unauthorised image/photo use, lack of consent, unlawful data disclosure, failure to prevent data breach, failure to notify data breach, unlawful processing, failure to register with odpc
The complainant alleged the unauthorised disclosure of a copy of her national identity card by Becton Dickinson and Company, trading as BD East Africa, to Safaricom, and the respondents' handling of her personal data in an alleged unauthorised transfer of mobile number account ownership without her consent. The ODPC found both respondents liable for infringing her right to be informed and for unlawful processing of her personal data without consent. Her claim for KES 200,000 in specific damages for an advocate's invoice was declined for lack of proof of payment.
Orders and outcome
Each respondent was ordered to pay the complainant Kenya Shillings Two Hundred and Fifty Thousand (KES 250,000) as compensation, and the first respondent was ordered to register as a data controller in Kenya. Dated 2025, with the month OCR-garbled.
ODPC (Kenya), Catherine Kainyu Murithi v Becton Dickinson And Company Ta Bd East Africa Safaricom Plc, ODPC Complaint No. 1958 of 2024, determination of March 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2025/becton-dickinson-and-company-ta-bd-east-africa-safaricom-plc/ (accessed 30 August 2026).