The Right to Be Forgotten in Kenya: Can You Ever Truly Escape Your Past Online?
By Morna Aturinda Partner
Imagine applying for an international business partnership, a senior corporate position or a donor-funded project. Before making a decision, your prospective partners conduct a simple Google search of your name. Among the results, they find an old news article linking you to criminal proceedings that were eventually withdrawn. The case is no longer active, but the article remains accessible. To anyone unfamiliar with the full story, the search results may create the impression that you are still facing prosecution.
You explain that the proceedings ended years ago. You provide the relevant court records. Yet the article remains online, and every new search brings the same story back to the surface.
This article examines who may act as a Trust Agent, the services they may provide, and the disclosure and record-keeping obligations imposed on them.
Can you ask Google to remove it? Can you compel the publisher to delete the article? And, more fundamentally, does the law give you the right to move beyond information about your past?
These questions lie at the heart of what is commonly known as the right to be forgotten.
The right to be forgotten is not entirely new. It is commonly traced to Europe, where, in 2014, the Court of Justice of the European Union (CJEU), in Google Spain SL and Google Inc. v Agencia Española de Protección de Datos and Mario Costeja González, recognised that individuals could, in certain circumstances, require search engines to remove links to information that was inadequate, irrelevant or no longer relevant.
The case concerned Mario Costeja González, whose name continued to be associated with an old newspaper notice about financial difficulties and the sale of his property. Although the underlying proceedings had long been resolved, a simple online search continued to bring up the historical information.
The decision changed the conversation around personal information online. It recognised that information may be historically accurate but, with the passage of time, its continued prominence may become disproportionate to the purpose it originally served.
Four years later, the European Union formalised the right through Article 17 of the General Data Protection Regulation (GDPR), which provides for the right to erasure, commonly associated with the right to be forgotten.
Kenya has taken a similar, although not identical, approach. The Constitution of Kenya, 2010 and the Data Protection Act, 2019 provide a legal framework through which individuals can seek the deletion of personal information. However, the position is not straightforward, particularly where the information appears in newspaper archives, online publications or search engine results.
The question is no longer simply whether an individual has a right to have personal information deleted. It is whether that right extends to information that is accurate, publicly available and potentially relevant to the public interest.
1. The Constitutional Foundation of the Right to Be Forgotten in Kenya
Although the Constitution does not expressly use the words “right to be forgotten”, several constitutional provisions provide the foundation for protecting an individual’s privacy, dignity and reputation.
Article 31(c) guarantees every person the right to privacy, including the right not to have information relating to their private affairs unnecessarily required or revealed.
This protection is particularly important in the digital age, where personal information can be collected, stored, reproduced and circulated long after the circumstances that gave rise to it have changed.
Article 28 further protects human dignity. The continued circulation of personal information may, in appropriate circumstances, undermine an individual’s dignity, particularly where the information is misleading, outdated or presented without sufficient context.
Article 33(3) also requires freedom of expression to be exercised with respect for the rights and reputation of others.
However, these protections do not operate in isolation.
The Constitution also protects competing public interests:
- Article 33: Guarantees freedom of expression.
- Article 34: Protects the freedom and independence of the media.
- Article 35: Guarantees access to information, subject to the applicable constitutional and legal limitations.
This creates an important constitutional balancing exercise. An individual’s right to privacy and dignity must be considered alongside the media’s right to report, the public’s right to access information and the importance of preserving historical records.
Consequently, the right to be forgotten cannot be treated as an unrestricted right to erase every uncomfortable or damaging account of one’s past.
2. The Right to Erasure Under the Data Protection Act, 2019
For many years, Kenya did not have a comprehensive statutory framework governing the processing of personal data. That changed with the enactment of the Data Protection Act, 2019.
The Act established the Office of the Data Protection Commissioner (ODPC) and introduced rights and obligations governing how organisations collect, use, store and retain personal information.
Although the Act does not expressly use the phrase “right to be forgotten”, it recognises a related and enforceable right: the right to erasure of personal data.
Two provisions are particularly important: Sections 26 and 40.
2.1 Section 26: The Right to Delete False or Misleading Personal Data
Section 26 sets out the rights of data subjects, including the right to request the deletion of false or misleading personal data about them.
This provision is important because it recognises that individuals should not be forced to live with inaccurate personal information held by organisations.
For example, where a company maintains an incorrect record showing that an individual owes money, has defaulted on an obligation or has provided inaccurate personal particulars, the individual may invoke the rights under Section 26 to seek correction or deletion, as applicable.
The underlying principle is that personal data should not remain inaccurate or misleading when the individual has a lawful basis to demand its correction or removal.
2.2 Section 40: The Right to Erasure
Section 40 goes further by providing a statutory right to request the erasure of personal data in specified circumstances.
The right applies where personal data is:
- No longer necessary for the purpose for which it was collected or processed;
- Processed unlawfully;
- Required to be erased to comply with a legal obligation; or
- Otherwise falls within the circumstances recognised under the Act and its accompanying regulations.
The provision also addresses the handling of valid erasure requests, requiring the data controller or processor to act without undue delay.
Importantly, the right is not automatic. An individual must establish the relevant legal grounds for requesting erasure, and the circumstances surrounding the processing must be considered.
Regulation 12 of the Data Protection (General) Regulations, 2021 supplements the statutory framework by providing further guidance on the exercise of the right to erasure.
It is important to distinguish Sections 26 and 40. Section 26 establishes the broader rights of data subjects, including the right to deletion of false or misleading data, while Section 40 provides the specific statutory framework for erasure. They are related, but they are not interchangeable.
3. How the Office of the Data Protection Commissioner Enforces the Right to Erasure in Kenya?
Having a legal right is one thing. Being able to enforce it is another.
The ODPC plays a central role in ensuring that organisations comply with their obligations under the Data Protection Act. Individuals who believe that an organisation has unlawfully processed or retained their personal information may lodge complaints with the Commissioner.
The Commissioner’s determinations demonstrate that the right to erasure is not merely theoretical. It has been applied in disputes involving telecommunications companies, service providers and other organisations that hold personal information.
Some notable examples include:
3.1 Liquid Telecom: Failure to Respect Data Subject Rights
In a complaint involving Liquid Telecom, the Data Commissioner found that the company had violated the complainant’s right to be informed under Section 26(a) and the right to erasure under Section 40(1)(b) of the Data Protection Act.
The Commissioner ordered the company to pay KShs. 700,000.
The determination demonstrates that organisations must take data subject requests seriously and ensure that their data processing practices comply with the Act.
3.2 Wananchi Group (Zuku): Continued Marketing Despite Objection
In a separate complaint against Wananchi Group, which operates Zuku, the ODPC found a violation of Section 40 after the company continued sending marketing communications to a complainant despite her requests that it stop.
The decision illustrates an important practical point: organisations cannot simply disregard an individual’s request concerning the continued use of their personal information.
Where an individual has exercised a statutory right, the organisation must assess the request and respond in accordance with the law.
3.3 Wananchi Group: Right to Object and Right to Deletion
In another matter involving Wananchi Group, the ODPC found violations relating to the right to object under Section 36 and the right to deletion under Section 40.
The determination reinforces the need for organisations to establish effective procedures for receiving, assessing and responding to data subject requests.
3.4 Not Every Complaint Results in a Finding Against the Data Controller
The right to erasure does not mean that every request must automatically succeed.
In a complaint against the Kenya Revenue Authority (KRA), the respondent demonstrated that it had already deactivated the complainant’s profile before receiving the erasure request. The Commissioner consequently found no violation.
This determination is equally important.
It demonstrates that the ODPC examines the circumstances of each complaint and considers the evidence presented by both parties. Organisations that maintain proper records of their data processing activities and demonstrate compliance with the law are better placed to defend themselves against complaints.
Taken together, these determinations demonstrate that the ODPC is actively applying the Data Protection Act. However, they also reveal an important distinction: enforcing erasure rights against a business holding customer information is considerably different from compelling a search engine or media organisation to remove historical information from public view.
That distinction brings us to one of the most significant unresolved questions in Kenya’s data protection landscape.
4. Can You Force Google to Forget You? The Mary Wambui Mungai Petition
What happens when the information you want removed is not simply sitting in a company’s internal database, but is publicly accessible through Google?
This is where the right to be forgotten becomes considerably more complicated.
A company holding your personal information may have collected it for a specific commercial purpose. If that purpose no longer exists and there is no lawful reason to retain the information, the case for erasure may be relatively straightforward.
A search engine, however, operates differently. It indexes information published by third parties and makes that information accessible to the public.
Removing a search result does not necessarily mean that the original article is deleted. It may simply mean that the link is no longer displayed when someone searches for a particular name.
This distinction is central to the petition filed by businesswoman Mary Wambui Mungai against Google LLC and Google Kenya Limited before the High Court in Kiambu.
4.1 What Is the Mungai Petition About?
The petition concerns at least 35 online links relating to a Sh2.2 billion tax evasion case involving Mungai.
The prosecution withdrew the case in January 2023 at the request of the Kenya Revenue Authority.
However, the online reports remained accessible through Google search results.
Mungai argues that the continued prominence of these reports creates an inaccurate impression about her legal position and adversely affects her reputation, particularly in her dealings with international partners and donors.
Her case raises several important legal arguments:
First, the continued availability of the information allegedly undermines her reputation and dignity.
Although the criminal proceedings were withdrawn, the search results continue to associate her name with the allegations. She argues that this creates a misleading impression about her current legal position.
Second, she challenges Google’s approach to the right to be forgotten.
Her argument includes the position that Google applies right-to-be-forgotten policies in other jurisdictions but does not provide equivalent protection to individuals in Kenya.
Third, she relies on the Data Protection Act and the Constitution.
The petition invokes Section 25 of the Data Protection Act, together with Articles 28, 31(c) and 33(3) of the Constitution, in support of her claim that the continued processing and accessibility of the information violate her rights.
4.2 Google's Defence: Is Google Kenya Responsible for the Search Engine?
Google Kenya Limited has challenged its position as a respondent, arguing that it does not own or operate the Google search engine.
This raises a significant jurisdictional and data protection question: which entity should bear responsibility where an individual seeks to challenge the processing and display of personal information through a global search engine?
The question is particularly relevant where a multinational technology company operates through different corporate entities across jurisdictions.
The court’s consideration of this issue could have implications beyond the immediate dispute, particularly for other international technology companies processing personal data belonging to individuals in Kenya.
4.3 The Public Interest Argument: Should Accurate Historical Information Be Erased?
The petition also raises concerns about the potential conflict between privacy rights and freedom of expression.
Critics of the petition argue that the reports concern events that actually occurred and form part of the public record. They caution that allowing individuals to remove accurate historical reporting could undermine the media’s ability to report on matters of public interest.
There is also a concern that an expansive right to be forgotten could disproportionately benefit wealthy and influential individuals who have the financial resources to pursue legal proceedings against publishers and search engines.
An advocacy position advanced in the debate is that the public’s right to know about criminal proceedings involving public figures should not automatically be displaced by an individual’s demand for erasure.
The concern is understandable. The right to be forgotten should not become a mechanism through which individuals rewrite history, suppress legitimate journalism or remove information simply because it is damaging to their reputation.
At the same time, the fact that information was once lawfully published does not necessarily mean that its continued processing and prominence will remain justified indefinitely.
4.4 What Is the Current Position of the Case?
An interim ruling was scheduled for 10 June 2026. The outcome of that scheduled ruling is not established in the material available for this article.
The petition therefore remains an important point of reference in the debate on the scope of the right to be forgotten in Kenya. Its significance lies in the questions it places before the courts, particularly the extent to which the Data Protection Act can be used to challenge the continued accessibility of historical information through search engines.
The eventual judicial determination will be important in clarifying the relationship between data protection, privacy, freedom of expression and the public’s right to information.
5. Is There a Right to Be Forgotten in Kenya?
The short answer is yes, but it is qualified.
Kenyan law recognises the right to erasure under Section 40 of the Data Protection Act, 2019. It also protects an individual’s right to seek the deletion of false or misleading personal data under Section 26.
The ODPC has demonstrated that these rights can be enforced against organisations that unlawfully process or retain personal information.
However, the position becomes more complicated where an individual seeks to remove accurate historical information from online publications, search engines or public archives.
The distinction is important.
Where a private organisation retains personal information without a lawful justification, an individual may have strong grounds for seeking erasure.
Where the information is accurate, forms part of a historical record and concerns a matter of legitimate public interest, the individual must contend with competing constitutional rights, including freedom of expression, media freedom and access to information.
The right to be forgotten is therefore not an unrestricted right to erase one’s past. It is a qualified right that requires the circumstances of each case to be considered.
The Mungai petition brings this tension into sharp focus. It presents an opportunity for the Kenyan courts to consider whether the continued accessibility of historical information can, in appropriate circumstances, become disproportionate to the legitimate interests served by its publication.
Ultimately, the future of the right to be forgotten in Kenya will depend on how the courts balance an individual’s right to privacy and dignity against the public interest in preserving access to information.
For individuals, the message is clear: you do have rights over your personal information, and the law provides mechanisms through which you can challenge its unlawful processing and retention.
For businesses, publishers and technology companies, the message is equally important: personal data protection is no longer optional, and the continued use of personal information must have a lawful basis.