A landmark ruling by the Office of the Data Protection Commissioner (OCPC) has set new limits on workplace data privacy, barring employers from sharing employee information with third parties without consent or transparency.
The ruling establishes that former employers cannot provide negative background information about employees to prospective employers without granting them access to the same data.
The case arose after a woman was allegedly denied a job opportunity following a negative background check conducted by her former employer. She subsequently filed a complaint with the ODPC, arguing that undisclosed adverse information had been shared without her consent.
In its determination, the ODPC found that the employer had violated the complainant’s right to access personal data under the Data Protection Act, 2019.
The regulator ordered the employer to pay Ksh250,000 in compensation after unlawfully denying the complainant access to the information shared during the background check.
“The complainant’s rights under Section 26(b) was infringed upon when access to her personal data was denied,” the ODPC said in part of its ruling.
The employer had declined to release the information, citing confidentiality. However, the ODPC clarified that individuals have a legal right to access personal data held or shared about them, including employment references issued to third parties.
The regulator further directed the employer to release the requested reference letters within 14 days, warning that failure to comply would result in enforcement action.
Implications for Employers and Job Seekers
The ruling marks a significant shift in employment practices, reinforcing transparency and accountability in how employee data is handled.
The ODPC emphasized that denying individuals access to such information constitutes a breach of data subject rights and may attract penalties, including financial compensation.
It also clarified that “damage” under the law extends beyond financial loss to include emotional distress caused by misuse or concealment of personal data.
Relief for Job Seekers
The decision is expected to offer relief to many Kenyans who may have previously lost job opportunities due to undisclosed negative references from former employers.
At the same time, it serves as a warning to employers that any personal data shared about current or former employees- especially information that could impact employment prospects- must be transparent, lawful, and accessible to the individual concerned.
