Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Cherry Fiona Mwendwa complained Acceler Global Logistics used her partial image on its internal system since 2021, ignoring her cease-and-desist letter. The ODPC found the Respondent liable for violating her right to object and ordered compensation of Kshs. 250,000.

Facts

The Complainant, Cherry Fiona Mwendwa, lodged a complaint with the Office of the Data Protection Commissioner (ODPC) on 11th April 2025, asserting that the Respondent, Acceler Global Logistics, used her partial image on its internal track and trace system continuously since 2021. This usage persisted even after she issued a cease-and-desist letter in November 2021. She averred that her image was used on the Respondent's internal Track and Trace system from 2021 without her consent. She further claimed that although the image was partial and translucent, it remained visible enough to be identified by third parties. The Complainant maintained that the Respondent failed to act on her initial objections, demonstrating a willful disregard for her privacy rights. She alleged that the image was used to secure commercial advantage, including its use in promotional materials and tenders. Furthermore, the image continued to appear even after her employment with the Respondent was terminated, without a lawful basis. The use of her image, she argued, caused her emotional distress and exposed her to reputational harm. The Complainant sought remedies including a finding that the Respondent unlawfully appropriated her data without consent, unlawfully derived commercial gain from the use of her images, and continued the use of her images despite the demand to cease, thereby aggravating the breach of her rights.

Acceler Global Logistics submitted its response on 19th May 2025. The Respondent averred that the Complainant initially consented to the use of her image during her employment. They claimed that they did not use the image for any commercial or promotional purposes. According to the Respondent, the image remained on its internal Track and Trace platform, but it was translucent and unidentifiable. They asserted that the image was never visible to the general public, only to internal users and existing customers. The Respondent suggested that the prolonged display of the image was due to inadvertent oversight, and not malice or willful neglect. They also claimed that the Complainant only raised the issue again after the termination of her employment. The Respondent noted that they removed the image immediately upon receiving a letter from the Complainant’s Advocate in July 2024 and offered an apology. Finally, they stated that the image had no commercial value in their line of business.

The ODPC reviewed the evidence and the claims, focusing on whether a violation of the Complainant’s rights occurred and whether the Respondent lawfully processed her personal data.

Regarding the right to object, the ODPC found that the Complainant had clearly exercised her right to object to the processing of her data by writing a letter dated 1st November 2021 to her employer. The Respondent was legally obligated to honor this request to cease processing her personal data but disregarded this objection and continued to display her image on the Track and Trace platform. The continued display of the Complainant's image, despite her clear objections, constituted a direct violation of the Complainant's right to object under Section 26(c) of the Act. The Office noted that the Respondent only removed the image upon receiving a letter from the Complainant's Advocate in July 2024.

Concerning the lawfulness of processing, the ODPC found that the Respondent failed to demonstrate they had consent to process the Complainant's personal data. The burden of proof for establishing a data subject's consent lies with the data controller. The Respondent also failed to get the requisite consent to process the Complainant's personal data and therefore did not lawfully process it. The Office concluded that the Respondent was required to obtain explicit consent from the Complainant prior to using her personal data for purposes beyond those originally stated at the time of collection or provide an alternative lawful basis under Section 30. The ODPC determined that the Respondent unlawfully processed the Complainant's personal data.

• Evaluation of Applicable Laws

Holding

The Data Commissioner made a final determination based on the findings:

1. The Respondent, Acceler Global Logistics, was hereby found liable.
2. The Respondent was ordered to pay the Complainant a sum of Kenya Shillings Two Hundred and Fifty Thousand (Kshs. 250,000) as compensation for the infringement of her rights under the Act. This amount took into consideration that the Complainant's right to object to processing under Section 26(c) was infringed upon and that the Respondent eventually deleted the partial image from its internal system.