Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Brian Onyango and Clemence Wangio sued Bwibo Restaurant for using their images on Twitter for promotional purposes without consent. The ODPC found the restaurant failed to prove express consent for commercial processing. Consequently, the Respondent was found liable and ordered to pay KES 50,000 total compensation.

Facts

The Complainants, Brian Onyango and Clemence Wangio, alleged that in October 2024, they discovered the Respondent had obtained and published their images on the Twitter (X) platform for promotional and commercial purposes without their knowledge, consent, or legal authorisation. They asserted that this unauthorised processing caused them emotional distress, unwanted public attention, and reputational harm, as the posts falsely implied they were "influencers" associated with the restaurant. Despite issuing demand letters in late 2024 and early 2025 for an amicable settlement, the Complainants claimed the Respondent failed to provide compensation for the violation of their rights.

Bwibo Restaurant maintained that the photographs, posted in May 2022, were general shots intended to showcase the restaurant’s cuisine and outlook rather than targeting the Complainants specifically. The Respondent argued that the images were not defamatory and that a conspicuous poster was pinned to its wall informing patrons that entry implied consent to photography. Furthermore, they contended that the complaint was "monetarily motivated" and an "afterthought," noting that the Complainants waited three years after the initial post to file their claim. The Respondent also highlighted that they had promptly pulled down the post and tendered a written apology once notified of the dispute.

The Office of the Data Protection Commissioner (ODPC) found that the Respondent bore the legal burden of proof to demonstrate that express, unequivocal, and informed consent had been obtained for processing personal data. The ODPC determined that the general notice pinned on the restaurant wall did not constitute valid consent as defined under Section 2 of the Act. Additionally, the Commissioner ruled that the text accompanying the image ("Welcome to Bwibo") was designed to advance economic interests and induce public patronage, thus qualifying as processing for commercial purposes. Consequently, the Respondent was found to have violated the Complainants' right to privacy by failing to obtain express consent.

• Legal Provisions Reviewed

Holding

In the final determination, the Data Commissioner ruled as follows:

• The Respondent was found liable for infringing the Complainants' data protection rights.
• The Respondent was ordered to pay a cumulative compensation of KES 50,000 (split as KES 25,000 to Brian Onyango and KES 25,000 to Clemence Wangio).
• The ODPC took cognisance of the Respondent's mitigation measures, specifically the immediate removal of the impugned posts upon receiving the demand letters.
• The parties were granted the right to appeal the decision to the High Court of Kenya within thirty days.