The Employment and Labour Relations Court has barred the Kenya Broadcasting Corporation (KBC) from continuing the use of facial recognition technology on its employees after finding that the system violated constitutional privacy protections and the Data Protection Act, 2019.
Justice Maureen Odero ordered the state broadcaster to immediately erase all facial images and biometric data it had collected from staff through its digital time and attendance monitoring system.
In the judgment, the court held that facial recognition data qualifies as sensitive personal data under Kenyan law and therefore requires strict legal safeguards before it can be collected or processed.
Justice Odero found that KBC introduced the invasive technology without first carrying out a mandatory Data Protection Impact Assessment, a failure she ruled rendered the entire process unlawful and unconstitutional.
The court further established that KBC failed to obtain clear, informed and voluntary consent from its workers before subjecting them to biometric registration. Instead, employees were compelled to surrender their facial data as a requirement for clocking in and out of work, effectively stripping them of their freedom of choice in the matter.
Evidence placed before the court showed that the biometric system was rolled out between September 15 and 20, 2017, and involved a third-party technology vendor that collected facial images for purposes of staff attendance tracking and movement monitoring within KBC premises.
However, the broadcaster did not adequately disclose how the data would be stored, how long it would be retained, or who would have access to it, creating serious risks of misuse, exposure and abuse.
Justice Odero held that the lack of transparency surrounding the data handling process amounted to a direct violation of employees’ right to privacy as guaranteed under Article 31 of the Constitution.
She ruled that KBC’s actions failed the legal tests of necessity, proportionality and legality required where sensitive biometric surveillance is involved.
The court directed KBC to permanently destroy all facial recognition and biometric data collected through the impugned system.
“I do order KBC to develop and implement a comprehensive data privacy policy within 60 days to guide any future adoption of technology involving personal information,” the judged directed.
In addition, the court instructed that the judgment be served upon the Office of the Data Protection Commissioner to facilitate regulatory oversight.
KBC was further ordered to file a formal compliance report with the Data Protection Commissioner within 30 days confirming that all the biometric data has been fully and irreversibly deleted.
The matter is scheduled for a status review on January 21, 2026, when the court will assess whether the broadcaster has fully complied with its directives.
