Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Stephen Kipchumba Kiptiness alleged Neqtar Medical Ltd. used his image for commercial gain on brochures without his express consent. Despite notifications, the Respondent failed to provide a response. The ODPC found Neqtar Medical Ltd. did not obtain the requisite consent for commercial use, making them liable and entitling the Complainant to remedies in the sum of KES.500,000/-.

Facts

The applicant's core complaint revolved around the unauthorised use of his personal data for commercial purposes. Stephen Kipchumba Kiptiness alleged that Neqtar Medical Ltd. (the Respondent) had been using his image for commercial gain on its brochures without his express consent. He further contended that the Respondent, after approaching him for legal professional services, publicised that he and his law firm were their legal partners.

This publication, which he stated contained his name and photo, was done without his authority or consent and had commercially benefited the Respondent, helping them establish their business in Kenya. To support his claim, the Complainant provided a copy of the Respondent's brochure showing his name, photo, and description, as well as an email confirmation from the Respondent acknowledging the use of details and display in their portfolio without seeking consent.

Neqtar Medical Ltd. failed to provide any response or evidence to the allegations despite receiving notifications of the reinstituted complaint and numerous reminders/follow-ups from the Office of the Data Protection Commissioner (ODPC). Consequently, the allegations levelled against them by the Complainant remained uncontroverted. The ODPC had specifically asked the Respondent to provide, among other things, a response to the allegations, their lawful basis for processing the Complainant's data, how the image was obtained, and evidence of the Complainant's consent for commercial use.

The Office of the Data Protection Commissioner (ODPC) found that the Respondent did not obtain the requisite consent as mandated by the Data Protection Act, 2019, to use the Complainant's personal data for commercial purposes.

The key aspects supporting this holding include:

• The Respondent used the Complainant's name and image in its brochures to advertise and market its facilities and services, thereby advancing its commercial and economic interests.
• The Respondent's failed to respond to the allegations or provide any evidence, which meant the Complainant's claims remained uncontroverted.
• Evaluation of Applicable Laws

Holding

The Data Commissioner made the following final determination;