| Entity | Role in Data Access/Use |
|---|---|
| Central Bank of Kenya (CBK) | Oversees mobile money operations, requires transaction data for compliance and systemic risk monitoring. |
| Communications Authority of Kenya (CAK) | Regulates telecoms, monitors subscriber records and transaction flows for licensing and compliance. |
| Financial Reporting Centre (FRC) | Receives suspicious transaction reports to combat money laundering and terrorism financing. |
| Office of the Data Protection Commissioner (ODPC) | Ensures Safaricom’s data handling complies with Kenya’s Data Protection Act. |
| National Intelligence Service (NIS) | Accesses metadata for national security surveillance under lawful requests. |
| Ethics and Anti-Corruption Commission (EACC) | Investigates corruption cases, often requiring transaction trails from M-Pesa. |
| Directorate of Criminal Investigations (DCI) (non-police units) | Accesses transaction records for fraud, cybercrime, and financial crime investigations. |
| Banks & Financial Institutions (e.g., Equity Bank, KCB, NCBA) | Linked through M-Pesa integrations; transaction data shared for reconciliation and compliance. |
| Credit Reference Bureaus (CRBs) | Receive customer repayment and transaction data for credit scoring. |
| Telecommunications Partners (Airtel, Telkom, international roaming partners) | Limited sharing for interoperability and settlement of cross-network transactions. |
5 Court Cases Involving Safaricom’s Illegal Data Sharing
| Case | Year | Data Shared | Recipient | Court Findings/Notes |
|---|---|---|---|---|
| David Oaga Mokaya v Safaricom (Ruto Social Media Case) | 2025 | University student’s subscriber details and call records | Kenya Police investigators | Safaricom admitted to sharing data without a court order during trial at Milimani Law Courts. |
| Safaricom v. Student (Ruto Coffin Story Case) | 2025 | Call data records (SMS logs, phone call duration) | Directorate of Criminal Investigations (DCI) | Safaricom’s security officer testified that data was handed over without judicial authorization. |
| Wachira v Safaricom Company Limited (Civil Suit E005 of 2022) | 2024 | Subscriber information allegedly leaked | Unknown third parties (claimed by plaintiff) | Plaintiff alleged illegal disclosure; case dismissed for lack of proof, but highlighted risks of weak safeguards. |
| Milimani Cybercrime Case (Unnamed Student) | 2024 | Transaction and subscriber data | DCI Cybercrime Unit | Court heard Safaricom provided records under informal requests, breaching Data Protection Act requirements. |
| High Court Petition on Data Protection (Multiple Plaintiffs) | 2023 | Bulk subscriber metadata | Government agencies (unspecified, including security services) | Petitioners argued Safaricom shared data without consent; case underscored systemic issues in lawful interception practices. |
Key Observations
- Pattern of Breach: Most cases involve students or activists, where Safaricom shared call/SMS records with police or DCI without court orders.
- Legal Gap: Courts repeatedly flagged violations of the Data Protection Act (2019), but enforcement remains weak.
- Dismissals: Some civil suits (e.g., Wachira v Safaricom) were dismissed due to insufficient evidence, showing the difficulty of proving illegal data transfers.
- Transparency Issues: Safaricom often claims compliance, yet testimony from its own officers revealed informal cooperation with investigators.
I simply have no time for Kagege stupidity.
