Illegal Call Recording in Kenya: ODPC Awards KSh 700,000 for Privacy Breach
Recording a person’s voice without their consent is a criminal offence in Kenya, yet many citizens continue to treat call recording as normal practice. With smartphones now equipped with automatic recording features, individuals and even organisations have adopted the habit without considering the legal consequences.
What many Kenyans do not realise is that recording without consent in Kenya amounts to an invasion of privacy and unlawful processing of personal data. Offenders can face heavy penalties, including compensation running into hundreds of thousands of shillings and enforcement action by regulators.
Landmark ODPC Decision
The seriousness of the offence was highlighted in a recent ruling by the Office of the Data Protection Commissioner (ODPC). In the case, a complainant whose voice had been recorded without his permission was awarded KSh 700,000 in damages.
The ODPC ruled that voice and call recordings are not simple business records but qualify as personal data under the Data Protection Act, 2019. Employers, companies, and individuals who record conversations without following strict legal procedures are therefore engaging in unlawful processing.
This decision has become a wake-up call to many Kenyans who routinely record phone calls, meetings, or private conversations without informing the other party.
How the Dispute Arose
The case stemmed from a complaint by a former employee who objected to a phone call being recorded during discussions about his exit from employment. The conversation involved company human resource representatives and was meant to be a routine consultation.
According to the ODPC findings, the employee expressly declined consent to the recording and asked that it be deleted. His objection was acknowledged during the call, creating a clear expectation that no recording would be kept.
However, the organisation retained the file and later used it in separate legal proceedings long after the discussion had ended. This, the regulator ruled, was a blatant violation of data protection principles.
Voice Is Personal Data
A key finding in the ruling was that a person’s voice is a biometric and physiological identifier. Under Section 2 of the Data Protection Act, such identifiers fall within the definition of personal data.
This means that any call or voice recording captures sensitive information belonging to an individual. Processing that information—whether by storing, sharing, or using it as evidence—requires a lawful basis and the clear consent of the data subject.
The ODPC stated that organisations must treat voice recordings with the same level of protection as identity numbers, medical records, or financial details.
Failure to Inform the Data Subject
Another major issue was the company’s failure to meet its duty to inform. At the point of collecting personal data, the law requires the data controller to explain:
- Why the recording is being made
- The lawful basis for processing
- Who will have access to it
- How long it will be kept
- The safeguards in place to protect it
In this case, there was no evidence that the employee received any of this information. The recording was made despite his objection, and no privacy notice was issued.
Breach of Purpose Limitation
The principle of purpose limitation also played a central role. The call was recorded in the context of an employment consultation, yet it was later used as evidence in legal proceedings—an entirely different purpose.
The ODPC ruled that personal data collected for one reason cannot be reused for another without fresh consent and notification. Using the recording in court without informing the employee was therefore unlawful.
Right to Erasure Ignored
The complainant had also invoked his right to erasure, requesting that the company delete the file. Although the law allows limited retention of data for evidentiary reasons, this is not automatic.
The regulator emphasised that a data subject must be informed within a reasonable time if their data will be retained and the reasons must be clearly explained. In this matter, more than a year passed after the deletion request, yet the recording continued to be used without notice.
The ODPC concluded that such delay was unreasonable and violated the individual’s rights.
Penalties and Orders
After reviewing all the violations, the ODPC found the organisation guilty of:
- Failing to establish a lawful basis for processing
- Breaching the right to be informed
- Ignoring the right to erasure
- Violating the purpose limitation principle
The regulator ordered the company to compensate the complainant KSh 700,000 and issued an enforcement notice to prevent future misconduct.
What This Means for Kenyans
The ruling makes it clear that recording without consent in Kenya is not a harmless act. Whether done by employers, banks, landlords, friends, or family members, capturing someone’s voice without permission can lead to serious legal consequences.
Individuals now have stronger grounds to sue offenders and seek compensation where their privacy has been violated. Personal data belongs to the individual, and no one has the right to record or retain it without a lawful reason.
Practical Lessons
- Always seek consent before recording any call or conversation.
- Explain the purpose and how the recording will be used.
- Respect objections and delete files when requested.
- Organisations must develop clear data protection policies.
- Automatic call-recording apps should be used with extreme caution.
Growing Awareness
As Kenya’s digital space expands, more disputes over privacy are expected. The ODPC has warned companies to train staff, update privacy notices, and ensure compliance with the Data Protection Act.
This decision sets an important precedent: convenience can never override constitutional rights to privacy.