Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

The case of Muthoni v Solpia Kenya involved Hellen Muthoni suing Solpia Kenya for unauthorised commercial use of her public Instagram photo, violating her privacy and data protection rights. Solpia claimed it was mere admiration, not commercial, and her public post implied consent. The High Court found Solpia breached data protection by commercial use without consent, upholding the Kshs. 500,000.00 compensation.

Facts

The appellant, Hellen Muthoni, describes herself as an established and renowned television host, gospel artist, youth mentor, public figure, entrepreneur, and media personality at Inooro TV, where she hosts the Sunday show "Rurumuka". She stated that her image has been used to commercially market and advertise products on her social media pages, subject to mutually agreed terms, leveraging her significant following of 406,000 on Facebook, 17,000 on Twitter, and 153,000 on Instagram.

In October 2020, after a salon appointment, she took a photo of her hairstyle and posted it on her Instagram (@hellen_msoo) and Facebook (Hellen Muthoni Kenya) accounts with a spiritual caption. Four days later, on 6th October 2020, she discovered the same image on the respondent’s Facebook (Sistar Kenya) and Instagram (@sistarkenya) accounts, accompanied by a post promoting "Crochet braid" and referring to her as "hair inspiration".

The appellant contended that this publication was unauthorised and violated section 37 of the Data Protection Act and Part III of the Data Protection (General) Regulations 2021, breaching her fundamental right to privacy guaranteed in Article 31 of the Constitution. She argued that the respondent gained financially and commercially by using her image as an endorsement. This alleged breach placed her employment in jeopardy due to advertisement guidelines and caused her mental and psychological distress.

Following a High Court directive, she lodged a complaint with the Data Protection Commissioner seeking compensation for violation of privacy, loss of control over data, financial gain loss, anxiety, stress, emotional and psychological distress, and sanctions against the respondent. She later argued the compensation awarded by the Commissioner was inordinately low and that the respondent unlawfully processed and controlled her data. She prayed for the High Court to re-assess the damages and award Kshs. 5,000,000.00.

<aside> ➡️

Link to the Original Determination | Hellen Muthoni vs. Solpia Kenya Ltd (t/a Sistar Kenya) - ODPC Complaint No. 1963 of 2023

Link to the Constituional Reference | Muthoni v Solpia Kenya Limited t/a Sista Kenya (Constitutional Petition E457 of 2021) [2023] KEHC 22373 (KLR) (Constitutional and Human Rights)

</aside>

Initially, the respondent (Solpia Kenya Limited t/a Sista Kenya) argued that it did not post the image, did not access the appellant's image, and did not advertise as alleged. In the alternative, it stated that the appellant was styled by John Mwangi using the respondent’s products, and the appellant posted her photo, tagging the stylist, @dghniehairarts. The respondent claimed the appellant's social media handles are public, and the stylist tagged the respondent, who then "reposted that post with the following comment" which it described as a "general admiration of the artist’s representation of art".

The respondent maintained the repost was not an advertisement for its products, was in compliance with social media practice guidelines, was harmless, lawful, and did not breach any of the appellant’s rights. It argued that the appellant actually "garnered more following on account of the respondent’s actions". The respondent claimed it was neither the data controller nor the data processor and therefore not in breach of sections 25, 26, and 29 of the Data Protection Act. It also highlighted that it unfollowed the appellant after legal proceedings began.

On appeal, the respondent asserted that the appellant’s right to data privacy under Article 31 was not infringed because she posted the photo publicly, making it accessible to any social media user. It contended that the Data Protection Act was inapplicable to social media posts involving liking, commenting, and reposting. The respondent argued that the appellant, being a public figure using her account for engagement, granted permission for users to engage with her posts, including reposting. It suggested that if the appellant wanted privacy, she should have privatized her account, making her "the author of her misfortune".

Regarding damages, the respondent claimed the appellant failed to prove commercial benefit to the respondent and that privacy rights do not exist for social media accounts used for business purposes. It urged the court to apply a three-pronged test: use of a protected attribute, for an exploitative purpose (commercial or otherwise), and absence of consent. The respondent also mentioned a separate marketing campaign (#sww9seekenya) as the source of its business growth, not the appellant's photograph. It argued the Data Commissioner awarded damages without justification and that the appellant's actions amounted to "constructive consent". Finally, it claimed it was denied a fair hearing by the Data Protection Commissioner due to lack of service of pleadings and notification of hearing, and that no investigations were carried out as per section 57 of the Act.

The High Court, presided over by RC Rutto, J, consolidated the appeals and cross-appeals.