The High Court has barred the Kenya Broadcasting Corporation from using its newly introduced facial recognition attendance system, and ordered the broadcaster to delete all the biometric data it had already collected from employees.
The ruling follows a petition filed by the Kenya Union of Journalists, accusing KBC of sneaking in the system without talking to staff or carrying out the risk assessment required under the Data Protection Act.
According to KUJ, the workers were never informed about what the system would capture, for how long their data would be stored, or who exactly would handle it. The union said this amounts to an outright violation of employees’ right to privacy under Article 31 of the Constitution.
The union also informed the court that KBC disregarded numerous demands for consultations letters were dispatched in July and again in October 2025 calling on management to suspend the deployment of the system until such time as the staff’s grievances were addressed.
KUJ further warned that the system exposed sensitive personal information, including details of staff with medical conditions, while the identity of the third-party provider managing the technology remained unclear.
KBC did not contest the case. The court heard that only now was the broadcaster embarking on the belated process of complying with the Data Protection Act, including carrying out the assessment, which should have been made at the outset.
Justice Roselyne Aburili ruled the introduction of a facial recognition system without consent, consultation, or accompanying safeguards violated both the Constitution and the Data Protection Act.
She declared the rollout unlawful and barred KBC from implementing the system unless it fully complies with the law. She further castigated the corporation for ignoring staff concerns, noting that public participation and openness are not optional.
KBC is to expunge and destroy all biometric data it has already collected, and should file an affidavit within 30 days confirming that it has done so. The deletion of such data is to be supervised by the Data Protection Commissioner with representatives of KUJ present, who will report back to the court.
