| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 28(1), 30(a) & 32 of the Data Protection Act, Regulation 6(3) of the Data Protection (General) Regulations, 2021. |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 10 October 2023 |
| Decided: | 6 January 2024 |
| Published: | Yes |
| Fine: | KES.1,900,000/= |
| Parties: | Mercy Wambua (Suing on behalf of herself & 2 Minors) vs. Bold Decisive Digital Lab & Anor |
| Case No.: | 1973 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
The ODPC found Bold Decisive Digital Lab liable for using photos of Mercy Wambua and her children without consent for commercial purposes, violating the Data Protection Act. The complaint against Equity Afia was dismissed, as no evidence showed its involvement. The decision reinforces consent requirements and child data protection obligations.
The complaint was made by Mercy Wambua on behalf of herself and her children against Bold Decisive Digital Lab (the 1st Respondent), a marketing agency, and Equity Afia (the 2nd Respondent), a health services provider. The complaint alleged that the 1st Respondent used and published photos of the complainant and her children without prior consent for commercial purposes. It was also alleged that the 2nd Respondent engaged in the collection, processing, or storage of personal data pertaining to the complainants without their consent.
After reviewing the evidence and submissions from both parties, the office of the Data Protection Commissioner (ODPC) found that the 1st Respondent had indeed used the photos without proper consent, thereby meriting the claim against them. However, the claim against the 2nd Respondent was deemed unfounded as there was no evidence of their involvement in the alleged data processing activities (the document was a marketing proposal by the 1st Respondent to the 2nd Respondent).
Additionally, the office considered the legal framework under the Data Protection Act, which outlines the principles and requirements for the processing of personal data, including the need for consent, protection of children's personal data, and the duty to inform data subjects of data collection. Based on these provisions, the office held that the 1st Respondent's actions contravened the Act by processing personal data without consent, while the 2nd Respondent was not found to have engaged in such activities.
Overall, the office of the Data Protection Commissioner found in favor of the complainant against the 1st Respondent for the unauthorized use of personal data, while dismissing the claim against the 2nd Respondent due to lack of evidence supporting the allegations.
The ODPC held that:
The images the subject of the complaint were obtained from the Complainant's social media page, adding an interesting dimension to the case.
The full text of the ruling is available below.