{"id":1072,"date":"2026-09-30T12:52:31","date_gmt":"2026-09-30T12:52:31","guid":{"rendered":"https:\/\/baadvocates.com\/?p=1072"},"modified":"2026-10-19T08:20:48","modified_gmt":"2026-10-19T08:20:48","slug":"employee-exits-social-media-and-the-law","status":"publish","type":"post","link":"https:\/\/baadvocates.com\/index.php\/2026\/09\/30\/employee-exits-social-media-and-the-law\/","title":{"rendered":"Employee Exits, Social Media and The Law"},"content":{"rendered":"\n

Employee Exits, social media and the Law: What Kenyan Employers Need to Know<\/u><\/strong><\/p>\n\n\n\n

A staff member resigns. Sometimes quietly. Sometimes abruptly. Sometimes under a cloud of suspicion, disagreement or frustration. In many organisations, the instinctive reaction is not just to process the exit internally, but to \u201cwarn\u201d others. A notice is circulated on WhatsApp groups. A social media post appears with the former employee\u2019s photograph. Clients are informed not to transact with them. In some sectors, even paid advertisements on national newspapers are considered.<\/p>\n\n\n\n

To many employers, this feels reasonable. Protective, even. After all, businesses want to safeguard customers, prevent fraud and distance themselves from individuals who no longer represent them.<\/p>\n\n\n\n

But a recent landmark decision by the Office of the Data Protection Commissioner serves as a powerful reminder that frustration, suspicion or internal concern is not the same thing as lawful authority under the law.<\/p>\n\n\n\n

The Catalyst: Peter Macharia Waithira v LOLC Kenya Microfinance Bank Limited<\/u><\/strong><\/p>\n\n\n\n

The ODPC\u2019s determination in Peter Macharia Waithira v LOLC Kenya Microfinance Bank Limited (Complaint No. 0213 of 2026<\/strong>) has drawn a very clear line in the sand: an employer cannot publish a former employee\u2019s image or personal data as a public warning without a clear, demonstrable lawful basis under Kenya\u2019s Data Protection Act, 2019 (DPA).<\/p>\n\n\n\n

The facts of the matter are surprisingly relatable to many workplaces. The complainant had been engaged on contractual basis and formally resigned through email. After his resignation, the employer published notices on its social media platforms stating that he was no longer associated with the organisation and warning members of the public against transacting with him. The notices included his image and personal details.<\/p>\n\n\n\n

For many reading the facts, the immediate reaction might be: \u201cBut organisations do this all the time.\u201d<\/em><\/p>\n\n\n\n

And that is precisely why this ruling matters.<\/p>\n\n\n\n

The problem was not merely that the employee\u2019s exit was announced, it was the manner in which it was done and the complete absence of a legal foundation behind it. By posting his photograph and identity publicly alongside cautionary language, the employer effectively turned a former employee into a public warning notice without any judicial finding of wrongdoing and without demonstrating any lawful basis for processing his personal data.<\/p>\n\n\n\n

Weaponizing Data vs. Lawful Processing<\/u><\/strong><\/p>\n\n\n\n

Under Section 25 of the Data Protection Act<\/strong>, personal data must be processed lawfully, fairly and transparently and in a manner that respects the right to privacy of the data subject. A photograph is personal data. A name is personal data. Publishing either on social media amounts to processing personal data.<\/p>\n\n\n\n

The Data Commissioner noted that the complainant had not consented to the publication of his image and details. Equally important, the employer failed to demonstrate any alternative lawful basis for the processing under Section 30 of the Act<\/strong>, such as compliance with a statutory obligation or a legitimate interest that overrode the individual’s fundamental right to privacy.<\/p>\n\n\n\n

What significantly escalated this case was the employer\u2019s failure to respond to the complaint before the ODPC. Under Section 61(b) of the Act,<\/strong> failing to provide information or assistance requested by the Data Commissioner constitutes the criminal offence of obstruction. Consequently, the Data Commissioner recommended the company’s directors for criminal prosecution an offence that carries a statutory penalty of a fine up to Kshs. 5 million, imprisonment for up to two years or both.<\/strong><\/p>\n\n\n\n

Ultimately, the bank was ordered to erase the complainant’s personal data from all online platforms within 14 days. While the ODPC did not award monetary damages in this specific determination, the precedent is clear: data protection disputes are no longer mere administrative inconveniences. They carry severe regulatory, financial and personal criminal exposure for corporate executives.<\/p>\n\n\n\n

The Illusion of the “Informal Space”<\/u><\/strong><\/p>\n\n\n\n

This ruling raises uncomfortable but necessary questions for HR professionals, legal counsel and business owners across Kenya:<\/p>\n\n\n\n