Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Cinderella Oyuke lodged a complaint against CAPSTUDIO KE for using her pictures on social media for commercial purposes without her express consent. The Data Commissioner determined that CAPSTUDIO KE violated Oyuke's rights. The respondent was ordered to stop publishing and erase the photos, implement clear consent mechanisms, and pay the complainant KES. 500,000 in compensation.

Facts

Cinderella Oyuke complained that Capstudio Ke was using her pictures on their social media platforms (Instagram and WhatsApp status) for commercial purposes without her express consent.

She stated that she had tried to talk to the Respondent to have the pictures removed, but they had only stopped for some days and then continued posting them. She provided screenshots of the photos as proof.

The Complainant prayed for an order directing the Respondent to refrain from using her information and pictures and to pay her for mental and psychological torture.

Capstudio Ke did not submit a response to the Notification of Complaint. Therefore, the allegations were treated as uncontroverted.

The Office analysed the Complainant's submissions and visited the Respondent's Instagram page, confirming the Complainant's photo was uploaded and still available for viewing.

The Office found that the Respondent processed the Complainant's personal data (photos) on their social media platforms for commercial purposes without obtaining her express consent. Section 37(1) of the Act stipulates that a person shall not use personal data obtained pursuant to the provisions of the Act unless the person has sought and obtained express consent from a data subject.

Regulation 14(1) of the Data Protection (General) Regulations, 2021, provides the interpretation of 'commercial purposes' which includes inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting directly or indirectly, a commercial transaction6.... The Office determined that by posting the Complainant's photos to attract clients to their studio for photography services, the Respondent was processing her data for commercial purposes without her consent, violating her rights.

The Data Commissioner found the Respondent liable for violating the Complainant's right to be informed of the use of her personal data and for using it for commercial purposes without her express consent. The Respondent was ordered to stop publishing the Complainant's photos on its social media platforms and to erase the photos from all its social media platforms within the next seven (7) days, failing which an enforcement notice shall issue.

Evaluation of Applicable Laws

• Section 8(1)(f) of the Data Protection Act, 2019: This section provides that the Office of the Data Protection Commissioner can receive and investigate any complaint by any person on infringements of the rights under the Act.
• Regulation 14 of the Data Protection (Complaint Handling Procedure and Enforcement) Regulations, 2021: This regulation states that the Data Commissioner shall, upon conclusion of the investigations, make a determination based on the findings of the investigations.