A recent ruling by the Office of the Data Protection Commissioner (ODPC) has shown that even an internal human resource consultation call can spiral into legal liability if consent, transparency and clear purpose are ignored.

In the case of Andrew Alston against his employer Liquid Telecommunications Kenya Ltd, a single recorded call ultimately resulted in a KSh700,000 compensation order and an enforcement notice against the company.

The dispute arose from a virtual HR consultation call linked to an employee’s exit discussions.

According to the complainant, he expressly declined consent to the recording and was assured it would be deleted.

Instead, the audio was retained and later surfaced in separate arbitration proceedings involving a related company.

For regulators, that sequence of events triggered multiple red flags — not just about consent, but about how long data was kept, who accessed it, and why it was used beyond its original context.

One of the most striking findings from the ODPC was the classification of a voice recording as biometric personal data.

In simple terms, your voice is considered an identifying feature, just like a fingerprint or facial image.

That means recording a conversation is not a harmless administrative act; it is the collection of protected personal data.

The determination highlights three common pitfalls that can quickly turn an ordinary recording into a compliance nightmare:

1. Assuming a Beep Equals Consent
Automated “this call may be recorded” notices are not enough. The regulator found that organisations must clearly explain why data is being recorded, who might receive it, and how it will be protected.

2. Stretching the Purpose Later
Recording a meeting for “internal reference” and later using it for litigation or sharing it with affiliates breaches the principle of purpose limitation, a core rule that data should only be used for the reason it was first collected.

3. Ignoring Deletion Requests
When a person asks for their data to be erased, the law requires prompt action or formal notification if deletion is refused for legal reasons. Silence or delay can amount to a violation on its own.

The company argued that keeping the recording served a “legitimate interest” in case of future disputes.

The ODPC disagreed, finding that less intrusive alternatives, such as written minutes, could have achieved the same goal without retaining sensitive biometric data.

The lesson is stark: “just in case” is not a lawful basis on its own.
Without necessity and proportionality, that precaution can morph into unlawful processing.

Beyond the financial penalty, the enforcement notice signals that regulators are increasingly willing to scrutinize everyday corporate practices, especially in multinational structures where data may move across borders between affiliated companies.

For employers, HR teams, and managers, the message is clear: recording workplace conversations is no longer a casual administrative decision.

It is a regulated activity with legal consequences if mishandled.

In an era of virtual meetings and remote work, the record button can feel harmless.

But as this ruling demonstrates, a few seconds of audio can carry months of legal exposure.and a six-figure price tag.

The post How Recording a “Simple” HR Call Could Land You in KSh700,000 Trouble appeared first on Insider Bits News.

In a decision rendered by Data Commissioner Immaculate Kassait, the Office of the Data Protection Commissioner (ODPC) found that the company violated data protection principles of consent and purpose limitation after it secretly recorded the meeting and later used the recording as evidence in an arbitration case filed in South Africa without the employee’s consent.

The complaint was filed by the company’s former employee Andrew Alston on August 25,2025 who accused the company of breaching his right to privacy under the Data Protection Act, 2019.

Data Commissioner Kassait said the company failed to meet its legal obligations in the handling of personal data, stressing that the law requires organizations to obtain consent before collecting or processing any individual’s information.

“The Respondent did not fulfill its obligations provided for under the Data Protection Act,” Kassait stated in her determination.

“Considering the nature of the personal data, the extent of the unlawful processing, and the conduct of the Respondent, this Office orders that the Complainant be compensated Sh 700,000.”

She further noted that the ruling should serve as a reminder to organizations that personal data, including communications and recordings, must be processed lawfully, fairly, and transparently.

“Consent is a fundamental principle under the Data Protection Act. No entity should record, share, or use personal data without clear and informed consent from the data subject,” Kassait said.

In his case, Alston accused Liquid Telecom Kenya of secretly recording a consultation meeting he held with the company’s HR representatives and then sharing the recording for use in international arbitration proceedings which he had sued the firm’s Mauritius office following his retrenchment in 2024.

According to Alston, who had relocated to Kenya after securing full-time employment with the firm, he clearly refused to have the meeting recorded and was assured that the recording would be deleted.

“At minute nine I explicitly stated l did not consent to the recording of the call and I requested the recording to be deleted deleted immediately,” Alston told the Data Commissioner.

“ I was assured by the HR representative that it would be deleted, but it was later produced as evidence in arbitration proceedings without my permission.”

The Zoom meeting, which involved Liquid Kenya’s HR team and a London-based head of HR for the Liquid Group, was reportedly recorded despite Alston’s protest.

” We held a consultation call between myself and HR representatives of the company. I confirm that the call was heated and a lot of things were said,” he stated in his suit papers.

He later discovered that the same recording had been shared and used as part of evidence in an arbitration case against Liquid Telecommunications-Mauritius, a sister company of the Kenyan branch.

” I found out that in an arbitration in South Africa against Liquid Telecommunications-Mauritius over another matter, Liquid Kenya produced that recording as part of their evidence, misconstruing what was said on the recording,” the ex-employee stated.

Liquid Telecom Kenya, in its response, admitted to recording the meeting but argued that the recording was retained for evidentiary purposes in anticipation of arbitration proceedings.

“We confirm that indeed the virtual consultation call was recorded by the HR representative and Alston indicated that he had not consented to the recording,” the firm stated.

Subsequently, Alston requested for the recording to be deleted and the HR representative acknowledged the request and confirmed it will be deleted.

The company stated that the recording was securely stored and later withdrawn before the arbitration hearing began.

“The recording was restricted and securely retained to document certain proposals and threats made during the call,” the company said in its response to the Commissioner.

However, Data Commissioner Kassait ruled that the company’s actions were unlawful, emphasizing that consent is a central requirement under Kenya’s data protection framework.

She said the company had breached Alston’s rights under Article 31 of the Constitution of Kenya, which guarantees the right to privacy.

“The Respondent did not fulfill their obligations provided for under the Act,” Kassait stated.

The ODPC also issued an Enforcement Notice against Liquid Telecom Kenya, directing the company to comply with data protection requirements and implement stronger consent and privacy measures in future.

The ruling further reaffirmed that employees have the right to be informed about how their data is collected, used, or shared, and to request the deletion of their personal information when consent has been withheld.

The ODPC emphasized that both parties have the right to appeal the ruling to the High Court of Kenya within 30 days.

The post Firm ordered to pay ex-employee Sh700,000 over secretly recorded zoom call appeared first on Insider Bits News.