Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

A former employee complained that Platinum Credit used her image without consent for a campaign. The company admitted inadvertent internal use, not commercial marketing. The Data Protection Commissioner found consent wasn't obtained, but the internal use didn't meet the commercial threshold. As the company deleted the image and added consent forms, the complaint was dismissed.

Facts

The case was initiated by the Complainant, Robinah Nyambusi, who lodged a complaint with the Office of the Data Protection Commissioner (ODPC) on 19th November 2023. Her complaint alleged that the Respondent, Platinum Credit Limited, was using her image without her consent to market its products in a campaign dubbed 'Sukuma Wiki February 2023'. She stated this use was a breach of her privacy as her photo had been circulated on the company's intranet. The Complainant, a former sales officer, highlighted that she had left the company in October 2022, yet her image was used for a campaign in March 2023. She requested compensation and that her photo be removed from the Respondent's database.

The Respondent, Platinum Credit Limited, responded by confirming that the Complainant was their former employee who exited in October 2022. They admitted that the Complainant's image was taken during her employment and subsequently used inadvertently in their internal communication to their sales officers. However, the Respondent maintained that the image had never been used for marketing and/or commercial purposes and they had not derived any commercial value from the intranet communication. As mitigation, they stated they had permanently deleted her image from their database and introduced a Media Consent & Release Form for staff to give and withdraw consent, providing the form as proof.

The ODPC's findings noted that it was undisputed the Respondent used the Complainant's image in its internal marketing campaign flyer. The key issues for determination were whether prior consent was obtained and whether the Complainant's rights were infringed. The ODPC found that the Respondent's own assertions indicated they did not seek the Complainant's express consent when they had the intent of using her image for commercial purposes. There was also no clause in her employment contract permitting commercial use of her image. However, the ODPC took cognizance of the fact that the campaign flyer was only shared internally, as demonstrated by the email addresses it was sent to ([email protected] and [email protected]). The ODPC concluded that the Complainant failed to demonstrate that the marketing campaign posters were shared externally, meaning the use did not meet the commercial purposes threshold as defined under Section 37(1) of the Act. The ODPC also noted the Respondent's action of permanently deleting the image and implementing the consent forms.

Evaluation of Applicable Laws

• Article 31 (c) and (d) of the Constitution of Kenya: This article provides for the right to privacy. The Data Protection Act, 2019 was enacted to further guarantee this right.
• The Data Protection Act, 2019 (hereinafter known as 'the Act'):
  • Section 5 of the Act: This section established the Office of the Data Protection Commissioner.
  • Section 8 (f) of the Act: This section provides that the ODPC can receive and investigate any complaint by any person on infringements of the rights under the Act.
  • Section 25 of the Act: This section sets out the principles that should guide the processing of personal data of a data subject.
  • Section 32(1) of the Act: This section states that the data controller or data processor shall bear the burden of proof for establishing the data subject's consent to the processing of their personal data for a specified purpose.
  • Section 37(1) of the Act: This section states that a person shall not use, for commercial purposes personal data unless they have sought and obtained express consent from a data subject. It also places the burden on the data controller to prove they obtained express consent.
  • Section 56 (1) of the Act: This section provides that a data subject who is aggrieved by a decision of any person under the Act may lodge a complaint with the Data Commissioner in accordance with the Act.
• The Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (the Enforcement Regulations):
  • Regulation 4 of the Enforcement Regulations: The complaint was lodged pursuant to this regulation by the aggrieved data subject.
  • Regulation 11 of the Enforcement Regulations: Pursuant to this regulation, the ODPC notified the Respondent of the complaint filed against it.
  • Regulation 14 of the Enforcement Regulations: This regulation states that the Data Commissioner shall, upon the conclusion of the investigations, make a determination based on the findings. The determination itself is premised on the provisions of this regulation. The ODPC also refers to Regulation 14(2)(e) in directing the Respondent to have employees sign consent forms.

Holding

Based on these findings, the ODPC's final ruling was that the complaint is hereby dismissed. The ODPC also directed the Respondent to ensure all its current employees sign the new Media Consent & Release Form to prevent similar occurrences. The parties retain the right to appeal the determination to the High Court within thirty days.

Comment

The full text of the ruling is available below.