Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Complainant alleged that Hotel Tobriana used his wedding photos and those of his guests in their advertisements on social media without obtaining their consent. The Data Commissioner found a violation for processing personal data for commercial purposes without express consent. The Respondent was ordered to pay KES 750,000 in compensation

Facts

Richard Wafula complained that Hotel Tobriana used images and videos of his wedding and guests, shared in a WhatsApp group, for branded and personalised advertisement on their social media platforms (Facebook and Instagram) without obtaining their express consent.

The Complainant alleged that the Respondent's actions infringed on his and his guests' right to privacy. He provided screenshots of the posts as evidence. The Complainant sought an order directing the Respondent to erase the data, issue an apology, and pay compensation of Kshs. 2.5 million for the damage caused.

Hotel Tobriana did not respond to the notification of complaint. Therefore, the allegations were treated as uncontroverted. However, the Office noted that as of the date of the determination, the Complainant's image and video were still available on the Respondent's Facebook and Instagram accounts.

The Office found that the Respondent collected and processed the Complainant's personal data (images and videos) and that of his wedding guests for commercial purposes by using them in their advertisements on Facebook and Instagram without obtaining their free, specific, and informed consent.

The posting of the wedding images and videos with details of the event and a call for bookings constituted the use of personal data to market the hotel's services, falling under commercial purposes as defined by Regulation 14(1) of the Data Protection (General) Regulations, 2021.

The Office determined that the Respondent failed to obtain the necessary consent before using the Complainant's and his guests' personal data for advertising, thereby violating their right to privacy under Article 31(c) of the Constitution and Section 25 of the Data Protection Act.

Evaluation of Applicable Laws

The legal provisions reviewed are as follows:

• Article 31(c) and (d) of the Constitution of Kenya: This article provides for the right to privacy of every person, including the right not to have information relating to their family or private affairs unnecessarily required or revealed, or the privacy of their communications infringed. This was reviewed as the constitutional basis for the Data Protection Act, 2019, which is central to the complaint. The Complainant alleged that the Respondent's use of their wedding images and videos without consent violated their right to privacy guaranteed under this article.
• Data Protection Act, 2019 (the Act): This Act was enacted to further guarantee the right to privacy as provided in the Constitution and to regulate the processing of personal data. The entire case revolves around alleged violations of this Act by Hotel Tobriana.
• Section 5 of the Act: This section established the Office of the Data Protection Commissioner and mandated it with the responsibility of regulating the processing of personal data, ensuring compliance with the principles set out in Section 25 of the Act, protecting the privacy of individuals, and establishing the legal and institutional mechanism to protect personal data. This provision was reviewed to understand the Commissioner's mandate and authority to handle the complaint.