Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Club Legend (”the Respondent”), an entertainment club, was found to have violated the Complainant privacy and the data protection laws when it used the complainant's personal data, specifically her image, for commercial purposes without her express consent.

Facts

The Complainant was a customer at an entertainment club in Ongata Rongai.

The Respondent, the entertainment club, allegedly used the complainant's personal data, specifically her image, for commercial purposes without her express consent.

The Complainant requested the Respondent to delete her images from their social media page, but the Respondent allegedly ignored this request.

The Complainant sought remedies, including compensation, for the violation of her rights.

The Respondent was notified of the complaint and was required to provide a response, relevant materials or evidence, and details of how it collected, stored, and processed the Complainant's data.

The Respondent failed to respond to the allegations and reminders despite being aware of the complaint.

The Office found that the Respondent did not obtain the requisite consent from the Complainant for the commercial use of her personal data, thus violating her rights under the data protection regulations.

Additionally, the Respondent failed to pull down the complainant's image despite her request, thus disregarding her right to withdraw consent. The ODPC also noted that the Respondent did not demonstrate a level of compliance with the requirements under the Act and the Regulations.

Holding

The ODPC held that:

• the Respondent violated the complainant's rights under Sections 32(2) and 40(1)(b) of the Data Protection Act, 2019, as well as Regulation 12(1)(b) of the General Regulations.