In recent years, Kenya has witnessed significant developments in data protection. One key development has been the commitment to safeguarding personal and sensitive information, which is underscored by the enforcement actions taken by the Office of the Data Protection Commissioner (ODPC). Specifically, the ODPC has established mechanisms for receiving and determining complaints related to data protection. We have been tracking decisions taken by the ODPC with the aim of understanding the impact of the decisions on our clients’ operations.
Below is a highlight of the key decisions:
- Using stock images for marketing purposes without express consent.
In the case of Liburuwen Lesanguru Kweri v Beehive Media Limited, [ODPC Complaint No. 0740 of 2023], Beehive Media Limited (Beehive”), was contracted by Capwell Industries Limited to provide advertising services for their maize flour products (“Soko” and “Amaize”). In executing its mandate, Beehive obtained an image from a public and royalty free image repository known as Shutterstock for use in a Father’s Day campaign. It was not in dispute that the image was obtained from Shutterstock and that there was no express consent from the data subject for use of the image.
In its defence, Beehive stated that: –
- it acted on the belief that Shutterstock had obtained consent from the data subject.
- the image was available for use subject to payment of fees and adherence to the license conditions.
- the photo was used for social purposes and not for commercial purposes; and
- upon receiving the complaint, they took immediate steps to pull down the images and stop its further use.
The ODPC determined that Beehive’s action of using an individual’s stock image for advertisements without their express consent violated their rights. However, the ODPC dismissed the complaint on the basis that Beehive had taken immediate steps to resolve the matter including pulling down the advertisements in dispute, terminating the contract they had with Shutterstock Inc., and reaching out to the data subject to try and settle the matter amicably.
- Using an individual’s image to advertise products and services.
In the case of Isaya Lemerketo v Kenya School of Law [ODPC Complaint No. 0608 of 2023], The Kenya School of Law (“School”) made flyers featuring the complainant’s image and distributed them on their social media platforms (Instagram, Facebook & Twitter) and hardcopy marketing collateral without his consent. Upon receipt of the complaint, the School withdrew the flyers within 24 hours, took down the social media posts and communicated its actions to the data subject. The ODPC determined that the School’s action of using a person’s image without their consent violated his rights over his image. However, the ODPC commended the immediate actions taken by the School to resolve the matter and marked the complaint as resolved.
- Using an employee’s image on social media
In Edith Andeso v Olerai Schools Limited, [ODPC Complaint No. 725 of 2023], Olerai Schools Limited (“School”). Prior to termination of employment, the complainant was a full-time teacher at the School. After she was terminated, she raised a complaint that the School took photos of her and posted them on the School’s Facebook page without her consent. She further asserted that the photo created a perception that she was a member of the School thereby limiting her employment options. In its defence, the School stated that: –
- As a class teacher, the complainant was responsible for obtaining parental consent before using the images. She gave written consent for her children’s photographs to be used by the school.
- The complainant coordinated the taking of the photographs of the students.
- The complainant never raised an objection to having her photo taken by the School. She participated freely in the taking of the photo and did not raise an objection in the three-month period following use of her image.
- Upon receipt of the complaint, the School took immediate action to pull down the image from its social media platforms.
The ODPC determined that the complainant had knowledge of the purpose and context in which the photos were to be used and by her clear affirmative action, she consented to the processing of her personal data by the School. Therefore, the ODPC dismissed the complaint.
- Using minor’s images on social media without parental or guardian consent.
In the case of Christine Wairimu Muturi v Roma School Uthiru, [ODPC Complaint No. 0841 of 2023], the complainant alleged that she was a parent at Roma School, Uthiru and that the School had processed images of pupils (minors) on TikTok, without the express consent of their parents or guardians. The School created a WhatsApp group through which it informed parents of its intention to publish minors’ images and videos on TikTok. This action prompted the parents to raise objections and leading to the filing of the complaint.
In its response to the Data Commissioner, the School stated, without producing evidence that: –
- They did not have a pupil or a parent by the complainant’s name in their School.
- They were not aware of any minor’s data shared on TikTok or any of their social media platforms.
- They had never received any complaint on the issue from any parent to enable investigations.
The Data Commissioner conducted independent investigations and determined that the respondent operates a TikTok and Facebook page on which it posted images and videos of pupils. As result, the Data Commissioner held that the School had failed to abide by the requirements of the Data Protection Act including the principles of data protection and protecting the rights of minors by seeking consent. The Commissioner issued an Enforcement Notice and a Penalty Notice and fined the School the sum of Kenya Shillings Four Million, Five Hundred Thousand (Kes. 4, 500,000/-)
In the case of Abdinur Kassim & Luqman Hussein Kassim (Minor suing through his father and next friend) v Joyce Njoki Ngugi T/A Kora Spa [ODPC Complaint No. 0660 of 2023], the complainant alleged that the respondent processed the personal information relating to the minor for commercial purposes without consent of the data subject and minor’s guardian. The complainant visited the respondent’s place of business at Fedha Business Park Embakasi with the sole purpose and intention of obtaining barber services. While receiving the services, agents of the respondent took their photographs, without offering any explanation. Five days after their visit, the complainants discovered that the respondent had published the photographs on Facebook and Instagram without their consent.
In response, the respondent denied the complainant’s allegations and stated that:
- The photographs were not taken in an intrusive manner as no intimate aspects of the claimants’ personal lives were published.
- There was no reasonable expectation of privacy in a public place such as a barbershop.
- The photographs taken did not portray the claimants as being distressed, disheveled or upset. This implied constructive consent.
- No evidence existed to ascertain that the complainant’s personal data were used for commercial purposes.
- The alleged infringing photos were pulled down immediately upon request by the complainant as per the respondent’s privacy policy.
The ODPC determined that posting the images on the respondent’s social media pages amounted to commercial use of personal data which required consent. The respondent failed to demonstrate that they had obtained the express consent of the complaint and his guardian. Further, the ODPC was unable to establish how long the images remained online after publication and before being pulled down. Therefore, the ODPC issued the respondent with an Enforcement Notice.
- Posting of customer’s image on social media without consent.
In the case of Perpetual Wanjiku v Casa Vera Lounge, [ODPC Complaint No. 0607 of 2023], the Respondent, a popular bar and restaurant joint, captured images of the data subject and featured them on their Facebook, Instagram and WhatsApp platforms without her consent . The Complainant filed a complaint alleging breach of privacy. In response to the complaint, the respondent stated that: –
- It had conspicuously displayed on a privacy notice at the entrance of their premises. The notice
- Their photographers never take photographs of their customers without first informing the customer. In this case, the photographer walked to the complainant’s table and requested to take a photograph of the complainant and her friend, which they consented to by posing for the picture.
- Customers were informed that the photographs would only remain on their social media pages subject to the customer’s consent, and
- where a customer withdraws consent, the Club retracted the photographs from their platforms.
- The Club pulled down the said image after the complainant informed them that she was uncomfortable with her photograph being on its social media pages.
- The Club was in the process of developing a comprehensive internal data privacy policy to prevent similar occurrences in the future.
The ODPC conducted a site visit and ascertained that the notice was not visible to customers upon their entry to the respondent’s premises. As such, it was not considered to be sufficient notice as envisaged in the Act. Consequently, the ODPC determined that the respondent failed to sufficiently notify the complainant of the possibility of her image being captured. In addition, the ODPC found that the respondent failed to demonstrate that the complaint had given consent for the photograph to be taken. Posing for the photograph was not sufficient proof of consent and in any case, such an action did not meet the conditions of consent established in the law. Therefore, the ODPC issued an Enforcement Notice to the respondents. In addition, the respondent was fined Kes. 1,800,000/- for failing to comply with the Enforcement Notice.
OUR OBSERVATIONS
- Images including photographs and videos are regarded as Personal Data and must be protected in accordance with the Data Protection Act.
- Use of images for commercial purposes such as advertising, brand promotion on social media, websites and other online print media must be done pursuant to an individual’s consent.
- Parental consent must be obtained prior to processing a minor’s personal data.
- The actions taken by the data controller or processor following posting of an image may be considered in determining the culpability of the data controller or processor.
- Where a person alleges consent, they must provide evidence of such consent.
- Consent must be demonstrated even for use of stock images obtained from sites such as Shutterstock.
- Failing to comply with an Enforcement Notice may result in the issuance of a monetary fine.
- Data Commissioner, Immanuel Kassait, MBS urged Data processors and controllers to ensure that the processing of personal data is in accordance with the provision of the Act failure to which will result in instituting enforcement procedures.
WAY FORWARD
In relation to the use of photography/videos and stock images for marketing purposes, we urge our clients to: –
- Audit all photographs and videos used for commercial purposes and the audit should extend to both online and offline materials and should determine to what extent photographs have been used without the consent of the image owners.
- Where consent has not been obtained, take immediate steps to obtain appropriate consent. The consent must comply with the requirements of the Data Protection Act.
- Maintain a record of all consents provided by image owners. The consent may be physical or electronic.
- Remove images where the image owners cannot be found or where the owner fails to provide consent.
- Update all privacy notices and inform people that where you use their photographs you will seek their prior consent.
- Inform the data subjects of their rights to object, withdraw consent at any time, rectification, erasure of their processed images.
- Develop and display Corporate Privacy Policy or Notice in conspicuous places specifying data subject rights and providing a mechanism for enabling data subjects to get in touch with you whenever they have a complaint or query relating to their personal data or if they want to exercise their rights.
- Develop a Data Retention Policy specifying on the duration that the data subject’s image will last on your organization’s social media pages.