Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Saira M. Iqbal alleged that Olivia Hair T/A Di Lorenzo Limited unlawfully used and continues to use her image for commercial purposes without any lawful basis or consent. The Respondent failed to reply to the complaint. The ODPC found the Respondent liable for processing the image without express consent and ordered compensation of KES 500,000.

Facts

The complaint concerned the allegation that the Respondent processed and continues to process the Complainant’s image for commercial purposes without a lawful basis. The Complainant alleged that the Respondent has used and continues to use her image for commercial purposes without obtaining her consent. She stated that no informed or explicit consent was ever sought or obtained from her regarding the intended use of her image.

The Complainant contended that the Respondent financially benefited from the unauthorized use of her image by marketing its beauty products. She claimed that these products are distributed both nationally and internationally through various supply chains. The Complainant asserted that her image and likeness constitute personal property with economic value, and that the continued use of her image without consent infringes on her right to privacy. She further averred that she has suffered reputational harm and emotional distress, as the Respondent continues to profit from her image without offering any form of compensation, despite her needing to work for a living.

The Respondent failed, refused, and/or neglected to respond to the Notification of Complaint filed against it. The Office had notified the Respondent of the complaint via a letter dated 4th April 2025, requesting details such as a response to the allegations, relevant materials in support of their response, details on how the Complainant’s personal data was obtained, and mitigation measures.

Because the Respondent failed to respond to the notification, the allegations levelled against it remained uncontroverted. The failure to furnish the Office with a response after being notified amounted to non-cooperation with the Office and non-compliance with an order of the Data Commissioner, contrary to Section 57(1)(c) and (3) of the Act.

The ODPC determined two key issues: whether the Respondent obtained the Complainant’s consent as required by the Act to use her image for commercial purposes, and whether the Complainant was entitled to any remedies.

1. Consent for Commercial Purposes: It was undisputed that the Respondent used the Complainant's image on a public business social media account to advertise and market its hair beauty product, meaning the Complainant's image was used to further the Respondent's commercial and economic interests. The use of the Complainant’s image, which was visible to the general public and intended to induce potential clients to use the Respondent’s services, required explicit consent. Consent must be an expression of express, unequivocal, free, specific, and informed indication of the data subject's wishes. Since the Respondent failed to respond to the complaint, it did not discharge its burden of proof to demonstrate that the Complainant expressly consented to the use of her image for commercial purposes, as required under Section 32(1) and 37 of the Act. The ODPC found that the Respondent did not obtain the requisite consent required by the Act to use the Complainant's image for commercial purposes.
2. Entitlement to Remedies: The ODPC found that the Respondent processed the Complainant's image for commercial purposes without the requisite consent, resulting in a violation of the Act. Section 65 of the Act provides that a person who suffers damage by reason of a contravention of a requirement of the Act is entitled to compensation, and "damage" includes financial loss and damage not involving financial loss, including distress. Considering the Respondent failed to prove that it obtained express consent and was continuing the unauthorized use of the image on its public social media platform, the ODPC determined the Complainant was entitled to compensation. The Data Commissioner took into account the nature and extent of the violation with regard to the unlawful processing of personal data and the period of violation.

• Evaluation of Applicable Laws

Holding

The Data Commissioner made the following final determination: