Kenya

The ODPC found that the bank published a complainant's images on its Facebook page without showing a lawful basis, and that it did not respond to the notification of complaint. It ordered the images erased within 14 days, warned of an enforcement notice if it failed to comply, and recommended prosecution of the directors for obstructing the Commissioner under s.61(b). No penalty or compensation was set.

The ODPC found that the company used the complainant's image for commercial purposes without valid express consent, making the processing unlawful. It ordered the company to pay the complainant KES 300,000 in compensation and imposed no fine or enforcement notice. The final order writes the sum in words as "Three Thousand" beside the figure KES 300,000, but paragraph 36 gives it as Three Hundred Thousand, so KES 300,000 is used.

The ODPC found that the hospital disclosed the complainant's health data to a third party without explicit consent after an administrative error with her test results, breached the transparency principle and did not secure the data adequately. It ordered the hospital to pay the complainant KES 525,000 in compensation and issued no fine or enforcement notice.

The ODPC found that the business ignored a customer's SMS opt-out requests and kept sending him marketing messages without shown consent, breaching his right to object. It found the business liable and directed that an enforcement notice be issued so that the measures the business had described (separate transactional and promotional messages and an opt-out mechanism) are put in place. No fine or compensation was ordered.

The ODPC found the respondent liable after it did not answer the complaint and did not show that its processing of the complainant's data was lawful, fair and transparent, and ordered that an enforcement notice be issued against it under s.58. No penalty amount or compensation is stated.

The Authority found that the bank made false or misleading representations about its banking services to a corporate customer and engaged in unconscionable conduct, including charging fees for unapproved facilities and applying default interest retroactively without notice. It ordered the bank to pay a penalty of KES 33,180,000, stated to be 2% of its 2023 gross annual turnover, to refund KES 13,211,285 to the complainant within 30 days and to train its staff on Part VI of the Act; 24 February 2026 is the release date on the decision, which gives no separate decision date.

The CMA fined the former general manager for corporate assets KES 2.5 million and disqualified him for 2 years from serving as a director or key personnel in the capital markets, with governance training required before reappointment. It found he facilitated false and misleading 2014 financial statements, including misclassified and undisclosed related-party loans, and the lump-sum bonus payment to the chairperson.

The CMA fined the former general manager for finance KES 3.5 million and disqualified him for 5 years from serving as a director or key personnel in the capital markets, with governance training as a precondition for reappointment. It found he facilitated preparation of the false and misleading 2014 financial statements published in the bond information memorandum and paid the chairperson's bonus as a lump sum contrary to a board resolution.

The CMA fined the former chairperson KES 5 million and disqualified him for 10 years from serving as a director or key personnel of any issuer, licensed person or approved person, with corporate governance training required before he can be appointed again. It found he failed to oversee management, which led to false and misleading financial statements in the 2015 bond information memorandum, and that he approved his own bonus without declaring a conflict.

The CMA fined EY KES 10 million over the 2014 Uchumi Supermarkets rights issue, where its inquiry found serious misrepresentations in the financial statements in the information memorandum. EY must put staff who audit issuers, NSE-listed companies and CMA licensees through three years of remedial training, failing which it could be barred; the CMA also recommended ICPAK disciplinary action against EY and two partners.

The CBK revoked PayU's authorisation as a payment service provider after PayU's board applied to cease operations in Kenya. The CBK said PayU had met the requirements for ceasing operations, including paying funds owed to customers; no penalty is mentioned.

The ODPC issued a KES 5 million penalty notice after an enforcement notice of 3 November 2022, which followed the use of a complainant's photo on the company's Instagram stories without consent. The ODPC said the company did not provide the data protection policy and complaints mechanism the notice required and had refused to cooperate.

The CBK found Ecobank's trading practices unsafe and in breach of foreign exchange exposure limits. It barred the bank from transacting as an authorised foreign exchange dealer from 29 March to 4 April 2022, and required a remedial plan by 31 March 2022 and reversal of the excess exposure. No fine was named.

After reviewing the banks' responses of 21 September 2018, the CBK said they did not alter the findings of its investigations and levied the monetary penalties it had assessed on the five banks, which handled the largest flows in the NYS transactions. The release gives no amounts. It welcomed their AML/CFT action plans and said it would monitor implementation. Older than the 2022-2026 window; kept as an AML-related CBK penalty.