Woman Wins Ksh250K After Ex-Boss Shares Data With New Employer

A former United Winners SACCO employee was awarded Ksh250,000 after the credit union shared her personal information with a prospective employer without her consent.

The case at the Office of the Data Protection Commissioner (ODPC) arose after Margaret Nzula, who had worked for United Winners SACCO for seven years, applied for a new role as Finance Manager at Shirika SACCO, where she was given the job on probation for 6 months.

Upon the completion of the probation, Shirika SACCO requested a reference from her previous employer (United Winners SACCO). 

Nzula claims that her former employer provided adverse information about her without notifying her or obtaining her consent, a move that saw her miss out on being onboarded for the Finance Manager job permanently.

Also Read: Company Ordered to Pay Ex-Employee Ksh700k Over Recorded Zoom Call

She indicated that she tried to access the letters containing the information shared and was unsuccessful, prompting her to lodge a formal complaint with the ODPC. 

In her complaint, she highlighted how the sharing of such information not only denied her access to her personal data but also resulted in lost job opportunities, including a CEO position she had been eyeing.

The investigation by the ODPC found that while the prospective employer had a legitimate basis to conduct background checks, the former employer violated Nzula’s rights under the Data Protection Act. 

“The Shirika SACCO, being a financial institution regulated by the Sacco Societies Regulatory Authority (SASRA), is required to conduct background checks on prospective employees, thereby establishing the legal basis of processing personal data," read the ruling in part.

"Regulation 9(4) of the Data Protection (General) Regulations 2021 stipulates that "A data controller or a data processor shall comply with a request by a data subject to access their personal data within seven days of the request. The United Winners SACCO did not furnish the complainant with the background check reports within the prescribed timeline.”

Also Read: Man Ordered to Pay Neighbour Ksh200K Over Installed CCTV Camera 

Specifically, she was denied timely access to her personal data, a right clearly provided under Kenyan law.

As a result, the ODPC ordered the former employer to release the requested reference letters to Nzula within 14 days and awarded her Ksh 250,000 as compensation for the infringement of her data rights and the distress caused.

The ruling clarified that while employers can conduct reference checks, they must respect the data protection rights of former employees, particularly regarding consent and access to personal information.

In recent years, ODPC has issued significant rulings on the processing of personal data. For instance, in April 2025, Platinum Credit was ordered to pay a man Ksh400,000 for sending promotional messages about their loan products. 

In November 2025, Liquid Telecommunications Kenya was ordered to pay a former employee Ksh700,000 for the unlawful recording of a Zoom meeting and sharing it with its subsidiary company in Mauritius.

Another significant ruling was made in November when a man was ordered to pay Ksh200,000 to his neighbour after installing CCTV cameras in his compound in a manner that intruded upon the neighbour’s private residence.