An employer has been ordered to pay KSh700,000 after the Office of the Data Protection Commissioner (ODPC) found that it unlawfully recorded an employee’s phone conversation and later used the recording without proper consent.

According to the decision, the employee declined to consent to the recording and was assured that the conversation would be deleted. However, the employer retained the recording for nearly a year instead of deleting it as promised.

The ODPC further found that the recording was later shared with a sister company and used in an unrelated arbitration process, despite the employee never authorising such use.

The Commissioner ruled that the employer’s actions amounted to a clear violation of Kenya’s data protection laws, which require organisations to collect and process personal data lawfully, fairly and only for the specific purpose for which consent was obtained.

The decision emphasised that employers cannot rely on vague notices or retain recordings “just in case” without a lawful basis. It also noted that promises to delete personal data must be honoured, and information collected for one purpose cannot be repurposed for unrelated proceedings without proper legal justification or fresh consent.

The employer was ordered to compensate the employee KSh700,000, with the ruling serving as a reminder that recording employees’ phone calls without valid consent, retaining recordings beyond their stated purpose, or sharing them with third parties can expose organisations to significant legal and financial consequences under Kenya’s data protection framework.