| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 25(4), 26, 30, 32, 40, 65, of the Data Protection Act, 2019; Article 22 (1) (b) of the DataProtection (General) Regulations, 2021; Article 31 of the Constitution of Kenya |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 7 November 2023 |
| Decided: | 2 February 2024 |
| Published: | Yes |
| Fine: | KES.50,000/- (KES.25,000/- each) |
| Parties: | Grace Mwende Chambi vs. Cecelia Munyoro (t/a Glam By Cess) & Anor |
| Case No.: | 2295 of 2023 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Cecelia Munyoro, trading as Glam By Cess, and John Irungu, trading as Veejay Studios, were found liable for violating the privacy rights of the Complainant and the provisions of the Data Protection Act and ordered to compensate the Complainant KES 50,000/-, for failing to delete images of the Complainant and her children from their social media page despite requests to do so.
Grace Mwende Chambi (the “Complainant”) attended the studios of the Respondents, the proprietors of a photography studio, and took portraits of herself and her children.
The Complainant alleges that the Respondents subsequently uploaded the images onto its social media pages to promote its business.
She later contacted the Respondents and requested them to pull down the images as she was receiving unwanted attention from the public, but the Respondents did not accede to her request and the images remained on their site to her dismay.
She avers that she sent a total of 4 requests including one from her Advocates, but all the demands did not elicit a favourable responce from the Rspondents. The Complainant therefore filed a Complaint with the ODPC.
The Respondents confirmed that the Complainant was a former customer who had taken photographs in their studio. They however averred that the Complainant agreed to have her photos posted on the firms social media pages.
The Respondents further averred that the Complainant later revoked that consent and they immediately took steps to remove the offending photographs from their pages which resolved the matter and requested that the matter be dismissed.
The ODPC found that requests to remove the photographs was made by the Complainant on 28 August 2023, 3rd, September 2023, 7 September 2023 and 20 September 2023.
The Respondents did not act on the requests until the ODPC contacted them on 6 December 2023, which meant that they violated the requirements of the Data Protection Act by refusing or failing or neglecting to act on deletion requests without undue delay as required.
The ODPC held that: