Safaricom Wins Court Battle Over Former Executive’s Dismissal for Data Breach The Employment and Labour Relations Court has upheld Safaricom’s decision to dismiss Brian Njoroge Wamatu, its former Head of Regional Expansion, following allegations of unauthorized access and sharing of confidential company and customer data. The court ruled that Safaricom had valid grounds and followed fair disciplinary procedures before terminating Wamatu’s employment in June 2019. The dispute stemmed from a 2019 investigation into claims that Safaricom employees had illegally accessed, compiled, and sold subscriber data. Wamatu was arrested on June 7, 2019, after being forcibly taken from a Nairobi restaurant by unidentified men and held for interrogation before facing charges of computer fraud and conspiracy to commit a felony. He alleged his arrest was orchestrated by Safaricom to scapegoat him for data losses, a claim the company denied, stating it had merely reported suspected criminal conduct to authorities. Safaricom’s internal investigation linked Wamatu to the unauthorized acquisition and proposed sale of confidential subscriber and corporate data, including internal security details and senior managers’ remuneration. The court accepted Safaricom’s position, ruling that the company had sufficient evidence to justify disciplinary action for breaching confidentiality obligations. Wamatu’s claims of unfair termination, defamation, and loss of employee share benefits were dismissed. The court found that Safaricom had complied with disciplinary procedures, including issuing a show-cause letter, reviewing Wamatu’s responses, and allowing an appeal. It also rejected his argument that he was denied a fair hearing, noting he failed to attend a scheduled disciplinary session despite having time to do so after a DCI meeting. The ruling emphasized that employment law does not require proof of misconduct beyond reasonable doubt for dismissal, provided the decision is based on a genuine belief supported by evidence. Wamatu’s defamation claim was also dismissed due to a missed filing deadline and lack of evidence proving reputational harm. The case highlights Safaricom’s efforts to address internal data breaches and enforce confidentiality policies.

Kenyan High Court Orders Safaricom to Pay KES 9.9 Million for Data Breach Violations The Kenyan High Court has ruled that Safaricom, the country’s largest telecommunications provider, must compensate 11 subscribers a total of KES 9.9 million (KES 900,000 each) for violating their constitutional rights to privacy, dignity, and consumer protection. The case, filed by Austin Taabu and 10 other complainants, stemmed from a 2018-19 data breach in which Safaricom’s internal systems were compromised, leading to unauthorized access to customer data. The court determined that Safaricom failed to adequately safeguard personal information, exposing subscribers to potential misuse. The ruling underscores growing legal accountability for data protection failures in Kenya, particularly under constitutional and consumer rights frameworks. The case highlights the financial and reputational risks companies face when mishandling sensitive customer data.