Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

E.K.M. complained BVB Lounge Meru used his image for commercial promotion on social media without consent. The lounge was non-responsive and failed to erase the image from Facebook. The ODPC found BVB Lounge liable for violating data rights. They were issued an Enforcement Notice and ordered to pay KES 800,000 compensation.

Facts

The Complainant, identified as E.K.M., filed a complaint with the Office of the Data Protection Commissioner (ODPC) with the allegation that BVB Lounge Meru (the Respondent) used his image for commercial purposes on its social media pages without his consent.

The Complainant provided Respondent) used his image for commercial purposes on its social media pages without his consent.

The Complainant stated that or about 2nd December 2023, he attended the Respondent’s premises, known as BVB Lounge in Meru County, to have a good time. The Respondent subsequently uploaded and posted his images on its social media platforms, namely Facebook and Instagram, with the aim of deriving monetary benefit from the images. The Complainant provided screenshots of the posts as proof. The Respondent's posts related to its bar and restaurant business and included the Complainant’s image with a caption like, "Drinkcember KickOff... Friday Night Party". The purpose of such posts was to attract revellers, resulting in financial gain for the Respondent. The Complainant attempted to resolve the dispute amicably by sending the Respondent a demand letter dated 13th December 2023, requesting the removal of the images, but his actions yielded no results.

The Complainant stated that he runs a business in Meru County and argued that the continued use of his image diverted his clientele, thereby affecting his livelihood. The remedies sought by the Complainant included:

• An order compelling the Respondent to immediately withdraw all his images from all its social media platforms and records.
• General damages for the breach of his right to privacy.
• Special damages amounting to KES 1,500,000/= for loss of business.

The Respondent, BVB Lounge Meru, was non-responsive and did not reply to the notification of the complaint filed against it. Therefore, pursuant to Regulation 11(2) of the Enforcement Regulations, the Data Commissioner proceeded to determine the complaint based on the available evidence and investigations, as the Respondent did not take any action as contemplated in the notification.

The ODPC conducted investigations, including a site visit, to ascertain whether the subject images were posted on the Respondent's social media pages. The investigation officers found that the Complainant’s images were available and accessible on the Respondent’s Facebook and Instagram social media pages at the time of lodging the complaint.

The ODPC focused on three main issues: whether there was an infringement of the Complainant's rights, whether the Respondent fulfilled its obligations, and whether the Complainant was entitled to remedies.

I. Infringement of Complainant’s Rights (Right of Erasure):