High Court Stops KBC From Rolling Out Biometric Attendance System, Orders Deletion of Staff Data
The Kenya Broadcasting Corporation (KBC) has been dealt a major setback after the High Court halted its plan to introduce a biometric attendance system for employees, ruling that the national broadcaster unlawfully collected staff data without their consent.
Justice Roselyn Aburili stopped the rollout and ordered KBC to delete, erase and destroy all biometric data already collected, noting that the information was improperly obtained and was in the possession of an unknown third party.
The case was filed by the Kenya Union of Journalists (KUJ), which argued that KBC implemented the system without seeking employees’ consent or informing them about the safety of the technology, its providers, or potential violations of their privacy rights. The union also raised concerns about the impact of the system on cancer patients working in the institution.
In her ruling, Justice Aburili declared that KBC’s failure to disclose the identity and licensing status of the biometric system’s service provider — including whether the entity was registered as a Data Controller or Processor — violated constitutional values of transparency, accountability and good governance under Article 10(2)(c).
The court heard that despite KUJ’s formal objections and requests for consultation, KBC ignored the concerns and proceeded with installation. In memos dated July 3, 2025 and September 9, 2025, the employer notified its staff that the biometric facial-recognition system would be operational from September 15, 2025.
The union challenged the move on grounds that KBC introduced the system without:
-
Obtaining staff consent as required under the Data Protection Act, 2019
-
Providing full information on how employees’ data would be processed
-
Conducting a Data Protection Impact Assessment (DPIA)
-
Holding public participation or stakeholder consultations
-
Disclosing the identity or credentials of third-party data handlers
Justice Aburili held that KBC’s refusal to consult employees, despite repeated requests, violated Article 10(2)(a) of the Constitution, which obligates public institutions to facilitate public participation before implementing decisions affecting citizens.
The court further directed the Data Protection Commissioner to supervise the deletion and destruction of all biometric data collected from KBC employees to ensure compliance.
KBC conceded to the application and expressed readiness to comply with the law. The court ordered the broadcaster to file an affidavit confirming the steps taken to ensure that all collected data has been destroyed and that no copies remain with any third party.