NAIROBI, Kenya, Feb 4 — A call recording containing an individual’s voice constitutes personal data whose processing without consent or legal justification amounts to unlawful processing under the Data Protection Act, 2019.
The Office of the Data Protection Commissioner (ODPC) made the determination on Tuesday in a suit against a teleco.
In the landmark case of Andrew Alston v Liquid Telecommunications Kenya Ltd (ODPC Complaint No. 1125 of 2025), the Commissioner found that the respondent recorded the complainant’s personal data during an exit consultation call without his consent and subsequently processed it in violation of multiple provisions of the Act.
The complainant testified that he explicitly refused consent for the call to be recorded and requested that the recording be deleted—a request acknowledged by Liquid Telecom’s HR representative.
Despite this, the recording was retained and later processed by Liquid Mauritius, a sister company, for use as evidence in arbitration proceedings.
The ODPC determined that the recording inherently contained the complainant’s voice—a biometric and physiological identifier—and therefore qualifies as personal data under Section 2 of the Data Protection Act.
Duty to inform
The respondent was found to have failed in its duty to notify the complainant about the purpose of data collection, the legal basis for processing, and any third parties to whom the data would be transferred, in violation of Section 29 of the Act.
Further, the respondent ignored the complainant’s request for erasure under Section 40(1)(b), which requires deletion of personal data that is unlawfully obtained, irrelevant, or excessive.
“Whereas the respondent had a duty to inform the data subject of the continued processing and that the request for erasure had been declined, they proceeded to process the complainant’s personal data one year later,” Data Commissioner Immaculate Kassait ruled declining a claim of ‘reasonable time’.
“The Office finds the respondent violated the complainant’s right to be informed under Section 26(a) and his right to erasure under Section 40(1)(b) of the Act.”
As a result, the Commissioner ordered Liquid Telecommunications Kenya Ltd to compensate the complainant Sh700,000.
ODPC also ordeed an Enforcement Notice against the respondent with a right of appeal to the High Court of Kenya within 30 days.
“This Office takes into account the nature of the personal data in question, the scope and duration of the unlawful processing, and the conduct of the respondent in failing to adhere to the principles of data protection,” Kassait said.
