Whistleblower protection and reporting channels in Kenya

The foundation of whistle blowing in Kenya is to be found in the Bribery Act of 2016, which specifically provided for the prevention, investigation and punishment of bribery and connected purposes. In 2021, the Attorney General in consultation with the Ethics and Anti-Corruption Commission (EACC) published Guidelines in respect to the Bribery Act, whose guidelines are intended to give effect to Section 9 of the Act. This Section imposes a duty on public and private entities to establish corruption and bribery prevention procedures.  

Further to the answer in (1) above, through the “Guidelines to assist public and private entities in the preparation of procedures for the prevention of bribery and corruption. Intended to give effect to Section 9 of the Bribery Act, 2016”, the local law does require private entities to establish a whistle blowing system. Whereas both the Act and the Guidelines do not expressly state which private entities are mandated to do so, it is expected that all private entities are to establish whistle blowing systems according to their size, scale and nature of operation, for the prevention of bribery and corruption. 

Section 9 of the Bribery Act, read together with section 18, provides that a director or senior officer of the private entity, or a person purporting to act in such a capacity, or occupying such a position, by whatever name called, commits an offence for failure to formulate procedures in respect to a whistle blowing system. This offence is liable to a fine of up to KES 5 million (approximately USD 44,500), or imprisonment for a term not exceeding ten years, or both.

Part II of the Guidelines published under Section 9 of the Bribery Act, though not expressly established under local labour laws, specifically outlines the procedure to be carried out by an employer in implementing a whistle blower system. 

Yes, the procedure in implementing a whistle-blowing system provides for the involvement of employees of all cadres in the entity. Where appropriate, an entity is to incorporate the consideration of external stakeholders of the entity. In this case, where the employer recognises a Trade Union, involvement of this Trade Union is key.

The procedures set out under the Guidelines specifically provide for the maintenance of confidentiality in disclosing irregularities. This is because the disclosures will need to undergo further internal investigations so as to provide for appropriate action and internal feedback on the veracity of the disclosures. The procedure further provides for fair administrative action, the key being the right to be heard before any further directions are taken on the irregularities reported. It is therefore expected that employees will not externally disclose these irregularities.   

The Employment Act of 2007 provides that no employer shall harass or directly or indirectly discriminate against an employee on any ground or other matters arising out of employment. If the irregularities/misconduct reported by an employee are founded on matters that arise from the nature of their employment with the employer, the law prevents discrimination against or dismissal of such an employee.

Under the guidelines, the procedures provide that an entity (i.e. the employer) must put in place mechanisms that prevent victimisation of employee informants, witnesses and whistle blowers. These mechanisms are to provide for the prevention of discrimination and/or dismissal of a whistle blower from employment.   

The relevant provisions of the Data Protection Act as relates to the processing of any information related to a data subject and the subject's rights must be complied with. Processing data requires that a legal basis must always be carried out in the least invasive way possible to minimise the impact on the data subject. The principle of data minimisation according to the Act must be observed. Personal data irrelevant to a specific report must not be collected or must be deleted without undue delay.

A reporting channel may also trigger other obligations under the Act, such as the obligation to conduct a data protection impact assessment.

The Guidelines provide for collaboration and co-operation with other actors or agencies within the sector or industry. Though not expressly providing for collaboration with entities in different organisations, the collaboration with such entities must be anchored and undertaken through the framework of joint planning and strategising, sharing of information and best practice, mutual consultation, peer reviews and capacity building.