In recent years, Kenya has witnessed significant developments in data protection. One key development has been the commitment to safeguarding personal and sensitive information, which is underscored by the enforcement actions taken by the Office of the Data Protection Commissioner (ODPC). Specifically, the ODPC has established mechanisms for receiving and determining complaints related to data protection. We have been tracking decisions taken by the ODPC with the aim of understanding the impact of the decisions on our clients’ operations. Below is a highlight of the key decisions: In the case of Liburuwen Lesanguru Kweri v Beehive Media Limited, [ODPC Complaint No. 0740 of 2023], Beehive Media Limited (Beehive”), was contracted by Capwell Industries Limited to provide advertising services for their maize flour products (“Soko” and “Amaize”). In executing its mandate, Beehive obtained an image from a public and royalty free image repository known as Shutterstock for use in a Father’s Day campaign. It was not in dispute that the image was obtained from Shutterstock and that there was no express consent from the data subject for use of the image. In its defence, Beehive stated that: – The ODPC determined that Beehive’s action of using an individual’s stock image for advertisements without their express consent violated their rights. However, the ODPC dismissed the complaint on the basis that Beehive had taken immediate steps to resolve the matter including pulling down the advertisements in dispute, terminating the contract they had with Shutterstock Inc., and reaching out to the data subject to try and settle the matter amicably. In the case of Isaya Lemerketo v Kenya School of Law [ODPC Complaint No. 0608 of 2023], The Kenya School of Law (“School”) made flyers featuring the complainant’s image and distributed them on their social media platforms (Instagram, Facebook & Twitter) and hardcopy marketing collateral without his consent. Upon receipt of the complaint, the School withdrew the flyers within 24 hours, took down the social media posts and communicated its actions to the data subject. The ODPC determined that the School’s action of using a person’s image without their consent violated his rights over his image. However, the ODPC commended the immediate actions taken by the School to resolve the matter and marked the complaint as resolved. In Edith Andeso v Olerai Schools Limited, [ODPC Complaint No. 725 of 2023], Olerai Schools Limited (“School”). Prior to termination of employment, the complainant was a full-time teacher at the School. After she was terminated, she raised a complaint that the School took photos of her and posted them on the School’s Facebook page without her consent. She further asserted that the photo created a perception that she was a member of the School thereby limiting her employment options. In its defence, the School stated that: – The ODPC determined that the complainant had knowledge of the purpose and context in which the photos were to be used and by her clear affirmative action, she consented to the processing of her personal data by the School. Therefore, the ODPC dismissed the complaint. In the case of Christine Wairimu Muturi v Roma School Uthiru, [ODPC Complaint No. 0841 of 2023], the complainant alleged that she was a parent at Roma School, Uthiru and that the School had processed images of pupils (minors) on TikTok, without the express consent of their parents or guardians. The School created a WhatsApp group through which it informed parents of its intention to publish minors’ images and videos on TikTok. This action prompted the parents to raise objections and leading to the filing of the complaint. In its response to the Data Commissioner, the School stated, without producing evidence that: – The Data Commissioner conducted independent investigations and determined that the respondent operates a TikTok and Facebook page on which it posted images and videos of pupils. As result, the Data Commissioner held that the School had failed to abide by the requirements of the Data Protection Act including the principles of data protection and protecting the rights of minors by seeking consent. The Commissioner issued an Enforcement Notice and a Penalty Notice and fined the School the sum of Kenya Shillings Four Million, Five Hundred Thousand (Kes. 4, 500,000/-) In the case of Abdinur Kassim & Luqman Hussein Kassim (Minor suing through his father and next friend) v Joyce Njoki Ngugi T/A Kora Spa [ODPC Complaint No. 0660 of 2023], the complainant alleged that the respondent processed the personal information relating to the minor for commercial purposes without consent of the data subject and minor’s guardian. The complainant visited the respondent’s place of business at Fedha Business Park Embakasi with the sole purpose and intention of obtaining barber services. While receiving the services, agents of the respondent took their photographs, without offering any explanation. Five days after their visit, the complainants discovered that the respondent had published the photographs on Facebook and Instagram without their consent. In response, the respondent denied the complainant’s allegations and stated that: The ODPC determined that posting the images on the respondent’s social media pages amounted to commercial use of personal data which required consent. The respondent failed to demonstrate that they had obtained the express consent of the complaint and his guardian. Further, the ODPC was unable to establish how long the images remained online after publication and before being pulled down. Therefore, the ODPC issued the respondent with an Enforcement Notice. In the case of Perpetual Wanjiku v Casa Vera Lounge, [ODPC Complaint No. 0607 of 2023], the Respondent, a popular bar and restaurant joint, captured images of the data subject and featured them on their Facebook, Instagram and WhatsApp platforms without her consent . The Complainant filed a complaint alleging breach of privacy. In response to the complaint, the respondent stated that: – The ODPC conducted a site visit and ascertained that the notice was not visible to customers upon their entry to the respondent’s premises. As such, it was not considered to be sufficient notice as envisaged in the Act. Consequently, the..
