Internet service provider Liquid Telecommunications has once again been found to be in breach of data privacy laws for recording a Zoom meeting with a former employee, despite his express denial of consent.
In a landmark ruling, the Office of the Data Protection Commissioner (ODPC) faulted the company for retaining the recording even after one of the participants requested its deletion, raising concerns in an era when virtual meetings, often recorded, have become a corporate norm.
The ODPC ordered the telco to pay Andrew Alston, its former chief technology officer, Sh700,000 for violating his data privacy rights by unlawfully recording and retaining the Zoom call.
“The call recording caused harm and prejudice to the complainant, in the context in which it was used. The call containing his personal data was processed by the respondent, Liquid Kenya, without his knowledge and consent,” said Data Commissioner Immaculate Kassait in the ruling.
“As a result of the processing, the complainant was placed in a position where he had to object to the processing and defend the admissibility of the call at his own cost.”
This marks the second time Liquid has been penalised by the data protection regulator. Last year, the company was fined Sh500,000 for using a man’s image for commercial purposes without his consent.
According to the latest case file, Mr Alston held a meeting with the head of human resources at Liquid Kenya and the overall HR head in London shortly after being laid off. “The call was heated, and a lot of things were said,” he told the ODPC.
He added that although he had expressly requested that the call not be recorded and had been assured it would be deleted, he was shocked to discover it had been preserved and later used as evidence in a lawsuit he filed against Liquid Mauritius, the parent company of Liquid Kenya.
In its defence, Liquid argued that it had retained the recording out of “legitimate interests”, claiming that it was needed for potential evidence since Mr Alston had already threatened to initiate arbitration against the firm.
“The recording of the call was specifically retained to document, for possible evidentiary purposes, certain proposals or threats that the complainant had made to or against Liquid Kenya during the call,” the telco told the ODPC.
While acknowledging that the company may have had legitimate grounds to keep the recording, the ODPC ruled that Liquid failed to notify the data subject, thereby breaching the Data Protection Act.
The regulator further noted that the firm did not demonstrate how its “legitimate interests” justified sharing the recording with Liquid Mauritius, a separate entity that was the subject of the lawsuit.
Ms Kassait also found that the telco’s claim of legitimate interest did not pass the necessity test, as there were “less intrusive” ways to obtain the same evidence.
“The purported legitimate interest fails the necessity test to the extent that there were other less intrusive means of achieving the same purpose, that is, evidence for purposes of litigation, such as written confirmation or minutes of the meeting,” she said.
