Calls Mount For Class Action Suit Against Safaricom in Kenya and UK Amid Privacy Fears

Growing public outrage is mounting against East Africa’s largest telecommunications company, Safaricom, following explosive court testimony that revealed the telco has been sharing customer data with police without proper legal authorization.

The revelations have sparked calls for coordinated class action lawsuits spanning both Kenya and the United Kingdom.

The controversy erupted during a September court hearing in the case of David Ooga Mokaya, a Moi University student charged with publishing false information about President William Ruto.

Chief Inspector Bosco Kisau, who is attached to the Serious Crimes Unit at the DCI headquarters, told Milimani Senior Principal Magistrate Benmark Ekhubi that Safaricom had provided them with the details of David Ooga Mokaya.

During cross-examination by defence lawyers Danstan Omari and Ian Mutiso, the officer stated that he had not been served with a court order by the DCI authorising the investigation of the accused’s mobile phone and laptop.

Even more damaging was the admission by Safaricom employee Daniel Hamisi, who confirmed the company gave out Mokaya’s details without a court order.

The police officer’s lack of awareness about legal requirements was particularly striking.

“I am not aware of the High Court ruling requiring mobile service providers to obtain court orders before releasing subscriber details,” the witness replied when questioned about privacy protections.

Pattern of Legal Violations Emerges

This case represents just the tip of an iceberg of mounting legal troubles for Safaricom.

The documents reveal the company is currently battling multiple fronts of litigation, including a suspended class action suit over SIM card deactivation that saw unregistered subscribers’ lines deactivated in 2022.

The two senior counsels also accused Safaricom of forcing subscribers to sign a data privacy statement, which allows the company to collect bank account details.

The controversial clause states that Safaricom can “collect and store information including credit or debit card information, information on bank account numbers, Swift codes or other banking information”.

Additionally, Safaricom faces another class action suit from its own dealers, with Goodweek Inter-Services Ltd, a dealer that operated three Safaricom shops in Nairobi, Migori and Homa Bay counties, claiming the telco introduced unrealistic targets to block merchants from earning commissions from newly registered customers.

Public Outrage Fuels Call for Coordinated Legal Action

Social media has become a rallying point for angry customers demanding accountability.

One prominent Twitter user, Kabansora, directly called for legal action, stating: “Safaricom. I urge the parents & relatives of Denzel Omondi go to court and demand that DCI disclose how they were able to find location Data of Denzel from Safaricom without a court order. It is time for a class action suit against Safaricom & its CEO Peter Ndegwa.”

The reference to Denzel Omondi appears to stem from broader concerns about how authorities track activists and protesters, though the specific case involves David Mokaya.

The confusion highlights the widespread public concern about surveillance practices.

Lawyer James WaNjeri, described the court testimony as a “bombshell confession by a Safaricom employee testifying under oath that they divulged private data to DCI without a court order”.

He suggested the implications extend beyond Kenya, noting that “Someone should also sue in the UK where those who compromise judges locally cannot reach”.

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Growing Fines

Recent court decisions suggest Kenya’s judiciary is taking privacy violations seriously.

A landmark ruling has seen Safaricom and Becton Dickinson (BD) fined Sh.250,000 each for unlawfully using a customer ID in February 2025, demonstrating that companies can be held financially accountable for privacy breaches.

The Kenya Human Rights Commission has also raised concerns about Safaricom’s data practices, issuing an open letter to Safaricom PLC on alleged breaches of customers’ data privacy in November 2024.

International Implications

The suggestion of pursuing legal action in the UK reflects Safaricom’s complex corporate structure, with historical ties to Vodafone Group Plc, a British multinational telecommunications company.

The dealer filed the suit at the Constitutional and Human Rights division of the High Court.

It has sued Safaricom, Vodafone Group Plc, Vodafone Kenya Ltd and Mobitelea, indicating the interconnected nature of the company’s operations.

This international dimension could potentially expose Safaricom to litigation under UK data protection laws, particularly the Data Protection Act 2018 and retained EU GDPR provisions, which impose strict requirements on how personal data is processed and shared.

Safaricom has not issued a comprehensive public response to the court testimony about sharing customer data without court orders.

The company has historically maintained that it follows legal procedures, but the sworn testimony from its own employee directly contradicts this position.

The revelations raise serious questions about Kenya’s data protection regulatory framework and whether current penalties are sufficient to deter such violations.

With accusations from lobby groups regarding data breaches and invasive privacy violations in collaboration with security agencies, the pressure for stronger regulatory action continues to mount.

As multiple class action suits progress through Kenya’s courts and calls for international legal action gain momentum, Safaricom faces a potential reckoning over its data handling practices.

The company’s response to these mounting legal challenges may well determine not only its reputation but also set precedents for corporate accountability in Kenya’s evolving digital landscape.