Did you know that you can sue your current or former employer for sharing your personal information, such as photos or phone call recordings, without your consent? Welcome to Money Box, where we explore all things money and finance.
Earlier this year, an employer was ordered to pay a former employee Ksh250,000 for unlawfully sharing their personal data with another employer. The Office of the Data Protection Commissioner (ODPC) ruled that this was a clear violation of Kenya’s Data Protection Act 2019.
The employee claimed that negative information about her had been disclosed to a potential employer without her consent while she was on probation and alleged that this unlawful disclosure had cost her a job opportunity.
According to ODPC proceedings, when the employee requested access to the information, her former employer refused, citing confidentiality as the reason.
The ODPC investigation found that the former employer had failed to provide the requested information and had not obtained consent to share the data. According to the law, the former employer violated Section 26(b) of the Data Protection Act by withholding this information.
Under Section 65 of the Act, anyone who suffers damage due to a breach of its provisions is entitled to compensation for both financial loss and non-financial harm, such as distress or reputational damage.
At the same time, Regulation 14(3)(e) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 empowers the ODPC to award compensation to affected data subjects.
Meanwhile, the ODPC ordered the employer to immediately provide the employee with the letters referencing her performance that had been shared, in a bid to ensure full transparency about the information that was initially circulated.
As such, the employer was also ordered to pay the Ksh250,000 as compensation for the distress and violation of rights suffered by the employee.
In essence, the ODPC clarified that if an employer talks about an employee, for instance, when responding to a referee, then that employee has a legal right to know all the information that was said or shared.
If you thought that was just a one-off, think again. The data commissioner also recently imposed a Ksh250,000 penalty on a financial institution over a data privacy breach involving the mishandling of a customer’s email address.
The fine came after a report revealed repeated disclosure of confidential business information to an unintended recipient. The case followed a complaint lodged on October 22, 2024, by a business owner whose requests to update his correct email address had been repeatedly ignored.
So, next time you land that dream job, get shortlisted, or face an interview only to be suddenly rejected, pause and think. Maybe it was a bad review or some personal information that got shared without your consent, something you could actually cash in on.
