Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Lilian Nderitu and John Mureithi alleged Josephat Karungo and Freshia Mugo's CCTV cameras intruded on their private home, causing distress. The ODPC found the processing unlawful, violating privacy principles (Section 25). The Data Commissioner ordered KES 200,000 compensation and an Enforcement Notice against the Respondents.

Facts

The Complainants alleged that the Respondents installed CCTV cameras on their property in a manner that intruded upon the Complainants’ private residence. The installation, which took place around mid-2021, was purportedly to enhance security within the neighborhood but instead infringed upon their right to privacy. The Complainants specifically noted that the placement of the cameras deprived them of a quiet and safe living environment, interfering with the peaceful enjoyment of their property.

They further contended that the field of view of two of the cameras allegedly extended into their kitchen and the surrounding areas, causing stress, anxiety, and emotional and psychological distress due to the continued surveillance. Despite multiple attempts, including through mutual contacts, legal representation, and escalating the matter to the police and the area chief, the surveillance issue remained unresolved. The Complainants emphasized that while security cameras play an important role, there is no justification for violating another person's privacy. They sought remedies including the removal of the CCTV cameras, cessation of activities invading their privacy, general damages for the anxiety and psychological distress caused by the alleged intrusion, and sanctions against the Respondents for breaching personal data privacy.

The Office notified the Respondents of the complaint on July 28, 2025. The Respondents submitted a response to the Office.

The Respondents categorically denied the allegations that they installed CCTV cameras to spy on, monitor, or record images of the Complainants’ property. They asserted that their claims of privacy violation were factually inaccurate, legally untenable, and motivated by malice rather than genuine data protection concerns. The Respondents maintained that their actions were lawful, necessary, and guided by legitimate security concerns. They stated that the CCTV system was installed early in 2021 after an attempted burglary, following consultations with community elders and security representatives, and was done in good faith to enhance security and not to infringe on anyone's privacy.

Crucially, the Respondents asserted that the CCTV camera in question had already been readjusted before the formal complaint was received, specifically on July 14, 2025, as a gesture of goodwill following a meeting with the area chief. They denied all allegations raised and reiterated that the camera’s current orientation does not violate privacy rights. They ultimately argued that the complaint was without merit and should be dismissed entirely, asserting that the installation served a legitimate security purpose and involved no unlawful data collection or intentional privacy breach.

The Office of the Data Protection Commissioner (ODPC) determined that the core issue was the alleged unlawful installation and positioning of the CCTV cameras and whether the Respondents fulfilled their obligations under the Act.

The ODPC found that the Respondents relied on legitimate interest under Section 30(1)(b)(vii) of the Act, claiming the CCTV was for security. While the Office acknowledged that security is a legitimate purpose, it must be pursued proportionally and within the confines of the law. The Respondents failed to demonstrate that they ensured the camera’s range did not capture neighboring property. This failure breached the principles of privacy, lawfulness, fairness, and data minimization under Section 25(a), (b), (c), and (d) of the Act.

The ODPC also noted that the Complainants’ home is a private space, and continued surveillance from a neighboring property, even if unintentional, constitutes unauthorized processing of personal data contrary to Sections 25(a), (b), (c), and (d) of the Act. Furthermore, the ODPC found that the Respondents' admission that the camera was later repositioned demonstrated that its earlier range extended into the Complainants' property, and the prolonged period before correction amounted to interference with the Complainants' privacy. The Respondents' delay of almost a year in acting on rectification requests also violated the principles enshrined under Section 25 of the Act and the statutory right to request rectification under Section 40(1).

• Legal Provisions Reviewed

Holding