Facial recognition technology is becoming increasingly common in South African workplaces for maintaining attendance and security, but is it legally permissible?

In November 2025 the Kenyan courts found that an employer’s use of facial recognition is unconstitutional and unlawful.

Let’s unpack why.

As we learn from the Kenyan court’s approach to the use of facial recognition it is important to bear in mind that South Africa’s Constitution protects the right to privacy and that South Africa’s data protection laws, including the Protection of Personal Information Act treats biometric information such as facial recognition, as ‘special personal information’.

Background

The Kenya Broadcasting Corporation (KBC) introduced a mandatory facial recognition attendance system for all employees, set for implementation in September 2025. The Kenya Union of Journalists challenged this rollout, citing lack of employee consent, inadequate information on data protection, ignored union requests for consultation, absence of a Data Protection Impact Assessment, undisclosed vendor details, and concerns over data being accessible to unknown third parties.

The right to privacy and data protection reaffirmed

The court considered whether KBC’s actions violated constitutional and statutory privacy requirements. Article 31 of the Kenyan Constitution protects the right to privacy, and the Data Protection Act, 2019, mandates strict safeguards for sensitive data like biometrics. The court emphasised that a Data Protection Impact Assessment is mandatory for new technologies involving such data, and that informed consent, transparency, and disclosure are essential for lawful processing, as these requirements collectively serve to ensure that individuals retain autonomy over their personal information and that any intrusion into their privacy is justified, proportionate, and compliant with both constitutional and statutory obligations.

Failure by the employer to comply with data protection laws

The court found that KBC failed to obtain informed consent, did not conduct the required impact assessment, ignored requests for consultation, and withheld key information about the system and its vendor. These failures amounted to both procedural and substantive violations of the law.

The court referenced its earlier decisions, reiterating that the right to privacy is a firm constitutional guarantee. Any deployment of intrusive technologies such as facial recognition must strictly comply with legal safeguards, including impact assessments, informed consent, and robust data protection measures.

The employer’s use of facial recognition declared to be unconstitutional and unlawful

As a result, the court declared KBC’s biometric system unconstitutional and unlawful, prohibited its implementation until all legal requirements are met, cancelled the rollout, and ordered the deletion of all collected biometric data under official supervision.

Significance for South African Employers

This judgment serves as clear notice to South African employers that adopting biometric or facial recognition technology must be managed with full transparency, meaningful employee engagement, data protection and thorough vendor vetting. Failure to comply with privacy protection principles could render such systems unlawful and expose employers to significant legal and reputational risks

This blog was co-authored by Saajidah Simjee, Candidate Attorney

The full judgment can be found here: Kenya Union of Journalists v Kenya Broadcasting Corporation (Judicial Review Miscellaneous Application E355 of 2025) [2025] KEHC 17216 (KLR) (25 November 2025) (Judgment) – Kenya Law