Ferdinand Omanyala Among Those Awarded Millions Over Privacy Breaches

Kenya’s Data Commissioner ordered more than Sh30 million in compensation in 2025 for misuse of personal data, marking one of the strongest enforcement actions yet under the Data Protection Act.

The Office of the Data Protection Commissioner (ODPC) has reinforced its role as the country’s main regulator of digital rights by issuing a series of rulings against organisations found to have violated privacy laws. The decisions show a clear shift towards treating data breaches as serious legal violations with financial consequences.

Created in 2020, the ODPC has gradually expanded its oversight across multiple sectors. Recent cases involved banks, credit firms, hotels, schools, marketing agencies and telecommunications companies. Together, the rulings demonstrate the regulator’s willingness to act on complaints from individuals whose personal information was used without consent.

One of the most prominent cases involved Philip Bolo, who complained that Platinum Credit continued to send him calls and text messages despite repeated requests to stop. The company argued that fraudsters were impersonating its staff, but the Commissioner found sufficient evidence linking the communication to Platinum Credit. Mr Bolo was awarded Sh900,000.

In another case, Richard Wafula received Sh750,000 after Hotel Tobriana used photographs from his wedding for advertising without his permission. The ruling confirmed that personal images cannot be used for commercial purposes without clear consent.

The ODPC also ruled in favour of Benjamin Ouma, who challenged St Joseph International Science School for displaying a minor’s image on a billboard without parental approval. The Commissioner awarded Sh700,000, emphasising the higher level of protection required for children’s data.

Several cases involved public figures and employees. Olympic sprinter Ferdinand Omanyala sued Oxygene Marketing Communication for publishing his image online after failed contract talks. While he sought Sh10 million, the Commissioner awarded Sh500,000, noting that the company had apologised and removed the content.

Former employees also succeeded in claims against organisations that continued to use their data after their contracts ended. Lawrence Kirima was awarded Sh500,000 after Solar Panda used his photograph in marketing materials. Yasin Abkar received the same amount when Wananchi Group failed to delete his personal information following his exit from the company.

Other rulings addressed a wide range of violations. Vincent Muema was awarded Sh50,000 after Sinoma Roofing used his image on social media without consent. Marlene Ngina received Sh450,000 after Whitepath Ltd repeatedly contacted her over a colleague’s loan default, despite her having no contractual link to the debt.

In another case, Ayub Odanya, a university lecturer, was compensated Sh450,000 after his CV and academic documents were used without authorisation in a tender application submitted by Geosky Ltd. Platinum Credit faced further penalties in a separate complaint by Samuel Kamau, who said company agents accessed his personal details, including information about his vehicle, to market loans. The Commissioner awarded him Sh400,000.