ODPC: Mwikali Nzyoka Determination Finds Banks Unlawfully Processed Data

• The Office of the Data Protection Commissioner (ODPC) found Kenya Women Microfinance Bank, Family Bank, and CO-OP BANK KENYA LTD unlawfully processed Mwikali Nzyoka's personal data without consent.
• Nzyoka's complaint stemmed from receiving unsolicited calls in September 2024, where callers claimed her loan information was shared by Kenya Women Microfinance Bank.
• The ODPC's April 21, 2025 determination did not find fraudulent money withdrawal but confirmed unauthorized disclosure of personal details.
• Kenya's banking sector reported Sh168.17 million in identity theft losses and 63 cases in 2025, according to the Central Bank of Kenya.
• Cyber threat events in Kenya surged to 2.696 billion between July and September 2026, marking a 14.45% quarterly increase.

The Mwikali Nzyoka ODPC determination underscored how the unauthorized use of personal information can lead to unwanted contact and place the burden of accountability on institutions entrusted with safeguarding customer data.

In a significant ruling, the Office of the Data Protection Commissioner (ODPC) determined that Kenya Women Microfinance Bank, Family Bank, and CO-OP BANK KENYA LTD unlawfully processed the personal information of Mwikali Nzyoka. This determination, issued on April 21, 2025, followed a complaint by Nzyoka alleging that Kenya Women Microfinance Bank had disclosed sensitive details—including her loan status, identification particulars, workplace, and telephone number—to other financial institutions without her explicit consent.

The complaint detailed how Nzyoka began receiving unsolicited calls in September 2024 from individuals purporting to represent CO-OP BANK KENYA LTD. During these calls, one individual allegedly informed her that Kenya Women Microfinance Bank was engaged in selling customer loans to other banking entities, while another caller claimed to have obtained her personal data directly from the microfinance institution. These interactions raised serious concerns for Nzyoka regarding the unauthorized access and use of her existing loan information by third parties. She specifically cited "the unauthorized disclosure of my personal data and the emotional distress it has caused me" in her formal complaint to the ODPC.

While Kenya Women Microfinance Bank contested that the alleged data breach originated from its internal systems, suggesting alternative sources for the information, the ODPC's subsequent investigation concluded that all three named banks had indeed engaged in unlawful processing of Nzyoka's personal data. Crucially, the ODPC's finding did not establish that any fraudulent withdrawal of funds occurred from her account, nor did it identify the precise technical method through which her information was acquired. Nevertheless, the Mwikali Nzyoka ODPC determination underscored how the unauthorized use of personal information can lead to unwanted contact and place the burden of accountability on institutions entrusted with safeguarding customer data.

The ODPC's intervention comes amidst a backdrop of increasing financial risks linked to compromised personal information within Kenya's banking sector. According to the Central Bank of Kenya's (CBK) Financial Sector Stability Report 2025, identity theft resulted in actual losses totaling Sh168.17 million in 2025. The report documented sixty-three banking-sector fraud cases categorized as identity theft for that year, marking an increase from fifty-six cases reported in 2024.

Despite a decrease in actual losses specifically attributed to identity theft, which stood at Sh199.08 million in 2024, the overall financial impact of fraud across all banking-sector categories saw a significant rise. Total losses escalated from Sh1.59 billion in 2024 to Sh1.90 billion in 2025. It is important to note that these figures from the Central Bank of Kenya fraud report encompass only reported banking-sector fraud and do not represent the full scope of identity theft or personal data misuse incidents across Kenya, nor do they detail the specific mechanisms of each occurrence or confirm a data breach in every case.

Digital identity encompasses a range of information utilized to identify or verify individuals when they access various services, including identification details, telephone numbers, email addresses, financial information, and account credentials. Criminals employ diverse tactics to acquire such sensitive data, including phishing, social engineering, identity theft, SIM-swap fraud, and unauthorized access to digital systems. Phishing, for instance, involves using deceptive messages, websites, or links to trick individuals into divulging confidential information like passwords.

SIM-swap fraud is another prevalent method where criminals attempt to transfer a victim's telephone number to a different SIM card, thereby potentially gaining access to calls or messages critical for account authentication and password recovery. Beyond these external threats, personal information can also be exposed due to vulnerabilities within an organization's systems or through unlawful disclosure by individuals who have authorized access to the data. The scale of these threats is substantial, with the Communications Authority of Kenya's National KE-CIRT/CC Cybersecurity Report for July to September 2026 recording approximately 2.696 billion detected cyber threat events, representing a 14.45 percent increase from the preceding quarter. The report highlighted phishing, social engineering, credential theft, and the exploitation of system vulnerabilities as key threats.

The Mwikali Nzyoka ODPC determination serves as a critical example of Data Protection Act Kenya enforcement, demonstrating that unlawful data processing can be identified and penalized even in the absence of direct financial fraud. The ODPC's finding that Kenya Women Microfinance Bank, Family Bank, and CO-OP BANK KENYA LTD engaged in ODPC unlawful data processing Kenya underscores the stringent requirements for consent and proper handling of personal data by financial institutions. This case highlights that the consequences for victims extend beyond monetary loss, encompassing compromised accounts, unauthorized transactions, misuse of personal details, and the challenging task of identifying responsible parties.

This ruling reinforces the imperative for financial institutions to rigorously review their data processing and sharing protocols, particularly concerning customer consent for third-party disclosures. The active investigation and enforcement by the ODPC signal a heightened regulatory environment where institutions are held accountable for safeguarding personal information, irrespective of whether a direct financial loss is immediately evident. The increasing volume of cyber threats, as evidenced by the Communications Authority of Kenya's reports, further emphasizes the urgent need for robust data protection measures and strict adherence to regulatory frameworks to protect individuals from the unauthorized use of their digital identities.

Financial institutions in Kenya must urgently review their data processing and sharing protocols, particularly regarding customer consent for third-party disclosures, to mitigate the risk of enforcement action from the ODPC, which is actively investigating unlawful data processing even in the absence of direct financial fraud.

Source: Original reporting via Nairobi News