The High Court in Nairobi has ordered Safaricom to pay Sh900,000 to each of 11 subscribers, a total of Sh9.9 million, after their personal and financial data was taken from the company's internal systems and passed to outside parties, according to Techweez.
In Constitutional Petition E095 of 2026, Justice Bahati Mwamuye heard that the data included betting histories and transaction records. Safaricom argued that a rogue employee was responsible and that, because the employee acted outside their authority, the company should not bear constitutional responsibility.
The court rejected that argument, Techweez reports. It found that the breach resulted from systemic failures, including poor data governance, weak internal oversight and inadequate security controls. The ruling relies mainly on Article 31 of the Constitution, the right to privacy, and holds that data controllers have a "positive and non-delegable duty". It also found violations of Article 28 (dignity) and Article 46 (consumer protection).
Under Article 28, the report says, a claimant does not need to show financial loss, because reputational and psychological harm from the exposure of sensitive data can be enough. Failing to build adequate safeguards for sensitive consumer data was treated as a deficient service, not only a breach of contract.
Techweez describes the decision as the first major test of this principle at this level in Kenya, and notes that organisations holding personal data, such as banks, telcos, insurers, health providers and government bodies, should be able to show who had access to what and how unusual activity would be detected.
This report is based on Techweez's account; Kijiji News has not reviewed the judgment itself.
Source: Techweez