Safaricom Faces Sh250 Million Privacy Suit as Second Victim Steps Forward

Safaricom is bracing for a fresh court battle after a Nairobi businessman accused the telecommunications giant of unlawfully tracking his location and sharing his private data with police, actions he says led directly to his arrest, detention and lasting physical and psychological harm.

In a formal demand letter, businessman Alex Mutuku Mbalezi accuses Safaricom of violating his constitutional right to privacy under Article 31 of the Constitution of Kenya, 2010, and is demanding Sh250 million in compensation. The claim lands hard on the heels of a Sh200 million suit filed by acquitted Moi University student David Ooga Mokaya, signalling what could become a cascading wave of litigation against Kenya’s dominant telecom operator over alleged data protection failures.

Through his lawyer Danstan Omari, who also represents Mokaya, Mbalezi contends that Safaricom owed him both a statutory and fiduciary duty to safeguard his personal data and to ensure that any disclosure strictly complied with constitutional and legal standards. The demand letter alleges that the company unlawfully tracked and shared his location data with third parties, leading to his arrest and detention. Mbalezi says he was manhandled in custody, sustained physical injuries and has since suffered continuing health complications, psychological distress and damage to his reputation and personal dignity.

“Your actions directly facilitated the violation of our client’s fundamental rights and freedoms and exposed him to unlawful arrest,” the demand letter states.

Mbalezi is demanding that Safaricom formally admit liability within seven days and settle the Sh250 million claim. The notice warns that failure to comply within the stipulated timeframe will trigger the filing of legal proceedings without further notice.

A DISTURBING PATTERN

The businessman’s claim follows the dramatic acquittal of Mokaya on February 19, 2026, in a cybercrime case that had drawn national attention. The 24-year-old finance student was charged with publishing false information over a post on X, formerly Twitter, in November 2024. The post allegedly depicted a funeral procession with a casket draped in the Kenyan flag and made reference to President William Ruto, which prosecutors argued was intended to mislead the public into believing the Head of State had died.

During the trial before Principal Magistrate Carolyne Nyaguthii Mugo at the Milimani Chief Magistrate’s Court, evidence emerged that investigators obtained Mokaya’s phone number and location data from Safaricom following a written request by a senior police officer on November 14, 2024. Daniel Hamisi, a Safaricom security department employee who testified as a prosecution witness, confirmed under cross-examination that the information was released without a court order being presented.

Mokaya was arrested the following day in Eldoret. His Samsung phone, laptop and identification card were seized before a search warrant was obtained. In acquitting him, the court ruled that the accused person’s gadgets were seized unlawfully and were subjected to forensic examination without any judicial authorisation. The magistrate found that the prosecution had failed to conclusively link Mokaya to the disputed post and that key digital evidence had been obtained in breach of the law.

“Your personal data, your messages, your contacts, and your location are part of your dignity and privacy. These rights were violated,” Omari said following the acquittal, announcing plans to file a constitutional petition at the High Court’s Constitutional and Human Rights Division.

SAFARICOM DIGS IN

In a letter dated February 24, 2026, Safaricom rejected Mokaya’s demand outright. Legal services head of department Wangechi Gichuki stated that having reviewed the February 19 judgment, “Safaricom does not admit, and expressly denies, any liability as alleged.” Gichuki added that the trial court made no binding determination of civil liability against Safaricom.

The company argued that observations in the judgment concerning investigative practices cannot be construed as imposing strict constitutional liability on a telecommunications provider acting in compliance with formal requests from law enforcement agencies, and warned that any litigation will be vigorously and robustly defended.

Safaricom has consistently maintained that it releases customer information only when required by law or pursuant to a court order. Its published privacy policy underscores compliance with legal requirements and international privacy management standards. Omari, however, insists that testimony from the company’s own employee amounts to damning evidence of systemic non-compliance.

A TROUBLED RECORD ON DATA PROTECTION

The twin claims thrust Safaricom, Kenya’s dominant telecom operator with more than 40 million subscribers, back into the spotlight over data protection. This is not the first time the company has faced such allegations.

In October 2025, the Business Daily reported that Safaricom had failed to settle a suit in which it sought to block the sale or transfer of stolen personal data belonging to 11.5 million subscribers. Court documents showed that two former senior managers at Safaricom allegedly accessed and shared data, including customer names, phone numbers, birth dates, location records, gambling histories, passport and identity card numbers, with a businessman for onward sale to a top sports betting firm.

That data leak triggered multiple legal actions, including a constitutional petition seeking Sh100 million for the alleged primary victim and Sh10 million for each of the 11.5 million subscribers who joined the data theft suit. The scheme allegedly began with the former managers creating an algorithm to collate and analyse subscriber betting patterns. They amassed personal data on 11.5 million subscribers, which was then transferred from Safaricom servers to password-protected Google drives that the company has been unable to access.

Safaricom warned the court that the data could be transferred to additional third parties. “The plaintiff has not been able to secure the personal laptops owned by the 2nd and 3rd defendants, which then allows them to disseminate the subscriber data,” the company told the court. “They will disclose the confidential information of millions of subscribers, thus exposing Safaricom to numerous lawsuits.”

THE REGULATORY LANDSCAPE

The Data Protection Act, 2019, was enacted to afford Kenyans broader rights over how their personal information is handled. Article 31 of the Constitution guarantees the right to privacy, including the right not to have information relating to family or private affairs unnecessarily required or revealed and the right not to have communications unlawfully intercepted.

In December 2023, the Office of the Data Protection Commissioner adopted a guidance note for the communications sector, assisting service providers in telecommunications, broadcasting and postal services to comply with the Data Protection Act. The guidance outlines principles for the lawful processing of personal data, including requirements for consent, contractual necessity or compliance with a legal obligation as the basis for any data sharing.

Data Protection Commissioner Immaculate Kassait has previously called on the sector to adhere strictly to data protection principles, raising particular concerns about data collection and tracking, the misuse of personal data and surveillance by telecommunications companies.

Legal analysts note that while the Data Protection Act permits limited disclosures to law enforcement for legitimate investigations, court precedents have increasingly demanded judicial oversight, particularly where real-time location data is at stake. In a landmark ruling in April 2024, the High Court declared the mandatory collection of International Mobile Equipment Identity numbers by mobile network operators unconstitutional, affirming the primacy of privacy, data protection and freedom from unreasonable surveillance in Kenya’s digital ecosystem.

A PRECEDENT-SETTING MOMENT

Omari has described the Mokaya case as a landmark moment for digital rights in Kenya. He has signalled the possibility of a sweeping class action that could run into trillions of shillings if the millions of subscribers potentially affected come forward.

“This is not just about David Mokaya. It is about restoring sanity to the telecommunications sector. Every Kenyan whose privacy has been violated in this manner now has a justiciable claim,” Omari said.

The case raises wider questions about the relationship between telecommunications companies and law enforcement agencies. During the Mokaya trial, the arresting officer admitted he had no court order to carry out the search or seize Mokaya’s phone and laptop. The court emphasised that cybercrime investigations must strictly comply with legal procedures, noting that digital evidence is highly sensitive and must be obtained through lawful means.

Mokaya himself has described months of gruelling travel between Eldoret and Nairobi to attend court appearances, funded by well-wishers and family members who also struggled to pay his tuition fees. “I used to travel all the way from Eldoret where I stay and study to come attend mentions and hearings and travel back to Eldoret on the same day due to financial difficulties,” he said in his supporting affidavit. Omari has alleged that Mokaya “can’t even talk due to mental trauma and shock that gripped him since he was charged.”

WHAT LIES AHEAD

The dispute is expected to raise far-reaching questions about data protection, privacy rights and the legal obligations of telecommunications companies handling subscriber information under Kenyan law. Mokaya’s lawyers are expected to seek conservatory orders to restrain any further release of subscriber data without a court sanction. The High Court’s determination could set a decisive precedent governing how telecom operators balance cooperation with security agencies against the constitutional right to privacy in Kenya’s fast-evolving digital landscape.

With Mbalezi’s claim adding fresh pressure, Safaricom now finds itself fighting on two fronts against allegations that strike at the heart of its relationship with millions of Kenyans who entrust the company with their most sensitive personal information. The company had not issued a public statement on the Mokaya matter by Tuesday afternoon, nor had it responded to Mbalezi’s demand letter.

As the seven-day ultimatum in Mbalezi’s notice ticks down, all eyes are on Safaricom’s next move and on the High Court, which may soon be called upon to define the boundaries of digital privacy in Kenya for generations to come.