| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Legal Provisions Reviewed |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 14 Septemebr 2024 |
| Decided: | 13 December 2024 |
| Published: | Yes |
| Fine: | KES.1,000,000 |
| Parties: | Daniel Odhiambo Opiyo & Anor vs. Tulia Amboseli Safari Camp Ltd |
| Case No.: | 1398 of 2024 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
The Complainants claimed that Tulia Amboseli Safari Camp Limited unlawfully used their images commercially to advertise hospitality services without consent. The ODPC found the company, having acquired the entity that originally held the images, unlawfully processed personal data for commercial purposes. Tulia Amboseli was ordered to compensate the Complainants KES 1,000,000 for this unlawful use.
The Complainants, Daniel Odhiambo Opiyo and Jeremiah Barasa, claimed that the Respondent, Tulia Amboseli Safari Camp Limited, took their images without their authority and approval and published them on its website, presenting the images as an advertisement for bush breakfast. They contended that the images suggested they were working for Tulia Amboseli Safari Camp Ltd to deliver bush breakfast, despite the fact that they never worked for that entity. The Complainants stated that at the time the images were taken, they were working for Airborne African Antiques Ltd, which was a different entity from Tulia Amboseli Safari Camp Ltd, and were involved in the hot air balloon industry. They adduced a demand letter addressed to the Respondent and the Respondent's website pages containing their images as evidence.
The Respondent provided a response to the complaint on 11th October 2024. The Respondent stated that the Complainants had admitted they were employees of Airborne African Antics Limited (AAAL) and that the impugned photograph was taken by their employer and had been uploaded to AAAL's website. The Respondent further stated that Tulia Amboseli Safari Camp Ltd acquired AAAL in 2018 and at the time of the said acquisition, the image had been on the Company's website with the approval of the Complainants. They claimed they have not used the said image for commercial purposes and neither have they generated any commercial benefit from the said image. The Respondent also mentioned receiving demand letters and responding to them, pulling down the image, and proposing alternative dispute resolution.
The Office of the Data Protection Commissioner (ODPC) analysed the complaint, the response, and conducted investigations. The ODPC noted the Complainants' challenge that the Respondent's use of their images for advertisement without authority constituted processing personal data, which identified the Complainants and made them publicly available. The ODPC found that the Respondent did not dispute that the Complainants' photographs were on their website even after acquiring the business from Airborne African Antics Limited (AAAL). The ODPC determined that upon acquiring AAAL, the Respondent became the data controller to the extent that they determined the purpose and means of processing the Complainants' personal data on their website. The ODPC found that using personal data for commercial purposes requires express consent according to Section 37(1) of the Data Protection Act. Regulation 14 of the Data Protection (General) Regulations 2021 clarifies that commercial use includes inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction. The ODPC found that the Respondent showing bush breakfast and advancing its commercial interests by inducing the public to experience and enjoy bush breakfast hospitality, influencing commercial transactions, amounted to commercial use. The ODPC noted that the Respondent's claim that the image was on their website with the Complainants' approval was not supported by proof, and Section 32(1) of the Act places the burden of proof on the data controller or data processor regarding consent. The ODPC therefore found that the Respondent unlawfully processed the Complainants' personal data for commercial purposes without express consent. The ODPC also considered the Complainants were entitled to a remedy.
The Data Commissioner made the following final determination:
The full text of the ruling is available below.
Share blogs or news articles here!