ODPC faults LOLC Kenya and recommends its directors for prosecution

In a determination dated 14 April 2026 (Peter Macharia Waithira v LOLC MFB), Data Commissioner Immaculate Kassait held LOLC Kenya Microfinance Bank liable for publishing a former employee's image and personal details in public notices on its social media platforms without consent or lawful basis, and ordered deletion within 14 days.

The Commissioner also recommended the bank's directors for criminal prosecution for obstruction, after the lender failed to cooperate with the investigation, with fines of up to KES 5 million or two years' imprisonment on conviction. The obstruction recommendation extends ODPC enforcement to directors personally, beyond the corporate respondent alone.