In Kenya, the Office of the Data Protection Commissioner determined that a call recording containing a personโs voice constitutes personal data, and that processing such data without fulfilling the duty to notify, without a lawful basis, in violation of the principle of purpose limitation, and in disregard of the right to erasure amounts to unlawful processing under the Data Protection Act, 2019.
In Andrew Alston v Liquid Telecommunications Kenya Ltd, ODPC Complaint No. 1125 of 2025, the Office of the Data Protection Commissioner considered a complaint that the Respondent recorded the Complainantโs personal data in the form of a call recording and processed it further in violation of the Data Protection Act, 2019. The Complainant stated that, during a consultation call with the Respondentโs HR representatives concerning his exit, he explicitly did not consent to the recording and asked for a commitment that the call would be deleted, which was not disputed. The recording was not deleted and was later processed further and used as evidence in arbitration proceedings by Liquid Mauritius, a sister company of the Respondent.
The ODPC found that a call recording inherently contains the voice of the person speaking, which is a biometric and physiological identifier, and is therefore personal data within the meaning of Section 2 of the Act. It determined that the Respondent failed to fulfil the duty to notify the Complainant under Section 29 of the Act, as there was no evidence that the Complainant was informed of the purpose for which his personal data was being collected, the legal basis for processing, the third parties to whom his personal data had been or would be transferred, or the safeguards adopted.
The ODPC further found that the Respondent did not inform the Complainant of the explicit or specified purposes for collecting and processing his personal data before or during the processing, that is, for purposes of evidence for future litigation. This is compounded by the fact that the call was recorded in the context of a conversation between the Complainant and the Respondentโs HR representatives regarding a consultation on his exit details. It was later further processed by a โsister companyโ, Liquid Mauritius, which was not part of the initial data collection, to be used as evidence in an arbitration proceeding.
The ODPC found that the Complainant explicitly asked for deletion of the recording, and although the HR representative acknowledged that request, the recording was retained and further processed by the Respondentโs โsister companyโ, Liquid Mauritius, with the Respondent stating it was required for evidentiary purposes. Meanwhile, the Complainant had exercised his right to erasure under Section 40(1)(b) of the Data Protection Act, which requires deletion of personal data that is no longer authorised, irrelevant, excessive, or unlawfully obtained. Although Section 40(3) permits restriction of processing where data is needed for evidence, provided the data subject is informed within a reasonable time, no evidence of such compliance was adduced, and processing continued one year later without notice, which did not qualify as a reasonable time. This led the ODPC to find a violation of the Complainantโs right to be informed under Section 26(a) and his right to erasure under Section 40(1)(b).
Having found that the Respondent processed the Complainantโs personal data without a lawful basis, failed to fulfil the duty to notify, processed the data contrary to the principle of purpose limitation, and violated the Complainantโs rights to be informed and to erasure, the ODPC determined that the Respondent unlawfully processed the Complainantโs personal data. The Respondent was ordered to compensate the Complainant KES 700,000 (UGX 19,270,435), and an Enforcement Notice was directed to issue against the Respondent.
The full decision is available here:
drive.google.com/file/d/1axdโฆ