| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Legal Provisions Reviewed |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 5 August 2025 |
| Decided: | 3 November 2025 |
| Published: | Yes |
| Fine: | KES.700,000 |
| Parties: | Andrew Alston vs. Liquid Telecommunications Kenya Ltd |
| Case No.: | 1125 of 2025 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Andrew Alston alleged Liquid Telcom recorded his consultation call without consent and failed to erase it. Liquid used the data for external arbitration (purpose limitation violation). The Data Commissioner found Liquid liable for unlawful processing and infringing Alston’s rights, ordering KES 700,000 compensation and an enforcement notice.
The Complainant alleged that the Respondent recorded a virtual consultation call he held with HR representatives of the Liquid Group without obtaining his consent. He stated that during the call, which became heated, he explicitly denied consent to the recording and was informed by the HR representative that, as a result of his objection, the recording would be deleted immediately after the call. The Complainant contended that the Respondent failed to honor this commitment and instead further processed the recording in violation of the principle of purpose limitation, as well as failing to fulfill his right of erasure and right to be informed. Specifically, the Complainant found that Liquid Kenya provided the recording to Liquid Telecommunications-Mauritius, who then used it as part of their evidence, including a transcript, in an arbitration proceeding over a different matter in South Africa. He denied that the recording had any relevance to that arbitration, noting the recording dealt exclusively with his work visa issues in Kenya. The Complainant asserted that he incurred substantial legal costs preparing to object to the admissibility of the recording and that he is entitled to compensation.
The Respondent confirmed that the consultation call was recorded by the HR representative but maintained that the recording was securely retained and processed for evidentiary purposes within arbitration proceedings initiated by the Complainant against Liquid Mauritius. The Respondent admitted that the HR representative had acknowledged the Complainant’s request to delete the recording and confirmed it would be deleted. However, they stated that the retention was necessary to preserve the call for evidentiary purposes, documenting possible threats or concerns raised during the discussion. They argued that retaining the recording was justified on the basis of legitimate interests under Section 30(1)(b)(vii) of the Act, which served to preserve an objective and verifiable account of the matters discussed, and did not require consent. Furthermore, they submitted that retaining the data was lawful for evidentiary purposes pursuant to Section 40(3) regarding the right of erasure. The Respondent ultimately argued that the Complainant suffered no pecuniary or reputational damage and was not entitled to compensation since Liquid Mauritius later elected not to introduce or rely on the recording in the arbitration.
The Office of the Data Protection Commissioner (ODPC) determined that a call recording inherently contains personal data, as it includes the voice of the person speaking, qualifying it as a biometric and physiological identifier falling under the Office's mandate. The ODPC found that the Respondent failed to fulfill its duty to notify the Complainant, as no evidence was provided demonstrating compliance with all necessary elements of notification outlined in Section 29, such as informing him of the purpose for which the data was being collected, the third parties to whom it would be transferred, or the security safeguards. Crucially, the ODPC concluded that the Respondent did not establish a lawful basis for processing the Complainant’s personal data. The purported justification of "legitimate interest" failed the necessity test, as the Respondent could have relied on less intrusive means, such as written confirmation or meeting minutes, for purposes of litigation evidence.
Furthermore, the ODPC found that the Respondent processed the data in violation of the principle of purpose limitation under Section 25(c) of the Act. The data was collected during a consultation about exit details and was subsequently processed by a sister company (Liquid Mauritius) to be used as evidence in an arbitration proceeding, which was not the original explicit or specified purpose. The ODPC also found that the Respondent violated the Complainant’s right to be informed under Section 26(a) and his right to erasure under Section 40(1)(b). The continued processing of the data, even after the request for erasure, was not considered to have occurred within a 'reasonable time'.
The foundation of the determination was the finding that the Respondent failed to adhere to the core principles of data protection, specifically violating Sections 26(a) (right to be informed), 40(1)(b) (right to erasure), and 25(c) (purpose limitation).
Having found that the Respondent processed the Complainant's personal data unlawfully, without a lawful basis, and violated his rights, the Data Commissioner issued the following final determination: