Media monitoring can answer legitimate questions. Is a false safety claim spreading? Did coverage carry the organisation’s correction? Are customers reporting the same service failure in public channels? Which issues require a response from leadership?
The same tools can also collect names, locations, opinions, photographs and networks of association at scale. The line between useful listening and intrusive surveillance is crossed when an organisation gathers personal data without a clear purpose, keeps it indefinitely, builds secret profiles or uses monitoring to punish lawful criticism.
Define the decision before collecting the data ¶
Every monitoring brief should name the decision it supports. A crisis team may need alerts about a product recall. A communications team may measure whether an announcement was reported accurately. An executive may need a weekly summary of sector issues.
“Collect everything in case it becomes useful” is not a defensible purpose. Kenya’s Data Protection Act, 2019 requires personal data to be processed lawfully, fairly and transparently, collected for explicit purposes and limited to what is necessary. Public availability does not automatically remove those duties.
A professional media monitoring service should therefore agree the sources, keywords, reporting period, recipients and deletion rule before the dashboard starts filling.
Monitor narratives before people ¶
Most reputation questions can be answered at topic level: volume of coverage, recurring questions, verified factual errors, sentiment with human review, source categories and changes over time. Naming every individual who comments is rarely necessary.
Where a person must be identified—for example, a journalist who requested a response or a public official speaking in an official capacity—the report should include only what the task requires. Staff should not append private family details, home addresses or unrelated social history.
Purpose, minimisation and deletion separate listening from surveillance.
Repute’s issues-management service focuses on emerging concerns and stakeholder response. The discipline is to understand the issue, not to convert disagreement into a dossier on the person raising it.
Listening becomes surveillance when the subject, scale and retention exceed the decision the organisation has a legitimate reason to make.
Treat sensitive inferences as risk, not insight ¶
Monitoring systems may infer political views, health status, ethnicity, religion or union activity from posts and connections. Such inferences can be wrong and can expose people to serious harm. A keyword match is not proof of belief, identity or intent.
The Data Protection (General) Regulations address fair and transparent processing and provide specific requirements for activities such as direct marketing. The official regulations reinforce the need to respect purpose and individual rights. Organisations should seek qualified legal advice where monitoring involves sensitive data, automated decisions, employees or vulnerable people.
Access also matters. Raw monitoring results should not become an open spreadsheet. Limit access to the team that needs it, record exports, protect accounts and review vendors. Corporate communications may need a summary of public narratives, while human resources or security should not automatically receive individual-level data.
Verify before acting ¶
Automated sentiment and identity matching make errors. Sarcasm may be classified as hostility; two people may share a name; a repost may be mistaken for endorsement. Any decision affecting a person should include human review and the original context.
This is especially important in online reputation management. A lawful critical article, genuine customer review or uncomfortable public question is not misinformation merely because it harms the organisation’s image. Repute’s ethical ORM guide rejects fake reviews, impersonation and pressure tactics, and favours factual responses and legitimate correction routes.
Monitoring reports should use confidence labels, link to the source and distinguish allegation, opinion and verified fact. Content development can then answer a real information gap with evidence instead of creating a counter-narrative unsupported by the record.
Set a deletion date and a challenge route ¶
Information that was relevant during a one-week incident may not belong in a permanent profile. The monitoring plan should specify how long raw items and reports are kept, when names are removed and who approves an exception. Vendor deletion should be checked, not assumed.
People may also have rights to ask what data is held, correct inaccuracies or object to certain processing. The organisation needs a route for those requests and a contact capable of explaining the monitoring purpose in plain language. The Office of the Data Protection Commissioner’s communication-sector guidance is a useful starting point for teams handling personal data in communications activities.
Report insight, not a target list ¶
A responsible weekly report may show that delivery complaints rose after an outage, that three articles repeated an incorrect date and that customers need a clearer refund process. It should recommend operational and communication action. It should not rank private citizens by hostility or encourage retaliation.
Repute Communications provides media monitoring and strategic advisory as part of its wider communications services. Organisations setting up or reviewing a monitoring programme can request a confidential consultation. The safest brief is also the most useful one: collect the minimum needed to understand the issue, verify before acting and delete when the purpose ends.
Sources: Kenya Data Protection Act, 2019, Data Protection (General) Regulations, 2021, ODPC communication-sector guidance, Repute Communications media monitoring.
