The Labour and Relations Court has issued a landmark ruling, ordering the Kenya Broadcasting Corporation (KBC) to immediately delete all facial recognition data collected from its employees for use in its time and attendance monitoring system.
In her ruling, Justice Maureen Odero declared that the state broadcaster had violated its employees’ constitutional right to privacy and failed to adhere to the provisions of the Data Protection Act (2019).
The court emphatically stated that facial recognition data qualifies as ‘sensitive personal data’ under the Data Protection Act, meaning its collection requires heightened safeguards and specific measures.
Crucially, Justice Odero noted that KBC deployed the invasive technology without conducting a mandatory Data Protection Impact Assessment (DPIA), a failure which, on its own, constituted a constitutional violation. Furthermore, the broadcaster failed to obtain explicit consent from its staff, whose union filed the petition challenging the system.
The system, which was rolled out between September 15 and 20, 2017, required staff to surrender their biometric data to a third-party vendor to “clock in” and “clock out,” and for tracking their movement within the KBC premises.
Justice Odero declared the entire process illegal, void, and a violation of the rights of all employees whose data was collected under the scheme. She highlighted the lack of transparency and awareness regarding the data handling processes before implementation.
In addition to ordering the immediate destruction of all collected facial recognition data, the court issued further directives to ensure future compliance:
- Policy Development: KBC must develop a comprehensive Data Privacy Policy and review all internal policies for new technologies involving sensitive data, in compliance with the Data Protection Act (2019), within 60 days.
- Data Commissioner Oversight: The court ordered that its ruling be served on the Data Commissioner, who is tasked with reviewing KBC’s technology adoption processes.
- Compliance Report: KBC must submit a report to the Data Commissioner within 30 days confirming full compliance with the court orders.
The matter is scheduled for a status review on January 21, 2026.