Kenya's Public Broadcaster Violated Employees' Privacy with Mandatory Facial Recognition Attendance, Court Found

Kenya's High Court found that the state-owned Kenya Broadcasting Corporation unlawfully collected employees' facial biometrics for mandatory attendance without informed consent or a prior data protection impact assessment. The broadcaster conceded the union's case. The court quashed the rollout and ordered deletion of collected data under regulatory supervision, including measures to ensure third parties retained no copies.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The facial recognition system obtained and processed sensitive biometric data from KBC employees without their consent or proper legal safeguards.

Additional risk subdomains

• 6.5 Governance failure: KBC, a public state corporation, failed to comply with mandatory regulatory frameworks, including the Data Protection Act and constitutional requirements.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by KBC management's intentional decision to deploy and enforce the facial recognition system without legal compliance.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is used for employment and worker management, specifically utilizing facial recognition for biometric identification, which is classified as high risk under the EU AI Act.

AI system and alleged parties

• AI system: facial biometric attendance system
• AI purpose: Face Recognition; Workforce Monitoring and Evaluation
• Behaviour type: Tool
• Alleged developer: Facial recognition system developers
• Alleged deployer: Kenya Broadcasting Corporation, Facial recognition system deployers, Employers
• Alleged harmed parties: Privacy, Kenya Broadcasting Corporation employees, Journalists, Biometric data subjects

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Minor
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes violations of constitutional rights caused directly and indirectly by the incident.

Directly caused: The mandatory rollout of the facial recognition system directly violated the employees' constitutional right to privacy and data protection by harvesting their sensitive biometric data without consent.

Indirectly caused: The refusal to consult employees violated their right to public participation in crucial decision-making under Article 10(2)(a).

Privacy

Reported: The report explicitly describes privacy violations caused directly and indirectly by the incident.

Directly caused: KBC collected and processed the sensitive facial biometric data of its employees without their consent, violating Article 31 of the Constitution and the Data Protection Act.

Indirectly caused: The collected sensitive biometric data was transferred to an unknown third-party service provider, exposing the employees to further privacy risks.

People affected

• Occurrences reported: 1
• People reportedly harmed: 500
• People reportedly exposed: 500

Potential causes

Management

• Unilateral Mandatory Directive: Enforcing system usage via mandatory memo without prior consultation.
• Lack of Transparency: Refusing to provide information on data processing to employees.
• Failure of Governance: Disregarding constitutional principles of integrity and accountability.

Technology

• Intrusive Facial Recognition: Use of facial recognition to capture sensitive biometric data without consent.
• Unknown Third-Party System: Procurement of system from an undisclosed and unverified supplier.

Data Inputs

• Unlawful Biometric Harvesting: Collecting sensitive biometric data without obtaining prior employee consent.
• Lack of Data Security Verification: No verification of how the third-party system processes and stores data.

Human Factors

• Ignoring Employee Concerns: Management ignored concerns raised by employees, including cancer patients.

Process and Methods

• No Data Protection Impact Assessment: Failure to conduct a mandatory DPIA before deploying the biometric system.
• Lack of Stakeholder Consultation: Unilateral rollout without public participation or union consultation.
• Opaque Procurement Process: No disclosure of system supplier identity, licensing, or security.

Regulatory Environment

• Non-compliance with Data Act: System deployed in direct violation of the Data Protection Act 2019.
• Disregard of Legal Precedents: Ignoring previous court rulings like the Worldcoin case on data privacy.

Information quality

• Classification confidence: High
• Reason for confidence: The court judgment and news report provide clear, consistent, and legally verified details about the unlawful deployment of the biometric system, the parties involved, and the specific legal violations.
• Ambiguities identified: The exact number of KBC employees affected is not explicitly stated in the reports.
• Alternative interpretations: None, as the facts of the case and the legal violations were conceded by the respondent and confirmed by the High Court.

The Kenya High Court ruled that the state-owned KBC unlawfully implemented a facial recognition attendance system, violating employee privacy rights. The court ordered the immediate destruction of collected biometric data, resolving the domestic administrative issue with minor national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Kenya
• Alleged perpetrator: Kenya Broadcasting Corporation

Threat characteristics

• Imminence: Long-term. The court has already ordered the cessation and destruction of the system, meaning there is no immediate or near-term active threat.
• Autonomy: Human-controlled. The facial recognition tool was fully controlled and deployed by KBC management as an administrative mechanism without independent decision-making capabilities.
• Novelty: Established threat. Unlawful biometric data collection and employee privacy disputes are well-established legal and regulatory issues globally.

Impact by dimension

• Physical security: Negligible. The incident involved an employee attendance tracking system and posed no threats to physical systems, critical infrastructure, or human safety.
• Information security: Negligible. There is no evidence of intelligence compromise, espionage, or systematic information manipulation targeting national security capabilities.
• Sovereignty: Minor. While a state-owned corporation unlawfully deployed the system, the issue was successfully resolved through domestic constitutional processes and judicial oversight.
• Economic security: Negligible. The incident has negligible impact on Kenya's economic stability, strategic industries, or technological competitive advantage.
• Societal stability: Minor. The deployment violated employees' constitutional right to privacy, but the impact was localized to a single state corporation and corrected by judicial intervention.