An advocate complained after a customer care agent of Safaricom PLC made an unauthorised disclosure of personal information, including material touching on her practice, to a third party. The Office found the agent acted outside the confines established by her employer and assumed personal responsibility for the unlawful disclosure, so the respondent was not vicariously liable; Safaricom had itself reported the breach to the police.
Orders and outcome
The complaint was resolved against the respondent, and the Office recommended the prosecution of the customer care agent for unlawful disclosure of personal data. Dated 3 October 2023.
ODPC (Kenya), Pauline Muhanda t/a Mudeshi Muhanda and Co. Advocates v Safaricom Plc, determination of 3 October 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/safaricom-plc/ (accessed 30 August 2026).