This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The Kenya High Court ruled that the state-owned Kenya Broadcasting Corporation (KBC) unlawfully implemented a facial recognition attendance system for its employees. The court found that KBC failed to obtain informed consent, conduct a mandatory Data Protection Impact Assessment, or provide transparency regarding data processing and the third-party service provider. Consequently, the court ordered the immediate cessation of the system's use and the supervised destruction of all collected biometric data.
Kenya's High Court found that the state-owned Kenya Broadcasting Corporation unlawfully collected employees' facial biometrics for mandatory attendance without informed consent or a prior data protection impact assessment. The broadcaster conceded the union's case. The court quashed the rollout and ordered deletion of collected data under regulatory supervision, including measures to ensure third parties retained no copies.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
KBC, a public state corporation, failed to comply with mandatory regulatory frameworks, including the Data Protection Act and constitutional requirements.
The facial recognition system obtained and processed sensitive biometric data from KBC employees without their consent or proper legal safeguards.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by KBC management's intentional decision to deploy and enforce the facial recognition system without legal compliance.
The Kenya High Court ruled that the state-owned KBC unlawfully implemented a facial recognition attendance system, violating employee privacy rights. The court ordered the immediate destruction of collected biometric data, resolving the domestic administrative issue with minor national security implications.
The biometric attendance system acts as a tool to record time and attendance using facial recognition. It operates on direct input to perform a specific, deterministic function without exhibiting independent goal-directed behavior or planning.
High Risk: The system is used for employment and worker management, specifically utilizing facial recognition for biometric identification, which is classified as high risk under the EU AI Act.
The system was deployed specifically to use facial recognition to monitor employee attendance and record work hours.
The court judgment and news report provide clear, consistent, and legally verified details about the unlawful deployment of the biometric system, the parties involved, and the specific legal violations.
None, as the facts of the case and the legal violations were conceded by the respondent and confirmed by the High Court.
Technology
Intrusive Facial Recognition
Use of facial recognition to capture sensitive biometric data without consent.
Unknown Third-Party System
Procurement of system from an undisclosed and unverified supplier.
Data Inputs
Unlawful Biometric Harvesting
Collecting sensitive biometric data without obtaining prior employee consent.
Lack of Data Security Verification
No verification of how the third-party system processes and stores data.
Human Factors
Ignoring Employee Concerns
Management ignored concerns raised by employees, including cancer patients.
Process and Methods
No Data Protection Impact Assessment
Failure to conduct a mandatory DPIA before deploying the biometric system.
Lack of Stakeholder Consultation
Unilateral rollout without public participation or union consultation.
Opaque Procurement Process
No disclosure of system supplier identity, licensing, or security.
Management
Unilateral Mandatory Directive
Enforcing system usage via mandatory memo without prior consultation.
Lack of Transparency
Refusing to provide information on data processing to employees.
Failure of Governance
Disregarding constitutional principles of integrity and accountability.
Regulatory Environment
Non-compliance with Data Act
System deployed in direct violation of the Data Protection Act 2019.
Disregard of Legal Precedents
Ignoring previous court rulings like the Worldcoin case on data privacy.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
