| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Legal Provisions reviewed |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 23 May 2025 |
| Decided: | 1 August 2025, |
| Published: | Yes |
| Fine: | Kes.500,000/- |
| Parties: | Miriam Okwara Mombo vs. Carlcare Services Limited |
| Case No.: | 0740 of 2025) |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Miriam Okwara Mombo complained Carlcare Services Limited used her image on Facebook for commercial promotion without consent after her employment ended. Carlcare failed to prove express, verifiable consent. The ODPC found a violation of privacy and ordered the Respondent to pay KES 500,000 compensation.
The Complainant, Miriam Okwara Mombo, was employed by the Respondent from January 2018 until her termination in November 2023. In November 2024, a family member alerted her that her image was being used on Carlcare's official Facebook page to invite over two million followers to visit the Nakuru branch for phone repairs. Upon further review, she discovered another post from July 2024 using her image as a pin location for the Eldoret office. She asserted that she had never consented, expressly or otherwise, to the use of her photographs for commercial purposes and was distressed that her personal data was being used long after her employment had ended. Despite issuing a demand letter, she noted that the images remained active until at least May 2025, drawing business and public engagement to the Respondent.
Carlcare Services Limited contended that the Complainant had provided verbal consent for the use of her image while she was still working for the company. They admitted that this consent was unfortunately not in writing but maintained that the image was used based on that verbal agreement. The Respondent further claimed that they immediately removed the image once the Complainant registered a complaint regarding its use and had not used it thereafter.
The Office of the Data Protection Commissioner (ODPC) found that under Section 32 of the Act, the burden of proof for establishing consent lies with the Respondent. The Office observed that the Respondent failed to provide sufficient evidence to substantiate the claim of verbal consent or to meet the legal criteria for express, unequivocal, and informed consent. Additionally, the ODPC determined that the use of the image to induce the public to visit repair branches constituted processing for commercial purposes under Section 37 of the Act. Since the Respondent used her likeness to advance its economic interests without obtaining the required express consent, it was found to have violated the Complainant's right to privacy.
In the final determination, the Data Commissioner ruled as follows: