Authority: ODPC - Kenya
Jurisdiction: Kenya
Relevant law: Section 25, 26, 40(1)(b) of the Data Protection Act, 2019; Article 31 of the Constitution of Kenya
Type: Complaint
Outcome: No violation
Started: 14 February 2024
Decided: 13 May 2024
Published: Yes
Fine: N/A
Parties: Dennis Gitonga Ndururi vs. Twiga Foods Ltd
Case No.: 289 of 2024
Appeal: Dennis Gitonga Ndururi vs. Office of the Data Protection Commissioner & 2 others; Office of the Attorney General & 3 others (Interested Parties) (Petition E193 of 2024) [2025] KEELRC 822 (KLR)
Original Source: ODPC
Original contributor: MZIZI Africa

Contents

  1. Summary
    1. Facts
    2. Holding
  2. Comment
  3. Further resources
  4. The Decision

Summary

Twiga Foods Limited (the “Respondent”) was found not to have violated the provisions of the DPA19 related to the erasure of the Complainant's image for commercial benefit without his approval. It was established that the Complainant did not provide the Respondent an opportunity to address the erasure request. Additionally, the Respondent promptly removed the offending image from publication without undue delay once notified of the complaint by the ODPC.

Facts

Dennis Gitinga Ndururi (the “Complainant”) filed a complaint against Twiga Foods Limited (the “Respondent”) in which he alleged that the Respondent used his image for commercial purposes, and in so doing obtained a commercial benefit on a world-wide scale and for profit, without his consent.

According to the complaint, the Respondent entered into a research agreement with a third party organisation (IBM) concerning a retail finance system to be piloted at the Respondent organisation and whose results would be published in multiple journals.

To this end, various information was shared to include images of the Complainant in the course of his employment. The images were subsequently published online in multiple journals accessible to the public and was thereby cited in many articles. He alleges that he did not consent to his images being used in this manner or at all.

The Respondent confirmed the arrangement with IBM and the publication of the research journal and also alleged that they only became aware of the dispute when the ODPC contacted them regarding the complaint. They averred that this complaint robbed them of an opportunity to resolve the issue with the Respondent. The Respondent confirmed that they had taken down the photo as a result of the complaint and averred that the actions complained of preceded the DPA,19.

The ODPC found that there was no evidence of service of a complaint to the Respondent upon which they would act. The Respondent swiftly resolved the complaint once notified of it by the ODPC thereby upholding the Respondent's right of erasure and resolving the Complaint.

Holding

The ODPC held that:

Comment

The full text of the ruling is available below.

<aside> <img src="/icons/gavel_red.svg" alt="/icons/gavel_red.svg" width="40px" />

Link to the Appeal/Related Case | Dennis Gitonga Ndururi vs. Office of the Data Protection Commissioner & 2 others; Office of the Attorney General & 3 others (Interested Parties) (Petition E193 of 2024) [2025] KEELRC 822 (KLR)

</aside>