later, again brought this question to the fore.  The defendant was being sued for passing off and infringement of the plaintiff’s trademark for importing and distributing on the Tanzanian market counterfeit goods which were identical in all particulars to those manufactured and distributed by the plaintiff.  A preliminary objection on a point of law was raised by the defendant, which argued, among other things, that the Commercial Court was not the proper forum to entertain a suit which was primarily founded on allegations of counterfeiting.

The defendant’s objection was based on the ground that there is a specific forum established by law to deal with matters relating to counterfeiting issues, and that such forum is the Office of the Chief Inspector of Merchandise Marks in accordance with the Merchandise Marks Act and its supporting regulations.

The defendant simply submitted that, as there is a specific forum, it was wrong for the plaintiff to institute the suit before the Commercial Court.  In response, the plaintiff relied on the ruling in the Kibo Match case and submitted that the Commercial Court had already settled the question of its own jurisdiction to entertain trademark disputes. The plaintiff argued that the forum of the Office of the Chief Inspector of Merchandise Marks caters for matters which are criminal in nature with criminal consequences, which are quite distinct from the remedies sought before the Commercial Court (i.e., civil remedies).  This meant that the Commercial Court was not excluded from entertaining trademark disputes for civil remedies in matters in which the Chief Inspector would also have jurisdiction for purposes of obtaining criminal consequences.

Decision

The judge agreed with the plaintiff’s arguments and confirmed that, based on the Procedural Rules of the Commercial Court, that court is “indisputably conferred with the jurisdiction to entertain civil remedies emanating from infringement and passing-off claims”.

This is an important decision which serves to clarify the distinctions between the role played by the Commercial Court and that played by the Office of the Chief Inspector of Merchandise Marks. It is hoped that the Godrej case will now have settled the question of the jurisdiction of the Commercial Court in trademark disputes.

Uganda High Court issues landmark decision on industrial DESIGN INFRINGEMENT

On 28^th June 2021 the High Court of Uganda rendered a landmark decision in Migoo Industrial and Trading Company (U) Limited v Rida International Industry (U) Limited (Civil Suit 0359/2019).  Plaintiff Migoo had sued defendant Ridafor infringement of its industrial design.

Background

In 2012 Migoo contacted Mr Li Dong Biao to design an industrial mould for the production of gumboots. However, in 2016 Mr Li incorporated Rida, which also manufactured and sold gumboots.  Rida’s gumboots were identical to those produced by Migoo in design, shape, colour and sizes.

Rida registered its industrial design in 2018, before Migoo registered its own design in 2019.  However, Migoo had begun the production and sale of gumboots with the distinctive design in 2012.

Decision

This is the first Ugandan High Court decision on the infringement of industrial design rights.  For a claim to succeed, one must prove that they have a validly registered industrial design and that another party is using the same design, or a design not differing substantially from it, applied to the same product.

In determining whether a design is identical, or similar, to a registered design, the court must make a visual comparison of the two products. The court noted that it would “find an infringement if the resemblance is such as to deceive such an observer, inducing him or her to purchase one supposing it to be the other”.

In determining the similarity between the two products, the court considered: the nature of the goods to which the industrial design was applied; the intended purpose of such goods; the method of use of the goods; the complementarity of the goods; whether the goods were in competition with each other; the respective distribution channels of the goods; the relevant consumer circles; the degree of freedom of the designer in developing the design; and the usual origin of the goods.

Given the strong similarity between the conflicting designs and the similarity between the goods concerned, the court found that there was a likelihood of confusion on the part of the relevant public, and that Rida had infringed Migoo’s industrial design in respect of the gumboots.

The court issued a permanent injunction preventing Rida from reproducing Migoo’s industrial design, and awarded Migoo: special damages in the amount of USh 6.5 billion (approximately USD 1.83 million); general damages in the amount of Ush 5.5 billion (approximately USD 1.55 million); interest on the damages at 15% per annum; and the costs of the suit.

Comment

The decision raises the issue of whether the proprietor of a registered industrial design can infringe an earlier similar/identical industrial design that was registered after the proprietor of the later design obtained a registration.  Given that the right to apply for registration of an industrial design lies with the party which commissioned the design (in this case Migoo), Rida had no right to apply for registration of a design that had been commissioned and used for several years by Migoo.

Therefore, the court ought to have revoked or invalidated Rida’s industrial design registration under Section 90 of the Industrial Property Act 2014 before making a finding of infringement. A revoked registration ceases to have effect from the date of the grant of the certificate of registration and, therefore, any unauthorised use on Rida’s part would be a clear infringement.

Nonetheless, this outcome encourages manufacturers to innovate, register their industrial designs and aggressively enforce their rights against infringers; in particular, it will assist manufacturers in their fight against the importation of low-cost imitations.

The decision is notable for awarding Ush 12 billion (approximately USD 3.3 million) in general and special damages for the infringement of IP rights, an amount that has undoubtedly sent shock waves through the market.