The High Court has ordered the Kenya Broadcasting Corporation (KBC) to delete and destroy biometric data collected from its employees after ruling that its facial recognition attendance system was unlawfully implemented.
This was after the Kenya Union of Journalists (KUJ) moved to court, arguing that KBC introduced the system without obtaining consent from staff or carrying out a Data Protection Impact Assessment (DPIA).
KUJ further told the court that the corporation failed to consult employees or provide information about how the system would process and store personal data.
According to the union, the rollout was a violation of employees’ constitutional rights to privacy and protection of personal data under Article 31 of the Constitution.
The union also argued that KBC ignored repeated requests for engagement and transparency, including letters sent in July and October 2025 calling for a consultative meeting before the system was enforced.
According to KUJ, the rollout endangered sensitive employee information, including data about staff with medical conditions, and the identity of the third-party service provider handling the biometric system remained undisclosed.
The High Court noted that KBC did not oppose the application and confirmed that it was taking steps to comply with the Data Protection Act, including conducting a DPIA.
Justice Aburili Roselyne ruled that processing facial biometric data without consent or safeguards violates statutory and constitutional provisions, including the Data Protection Act 2019 and relevant regulations.
The court issued several orders, including a declaration that the rollout without consent, consultation, or a DPIA was unconstitutional and unlawful.
At the same time, KBC was also restrained from implementing the system without proper consent and full transparency and was directed to quash the decision to roll out facial recognition attendance.
''A declaration is hereby issued declaring that the refusal of the Respondent to engage the Data subjects in any consultation despite repeated requests for meaningful engagement before the rollout violates Article 10(2)(a) of the Constitution, which requires public participation,'' Justice Aburili ruled.
Additionally, the court directed the corporation to delete and destroy all biometric data already collected and to file an affidavit within 30 days confirming compliance.
The Data Protection Commissioner was instructed to supervise the deletion process in the presence of KUJ representatives and report back to the court.
The ruling will serve as a precedent for such matters going forward.
