The complainant alleged that while investigating her, Samasource Kenya EPZ Ltd processed her personal data without consent, producing an adverse investigation report that led to her termination. The Office established there was a duly executed consent form, that the laptop was company property subject to the respondent's Corporate Information Security Policy under which information on company property is deemed the company's, and that the forensic audit firm acted on the respondent's instructions as data controller. It found the respondent had a lawful basis for the processing.
Orders and outcome
The complaint was found to lack merit and was dismissed. Dated April 2024 with the day illegible in the scan.
ODPC (Kenya), Rose Emma Muthoni v Samasource Kenya Epz Limited, ODPC Complaint No. 00187 of 2024, determination of 27 April 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2024/samasource-kenya-epz-limited/ (accessed 30 August 2026).