Job Seeker Awarded Ksh262,000 After Recruitment Firm Forwarded Her CV to Employer

The Office of the Data Protection Commissioner has ordered a recruitment firm to pay a job seeker Ksh262,500 as compensation for sharing her CV with another company without her consent.

In a complaint filed in October 2025, Margaret Manyange noted that she had applied for a legal assistant job advertised by the recruitment firm in 2024.

Consequently, she was called for interviews on two separate occasions and was only able to attend one.

However, in 2025, she received a call from a law firm inviting her for a job interview for the position of legal assistant.

Manyange added that she inquired from the law firm about how it got her details, given that she had not applied for a job at the firm. In response, the law firm explained that her CV had been shared by Brites Management Services Limited.

Also Read: Man Ordered to Pay Neighbour Ksh200K Over Installed CCTV Camera 

Aggrieved by the actions of the recruitment firm, Manyange filed a complaint with the data commissioner, lamenting that the sharing of her CV without consent had caused her emotional distress.

In its response to the complaint, Brites Management Services Limited confirmed that it had shared the CV with the law firm.

The company noted that it operated as a recruitment firm and does recruitment on behalf of prospective employers in addition to matching job seekers with potential employers.

"The Respondent attached a snapshot of an automated email response that indicates that they do recruitment on behalf of prospective employers. They also attached a candidate agreement form executed by the complainant, whose contents were specific to money-sharing with a named employer," read the ruling in part.

Data Commissioner Immaculate Kassait ruled that a signed candidate agreement form covering money-sharing with a named employer did not justify the sharing of the job seeker's personal data with other third parties.

Also Read: Company Ordered to Pay Ex-Employee Ksh700k Over Recorded Zoom Call

"By the complainant's account, she asserted that she did not consent to having her personal data shared with other third parties, beyond what was mutually agreed," the commissioner highlighted.

"The Respondent did not establish any lawful basis for the sharing of the Complainant's personal data with other third parties, as required by Section 30 of the Act. The automated email response that indicates that they do recruitment on behalf of prospective employers does not demonstrate a lawful basis for processing."

In the end, the data commissioner ordered the recruitment firm to pay Ksh262,500 for causing distress to the jobseeker. The ruling has set yet another precedent in the area of data protection. 

The Office of the Data Commissioner has, in recent years, issued significant rulings on the processing of personal data wilth companies and individuals fined up to Ksh700,000.

For instance, in April 2025, Platinum Credit was ordered to pay a man Ksh400,000 for sending promotional messages about their loan products. The man had not shared his contact or other personal details.

Later on in November 2025, Liquid Telecommunications Kenya was ordered to pay a former employee Ksh700,000 for the unlawful recording of a Zoom meeting and sharing it with its subsidiary company in Mauritius.

Another significant ruling was made in November when a man was ordered to pay Ksh200,000 to his neighbour after installing CCTV cameras in his compound in a manner that intruded upon the neighbour’s private residence.