ODPC faults LOLC Kenya and recommends its directors for prosecution

In a determination dated 14 April 2026 (Peter Macharia Waithira v LOLC MFB), Data Commissioner Immaculate Kassait held LOLC Kenya Microfinance Bank liable for publishing a former employee's image and personal details in public notices on its social media platforms without consent or lawful basis, ordered deletion within 14 days, and recommended the bank's directors for criminal prosecution for obstruction after the lender failed to cooperate with the investigation, with fines up to KES 5 million or two years' imprisonment on conviction. The obstruction recommendation is the development: ODPC enforcement now reaches directors personally, not just the corporate respondent.