In January 2023, the Office of the Data Protection Commissioner
("DPC") delivered one of its first
rulings under the Data Protection Act, 2019 (the
"Act") since the commencement of its
operations. The complaint pitted the partners of a firm, Allen
Waiyaki Gichuhi and Charles Wamae (the
"claimants") against two of their former
employees, Ms Florence Mathenge and Mr Ambrose Waigwa (the
"respondents") for alleged breach of
clients' confidential information, including personal data.
The claimants alleged that for almost one year, while Ms
Mathenge was still working for the claimants, she leaked personal
and sensitive personal data without authorisation from her
employers to Mr Waigwa, who at the time was no longer an employee
at the firm.
