Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The Office of the Data Protection Commissioner (ODPC) ordered Moja Expressway Company (the “Respondent”) to pay its former employee Cyrus Mwaniki Ndungu (the “Applicant”) Kshs 500,000 after the Respondent was found guilty of using the Applicant's image for commercial purposes without his consent nearly a year after he had left the organization.

Facts

The Applicant who was previously employed by the Respondent as a toll attendant within their sales team resigned in November 2022. The Respondent however continued to utilize a video featuring him explaining the ETC system on their social media platforms.

The Applicant contested this practice, arguing it violated his data privacy rights. He asserted that the continued use of his image implied his ongoing employment with the company and constituted unauthorized use of his image for commercial purposes.

The Respondent defended its actions, stating they had obtained the Applicant's consent to use his image in that manner while he was employed. The Respondent maintained that explaining the ETC system fell within the Applicant's job duties and that he willingly participated in the video creation. The Respodent further claimed that the Applicant had received a consent form but never returned it, despite providing verbal agreement.

The Office of the Data Protection Commissioner (ODPC) noted that the Respondent may have obtained initial consent during the Applicant's employment, but it failed to acquire further authorization for publishing the video after the Applicant's resignation.

The ODPC therefore found that the Respondent did not seek consent from the Complainant to further process his personal data after he resigned from employment which was contrary to the requirements of the Data Protection Act, 2019.

Holding

The ODPC held that:

• The Respondent is liable for using the Applicant's image without his consent.
• The Respondent to compensate the Applicant KES.500,000 for the violation.

Comment

The full text of the ruling is available below.