The Office of the Data Protection Commissioner (ODPC) has recommended the prosecution of directors of a micro-lender for failing to respond to a complaint filed by a former employee over the publication of his images on social media without consent.
Data Protection Commissioner Immaculate Kassait said LOLC Micro Finance Bank published the personal data of Peter Macharia Waithira in public notices and on its social media platforms without his consent.
Ms Kassait noted that despite being served with notification of the complaint, the micro-lender failed to respond.
She said the directors should be prosecuted for obstructing the Data Commissioner, contrary to Section 61(b) of the Act.
‘By failing to respond to the notification of complaint, the respondent obstructed the Data Commissioner in the exercise of her powers under Section 9,’ Ms Kassait said.
Evidence presented before the ODPC showed that Mr Macharia was previously employed by the lender on a contract basis.
On July 28, 2025, he formally tendered his resignation via email, which was received by the employer.
Despite his resignation, the micro-lender allegedly proceeded to publish highly sensitive public notices on its social media platforms, claiming he was no longer associated with the institution and warning the public against transacting with him.
The commissioner noted that the microfinance posted Mr Macharia’s images on its Facebook platform.
During the hearing, the complainant maintained that he did not consent to the processing of his personal data.
‘In light of the above, the office finds that the respondent unlawfully processed the complainant’s personal data,’ Ms Kassait said.
The commissioner added that the lender failed to demonstrate a lawful basis for processing the complainant’s personal data by not responding to the notification.
The lender was given 14 days from the date of the decision to erase the complainant’s images from its online platforms. Failure to comply will result in an enforcement notice being issued against the bank.