In 2025, the Office of the Data Protection Commissioner put real weight behind Kenyans’ digital rights, awarding over Sh30 million to individuals whose complaints over data protection violations were upheld.
The Office of the Data Protection Commissioner (ODPC) was established under the Data Protection Act 2019 and became operational in 2020 to safeguard and regulate the processing of personal data.
Since 2020, many Kenyans have received significant compensation amounts for breaches of their personal data.
Philip Bolo Vs Platinum Credit
Complaint: Promotional Calls and Text Messages
Mr Bolo wrote an email to Platinum Credit requesting that it stops sending him unsolicited texts and calling him to promote their loan products, but the creditor ignored the requests. Bolo then made a call asking the creditor to delete his personal data from its database, but to no avail. Bolo continued to receive calls from different sales agents of Platinum Credit.
In its response, Platinum denied that the phone numbers used to contact Bolo belonged to any of its sales agents or were associated with the company. Platinum claimed that people were masquerading as its employees, while some were its former employees who left with ill motives to damage the company’s reputation.
However, on one of the calls made by the sales representative, Platinum reached out to Bolo and apologised for the unsolicited call. Platinum maintained that at all times it sought express consent to use individuals' personal data for its promotional activities. However, it failed to prove that it had obtained consent from Bolo. Bolo had prayed for Sh1million as compensation for the disturbance caused.
Richard Wafula Vs Hotel Tobriana
Complaint: Wedding Image &Video Use
Wafula filed the complaint, accusing the hotel of using his wife’s and their guests' images and video taken during their wedding at the hotel for advertising. Wafula told the Data Commissioner that the hotel shared its wedding content in branded and personalised advertisements on its social media platforms, Facebook and Instagram, without seeking his wife’s consent. Wafula had sought Sh2.5 million in compensation, but the Data Commissioner awarded Sh750,000, faulting the hotel for not only failing to seek express consent, but also for refusing to delete the images and video from its social media accounts.
Benjamin Ouma Vs St Joseph International Science School
Complaint: Billboard Image Use of Minor
Mr Ouma filed the complaint on behalf of a minor (KDA) whose image was used on a billboard advert paid for by the school.
Mr Ouma claimed that the minor had gone for a fun day at school when the children were lured to put on uniforms and their photos taken. According to Mr Ouma, KDA was not a student of the school and accused the institution of infringing on the minor's privacy for financial gains without compensation. Awarding the compensation, the Data Commissioner faulted the school for failing to obtain consent for the image from the minor’s parents.
Ferdinand Omanyala Vs Oygene Marketing Communication
The fastest man in Africa filed the complaint in October 2024, accusing the PR and marketing firm of using his image to advertise its work on its website without having sought his approval.
The firm had initially approached Omanyala on behalf of its client Safaricom, seeking to on-board him for a project known as ‘Making of A Star.’
World Athletics Championships Tokyo 2025 - Men's 100m Round 1 - Japan National Stadium, Tokyo, Japan - September 13, 2025 Kenya's Ferdinand Omanyala reacts after the heats.
Photo credit: REUTERS/Eloisa Lopez
However Omanyala says along the way, due to irreconcilable differences, he declined to be part of the project and requested that Oxyene erase the personal data he had initially shared with them when they first reached out regarding the project to them. He would, however, later come across a poster with his image posted by Oxygene advertising the Safaricom project.
Omanyala also stated he hadn't given express consent for the usage of his image. Omanyala sought compensation of Sh10 million.
In defense, Oygene argued it had interviewed several athletes for the project, including Omanyala, who had willingly and voluntarily shared his data with the agency during the interview.
Oxygen further stated that the poster was a montage of all the athletes interviewed and that each athlete was paid a token. Oxygene stated that he directed his token to be paid to his relative. Oxygene further stated that it negotiated contracts with all the athletes, but failed to do so with Omanyala, as he kept changing his terms of engagement. With the negotiation falling through, Omanyala’s relative refunded the token. Subsequently Omanayala interview was never aired.
Oxygene admitted that its employee erroneously and accidentally uploaded the montage. Oxyene wrote an apology when Omanyala’s advocate wrote accusing it of breach of brand rights, copyright, trademark rights and invasion of privacy.
The Data Commissioner declined to award the sh10 million Omanyala had prayed for, noting that Oxyegene had issued an apology and pulled down the post. The Commissioner noted that Sh500,000 was fair compensation for the use of his personal data without having given his express approval.
Lawrence Kirima Vs Solar Panda Ltd
On October 15, 2024, Mr Kirima filed a complaint with the ODPC, accusing Solar Panda of using his images in sales and marketing flyers without his express consent.
In its defence, Solar Panda argued that Mr Kirima was its field agent, tasked with conducting sales on commission. The company further stated that the image in question was taken during Mr Kirima’s engagement as a field agent, stored in the company’s library, and later used in the marketing flyers to boost the company’s visibility.
However, finding Solar Panda liable, the ODPC noted that Solar Panda ought to have obtained an express consent from Kirima on the individual use of his image , regardless of whether he was its employee or contractor The Commissioner noted that Solar Panda stood to benefit financially, both directly and indirectly, from the use of Mr Kirima’s image and it was only fair if he was compensated.
Yasin Abkar Vs Wananchi Group (Zuku)
Complaint: Erasure of personal data
Mr Abkar had ceased being an employee of Zuku. However, Zuku continued sending him promotional messages, despite his verbal, phone, and even email requests to the company to delete his personal information from its systems and database.
In defence, Zuku argued that it had conducted a comprehensive review of its record and its system and found out that there was no formal data deletion request from Mr Abkar.
However, ODPC noted that Mr Abkar had presented an email he wrote to Zuku requesting that the company stop sending him unsolicited communication and delete his personal data from its system, as it was no longer necessary since he had left the company. Mr Abkar's email was undelivered, and ODPC faulted Zuku for providing an invalid and non-operational email address on its website.
Vincent Muema Vs Sinoma Roofing
Muema accused Sinoma Roofing of using his image to market its products on social media without his approval. Sinoma posted photos of Muema on its official Facebook and Instagram social media handles to advertise its upcoming workshop event. Muema told the Data Commissioner he was never informed that his image was to be used for the social advertisement. Sinoma didn’t file a response.
Marlene Ngina Vs Whitepath Ltd
Complaint: Calls and text over defaulted loan
Ms Ngina filed the complaint following several calls that had become a nuisance, she had received from Whitepah over a defaulted online loan taken by her colleague.
Marlemne said Whitepath repeatedly called her and sent her texts using different numbers over the loan, arguing that the act violated her privacy. The calls from Whitepath demanded that she reach out to her colleague and ask her to settle the loan. Whitepath maintained that if her colleague didn't settle the loan, Ms Ngina would be the one to pay it as she had been listed as a guarantor.
Ms Ngina stated she didn't have any prior knowledge of the loan and hadn't signed anywhere to be a guarantor of the same. She also stated that she hadn't shared her data with Whitepath. Whitepath chose not to file a defence.
Ayub Odanya Vs Geosky Ltd
Ayub, a lecturer at Nairobi University, filed the complaint after the directors of Geosky Ltd used his personal data, including his CV, professional certificates and other academic certificates, to submit a tender at the Central Bank of Kenya.
Ayub told the Data Commissioner that he had professional dealings and connections with one of the Geosky directors, which led to the obtaining of his documents that were fraudulently used to submit the tender in the pretence that they belonged to the director . Geosky didn't file a response. The lecturer had prayed for Sh5 million compensation.
Samuel Kamau Vs Platnum Credit
Complaint: Promotional Calls
Mr Kamau filed the complaint after receiving an unsolicited call promoting a loan product from a sales representative of Platinum Credit.
Kamau noted that while engaging with the sales representative he had never met before, on the call, he discovered that the representative had had access to his personal identifiable information, including specific details of his vehicle.
When he questioned the representative on the source of his personal data, the sales representative stated that the management routinely shared such information with the sales team for them to contact and promote the company’s product to potential clients.
In its defence, Platinum denied the phone number used to contact Mr Kamau belonged to any of its sales agents or was associated with the company.
When Mr Kamau complained, the sales representative was asked to start working from home to avoid being found on the Platinum Credit premises during investigations. The investigations subsequently found Platinum guilty of illegally processing Mr Kamau’s personal data for commercial interest.
