Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Joe Kiranya filed a complaint against Black and Gold Executive Barbershop for using his image in online and printed advertisements without consent. Despite a formal request to remove the image, the business failed to act. The ODPC ruled in his favor and awarded him KES 250,000 as compensation.

Facts

Joe Kiranya, the complainant, alleged that Black and Gold Executive Barbershop used his image on their social media pages and printed placards for advertising purposes without his consent. Despite sending a formal demand letter to the barbershop, requesting the removal of the image, the respondent failed to comply.

The respondent, Black and Gold Executive Barbershop, did not respond to the complaint or provide any justification for using Mr. Kiranya’s image. Additionally, they did not offer any evidence of consent from the complainant or any legal basis for processing his personal data.

The ODPC found that the complainant's rights were infringed under Section 26(c) of the Data Protection Act, which grants data subjects the right to object to the processing of their personal data. The respondent’s failure to act upon the request for removal of the complainant’s image from their platforms and their lack of response to the complaint violated these rights.

Evaluation of Applicable Laws

• Section 26(c) of the Act, which provides that a data subject has the right to object to the processing of their personal data.
• Section 36 of the Act, which provides that a data subject may request a data controller or processor not to process all or part of their personal data unless the controller demonstrates a compelling legitimate interest.
• Regulation 8(1) of the General Regulations, which provides that, pursuant to Section 36, a data controller or processor must comply with a data subject’s objection request within fourteen days without charge.
• Section 65 of the Act, which provides that a person who suffers damage from a contravention of the Act is entitled to compensation for financial or non-financial loss.
• Regulation 14(3)(e) of the Enforcement Regulations, which provides that the Data Commissioner may order a data controller to pay compensation to a data subject.

Holding

The ODPC: