Safaricom

Al Jazeera's 'Invisible Eyes' documentary (May 2026) exposed that Safaricom allowed Kenyan security agencies access to subscriber location data, call records, and M-Pesa financial transactions -- often without court orders -- to surveil, locate, and track activists and protesters. A Safaricom employee admitted in court to complying with a government data request without a court order. The Law Society of Kenya filed a constitutional petition seeking a court audit of all data requests from June 2024 to December 2025.

On May 18, 2026 the High Court of Kenya ordered Safaricom to pay 9.9 million Kenyan shillings to a customer over a client data breach, holding that Safaricom could not escape liability by blaming individual employees. The judgment established that companies bear institutional responsibility for documented access controls, monitoring systems, and breach detection. Local commentary described the ruling as exposing systemic failures in Safaricom's customer-data protection regime.