A recent ruling by the Office of the Data Protection Commissioner (ODPC) has shown that even an internal human resource consultation call can spiral into legal liability if consent, transparency and clear purpose are ignored.

In the case of Andrew Alston against his employer Liquid Telecommunications Kenya Ltd, a single recorded call ultimately resulted in a KSh700,000 compensation order and an enforcement notice against the company.

The dispute arose from a virtual HR consultation call linked to an employee’s exit discussions.

According to the complainant, he expressly declined consent to the recording and was assured it would be deleted.

Instead, the audio was retained and later surfaced in separate arbitration proceedings involving a related company.

For regulators, that sequence of events triggered multiple red flags — not just about consent, but about how long data was kept, who accessed it, and why it was used beyond its original context.

One of the most striking findings from the ODPC was the classification of a voice recording as biometric personal data.

In simple terms, your voice is considered an identifying feature, just like a fingerprint or facial image.

That means recording a conversation is not a harmless administrative act; it is the collection of protected personal data.

The determination highlights three common pitfalls that can quickly turn an ordinary recording into a compliance nightmare:

1. Assuming a Beep Equals Consent
Automated “this call may be recorded” notices are not enough. The regulator found that organisations must clearly explain why data is being recorded, who might receive it, and how it will be protected.

2. Stretching the Purpose Later
Recording a meeting for “internal reference” and later using it for litigation or sharing it with affiliates breaches the principle of purpose limitation, a core rule that data should only be used for the reason it was first collected.

3. Ignoring Deletion Requests
When a person asks for their data to be erased, the law requires prompt action or formal notification if deletion is refused for legal reasons. Silence or delay can amount to a violation on its own.

The company argued that keeping the recording served a “legitimate interest” in case of future disputes.

The ODPC disagreed, finding that less intrusive alternatives, such as written minutes, could have achieved the same goal without retaining sensitive biometric data.

The lesson is stark: “just in case” is not a lawful basis on its own.
Without necessity and proportionality, that precaution can morph into unlawful processing.

Beyond the financial penalty, the enforcement notice signals that regulators are increasingly willing to scrutinize everyday corporate practices, especially in multinational structures where data may move across borders between affiliated companies.

For employers, HR teams, and managers, the message is clear: recording workplace conversations is no longer a casual administrative decision.

It is a regulated activity with legal consequences if mishandled.

In an era of virtual meetings and remote work, the record button can feel harmless.

But as this ruling demonstrates, a few seconds of audio can carry months of legal exposure.and a six-figure price tag.

The post How Recording a “Simple” HR Call Could Land You in KSh700,000 Trouble appeared first on Insider Bits News.

Justice Maureen Odero ordered the state broadcaster to immediately erase all facial images and biometric data it had collected from staff through its digital time and attendance monitoring system.

In the judgment, the court held that facial recognition data qualifies as sensitive personal data under Kenyan law and therefore requires strict legal safeguards before it can be collected or processed.

Justice Odero found that KBC introduced the invasive technology without first carrying out a mandatory Data Protection Impact Assessment, a failure she ruled rendered the entire process unlawful and unconstitutional.

The court further established that KBC failed to obtain clear, informed and voluntary consent from its workers before subjecting them to biometric registration. Instead, employees were compelled to surrender their facial data as a requirement for clocking in and out of work, effectively stripping them of their freedom of choice in the matter.

Evidence placed before the court showed that the biometric system was rolled out between September 15 and 20, 2017, and involved a third-party technology vendor that collected facial images for purposes of staff attendance tracking and movement monitoring within KBC premises.

However, the broadcaster did not adequately disclose how the data would be stored, how long it would be retained, or who would have access to it, creating serious risks of misuse, exposure and abuse.

Justice Odero held that the lack of transparency surrounding the data handling process amounted to a direct violation of employees’ right to privacy as guaranteed under Article 31 of the Constitution.

She ruled that KBC’s actions failed the legal tests of necessity, proportionality and legality required where sensitive biometric surveillance is involved.

The court directed KBC to permanently destroy all facial recognition and biometric data collected through the impugned system.

“I do order KBC to develop and implement a comprehensive data privacy policy within 60 days to guide any future adoption of technology involving personal information,” the judged directed.

In addition, the court instructed that the judgment be served upon the Office of the Data Protection Commissioner to facilitate regulatory oversight.

KBC was further ordered to file a formal compliance report with the Data Protection Commissioner within 30 days confirming that all the biometric data has been fully and irreversibly deleted.

The matter is scheduled for a status review on January 21, 2026, when the court will assess whether the broadcaster has fully complied with its directives.

The post Court Declares KBC Workers’ Biometric Clock-In Illegal, Orders Data deletion appeared first on Insider Bits News.