Nairobi — The Office of the Data Protection Commissioner (ODPC) has ruled in favour of Catherine Kainyu Murithi in a data privacy case, ordering Becton Dickinson and Company (BD East Africa) and Safaricom PLC to pay Sh250,000 each for unlawfully processing her personal data without consent.
Murithi, a former employee of BD East Africa, filed the complaint in November 2024, alleging that her ex-employer shared a copy of her national ID with Safaricom without her nod.
The unauthorised disclosure was reportedly made to facilitate the transfer of her work-issued SIM card back to her personal identity after her employment was terminated.
According to ODPC's determination, BD East Africa violated the laws by failing to obtain Murithi's explicit consent before transferring her mobile number and processing her personal data.
Safaricom, on the other hand, was found to have acted improperly by processing personal data without verifying the complainant's authorisation.
Data Commissioner Immaculate Kassait ruled that both respondents breached Murithi's right to privacy enshrined in the constitution and failed to adhere to data regulations in the Data Protection Act, which guarantees individuals the right to be informed about the use of their personal data.
"The complainant's ID copies should not have been shared without her direct consent. The law mandates that any personal data processing be lawful, fair, and transparent," the ruling stated.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
Additionally, ODPC found that BD East Africa had transferred Murithi's personal data across borders, copying South African-based employees in email correspondences without providing adequate data protection safeguards.
However, since South Africa has established data protection laws, ODPC ruled that the cross-border transfer did not constitute a violation.
The ruling also highlighted Safaricom's failure to ensure proper procedures were followed when transferring Murithi's SIM card.
The Kenya Information and Communications (Registration of SIM Cards) Regulations require telecommunication companies to verify a subscriber's identity in person before effecting such changes.
Although ODPC does not have jurisdiction to issue constitutional declarations or permanent injunctions, the office awarded Murithi a total of Sh500,000 in damages, citing emotional distress and violation of her privacy rights.
Both BD East Africa and Safaricom have 30 days to appeal the decision in the High Court of Kenya.
