Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Christina Buliba (the Complainant) alleged that Dhaabu Kenya (the Respondent), a tailor, used her images on social media without her consent. The Complainant had contracted the Respondent to make a dress for her and, during a dress-fitting, the Respondent recorded a video of her trying on the dress with her consent, on the understanding that it would be shared only with her. However, the Respondent posted the video to its Instagram and TikTok accounts, where it was seen by the Complainant's acquaintances.

Facts

This case involves a dispute between Christina Buliba (the Complainant) and Dhaabu Kenya (the Respondent) regarding the Respondent's use of the Complainant's images on social media without her consent.

The Complainant filed a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, alleging violations of the Data Protection Act of 2019. Here is a summary of what transpired:

The Complainant hired the Respondent, a tailor, to make a dress for her traditional introduction ceremony.

During a dress fitting, the Respondent requested to film the Complainant trying on the dress, promising to share the video with her. The Complainant consented.

However, the Respondent later posted the video on their Instagram and TikTok accounts without the Complainant's knowledge or consent. The videos garnered thousands of views and featured links to the Respondent's business pages.

The Complainant became aware of the videos through acquaintances and found them circulating on social media. On October 4, 2023, she contacted the Respondent via WhatsApp expressing her grievance and requesting the removal of the videos. Her message was read but ignored. Unsatisfied with the lack of response, the Complainant filed a formal complaint with the ODPC on December 18, 2023.

The Respondent argued that the Complainant consented to both the filming of the video and its subsequent sharing on social media. The Respondent acknowledged that a video of the Complainant was recorded at its premises. It asserts that the Complainant understood, and consent was given to film the video.

The Respondent stated that it was usual business practice to share videos of clients on social media to show appreciation. It argued that sharing such videos was part of its ongoing practice of appreciating its clients. Therefore, it believed that consent was implied for both the recording and sharing of the video.

However, the Respondent did not provide evidence to support its claim that the Complainant consented to the video being shared on social media. The ODPC found that the Respondent had simply assumed the Complainant understood the video would be shared.

The ODPC investigated the matter and determined that the Respondent had indeed violated several articles of the Data Protection Act, including the Complainant's right to be informed, her right to object, the Respondent's obligation to notify, and the requirement for valid consent before using personal data for commercial purposes. Details:

• Article 26 (Right to be informed): The Respondent did not inform the Complainant that her video would be posted on social media.