Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. Decision

Summary

Abdul Naumanga sued Mi Casa Company for posting his photos/videos without consent, causing his work suspension. Mi Casa failed to respond. The PDPC found unauthorised use and, applying "continued breach" despite posts predating the Act, ordered Mi Casa to pay TZS 20M compensation and delete all content immediately.

Facts

In May 2024, the complainant, Abdul Said Naumanga, was informed by his mother, Catherine Tesha, that she had seen pictures and videos of him online that displeased her due to the values by which she raised him. Upon investigation, Mr. Naumanga discovered that these photos and videos had been posted on MI CASA Company Limited's Instagram account between February and April 2023. The complainant ordered MI CASA Company to delete the posts, and although they promised to do so, they failed to comply.

Mr. Naumanga, who had been employed by Msando Law Office since July 2024, was suspended from work on 12th August 2024 due to the posted pictures and videos, which depicted him drunk, on the pretext of embarrassing the office. He successfully defended himself by proving the photos were taken before his employment, leading to his reinstatement on 2nd September 2024 after an investigation. Mr. Naumanga sought monetary compensation of Four Hundred Million Tanzanian Shillings (TZS 400,000,000/=) and any other relief the Commission deemed fit.

The complaint was heard ex-parte because MI CASA Company Limited, the respondent, failed to submit their reply as required. According to Regulation 7(3), a respondent who fails to present their defence is deemed to have waived their right to appear and participate in the proceedings, allowing the Commission to proceed with the hearing without their presence.

The Commission framed three issues for determination:

1. Whether Mi Casa Company Limited used the complainant’s personal information without his consent?
   • The Personal Data Protection Act, Cap 44, defines "personal data" to include information about an identifiable person, such as photographs, which identify an individual.
   • The Commission found that Mi Casa Company Limited did use the complainant’s identifiable photos and videos without his consent. Such actions would normally constitute a clear violation of the Personal Data Protection Act.
2. Whether the alleged violation occurred during a period in which the Personal Data Protection Act was in force?
3. Whether the Personal Data Protection Commission has the authority to hear and determine the matter?
   • The material in question was posted between February and April 2023.
   • The Personal Data Protection Act, Cap 44, came into force on 1st May 2023.
   • Initially, the Commission noted that since the violation occurred before the law was effective, it lacked the legal authority to adjudicate or impose sanctions for an act done prior to the law's commencement. This aligns with Article 13(6)(c) of the Constitution of the United Republic of Tanzania, which prohibits punishing a person for an act that was not an offence at the time of its commission.
   • However, the Commission decided to apply the principle of "continued breach". It determined that the continued presence of the still pictures and videos of the complainant online continued to cause harm to him over an extended period.
   • Therefore, the Commission considered the ongoing online presence of the complainant’s personal data to be inappropriate and a violation of basic privacy norms, establishing unauthorized use of his personal data. This reasoning allowed the Commission to entertain the complaint despite the initial cause of action arising before the Act's enactment.

• Legal provisions reviewed

Holding

In the interest of protecting privacy and preventing further harm, the Commission issued the following orders:

• Mi Casa Company Limited is to pay the Complainant a monetary compensation of Twenty Million Tanzanian Shillings only (TZS 20,000,000/=) as general damage.