ODPC Mandates Compensation and Compliance

NAIROBI, KENYA – The Office of the Data Protection Commissioner (ODPC) has ordered Liquid Telecommunications Kenya Ltd. to pay Sh700,000 in compensation to a former employee for illegally recording a virtual meeting and refusing to delete the data upon request. The ruling, delivered on Monday, 10th November 2025, by Data Commissioner Immaculate Kassait, found the internet service provider in breach of Kenya's Data Protection Act of 2019.

The case was brought forward by Andrew Alston, the former chief technology officer at Liquid Telecom, who discovered that a sensitive Zoom meeting held with the company's human resources department shortly after his employment was terminated had been recorded without his consent. Despite his explicit request for the recording not to be made and subsequent demands for its deletion, the company retained the file for over a year. The recording was later used as evidence in a separate lawsuit Alston had filed against Liquid Telecom's parent company in Mauritius.

Violation of Fundamental Data Rights

In her determination, Commissioner Kassait stated that Liquid Telecom violated two core principles of the Data Protection Act. The company infringed upon the complainant's 'right to be informed' about the use of his personal data (Section 26a) and his 'right to erasure' (Section 40(1)b). "The call containing his personal data was processed by the respondent, Liquid Kenya, without his knowledge and consent," Kassait noted in the ruling. She added that this action caused "harm and prejudice to the complainant," who had to bear costs to challenge the recording's admissibility in court.

Liquid Telecom defended its actions by claiming a "legitimate interest" in retaining the recording. The company argued it needed the file for potential evidentiary purposes, as Alston had allegedly made threats of arbitration during the heated conversation. However, the ODPC rejected this defense, ruling that even if a legitimate interest existed, the company failed its legal obligation to inform the data subject about the data processing, rendering the action unlawful.

A Pattern of Non-Compliance and Broader Implications

This is the second time the ODPC has penalized Liquid Telecom for data privacy violations. In 2024, the firm was fined Sh500,000 for using an individual's image for commercial purposes without their consent, indicating a potential pattern of non-compliance with data protection laws.

The latest ruling is a significant development for data privacy in Kenya, particularly in the context of remote work and virtual meetings, which have become standard corporate practice. It underscores that employee consent is paramount and that companies cannot secretly record conversations, even for internal purposes or potential legal defense, without transparently informing all participants.

Alongside the financial penalty, the ODPC issued an Enforcement Notice compelling Liquid Telecom to bring its data processing operations into full compliance with the Act. This decision reinforces the ODPC's increasingly assertive role in enforcing the 2019 law. The commission has recently taken action against various entities, including digital lenders for misusing third-party contact information, a restaurant for posting a patron's image without permission, and a school for using minors' photos without parental consent, signaling a zero-tolerance approach to data privacy breaches across all sectors.

For Kenyan businesses, this case serves as a stark reminder of the legal and financial risks associated with non-compliance. It highlights the necessity of having clear, lawful, and transparent data processing policies, particularly concerning employee data and virtual communications. As the digital economy expands, the ODPC's enforcement actions are establishing critical precedents that shape corporate accountability and safeguard the digital rights of citizens.