Police Request for CCTV via WhatsApp in Nakuru
At 16:30, a man in a police uniform enters the security office of a shopping mall in Nakuru and demands a WhatsApp copy of CCTV footage showing a shoplifting incident in which a suspect was detained that morning. He has a police identity card but no written request, no occurrence book number and no court order. The footage covers 12 identifiable shoppers, including two children, and the mall’s data protection policy says requests must go through the data protection officer, who is off-site until Monday. The guard on duty has the footage on a phone used for incident review. The officer says, “This is a criminal case; you must cooperate immediately.”
1. What legal and policy issues arise from the officer’s demand?
Read the worked answer
CCTV images of identifiable people are personal data under Kenya’s Data Protection Act 2019. Disclosure to police must be lawful, necessary and proportionate, with proper authorisation and secure handling. A police identity card alone does not create an unlimited right to a WhatsApp copy; WhatsApp is an insecure channel and gives no control over onward sharing. Requests should normally be in writing, identify the case, occurrence book or case number, and specify the date, time and purpose. The footage includes children and uninvolved shoppers, so minimisation matters. The guard should not delete, edit or selectively erase footage, because that could amount to destroying evidence.
2. How should the guard respond in practice?
Read the worked answer
Be polite and professional, but do not hand over the phone or send the file. Record the officer’s name, service number, station and telephone number, and verify by calling the station or control room. Explain that the mall requires a written request to the data protection officer or manager and that the guard cannot authorise disclosure. Offer to preserve the footage and arrange a viewing or secure handover with the manager. If the officer says the matter is urgent, call the duty manager and let them decide. Do not use a personal WhatsApp account. If authorised later, release only the relevant clip through a documented, secure channel and keep a receipt.
3. What should the guard record and who should be notified?
Read the worked answer
Record the date and time, the officer’s details, what was demanded, the guard’s response, anyone present and any reference numbers given. Note that no written request or court order was produced. Preserve the original footage and keep it secure; log any access. Notify the data protection officer, the mall manager and the security manager the same day, and provide a written statement. Do not discuss the request on social media or with other tenants. If the officer becomes threatening, remain calm, withdraw to a safe area and call the manager or police station control.