| Authority: | ODPC - Kenya |
|---|---|
| Jurisdiction: | Kenya |
| Relevant law: | Section 26(a)(c), 32 36, 40(1)(b)of the Data Protection Act, 2019; Article 8(1), 14(1)(2)(3)(e) of the Data Protection (General) Regulations, 2021 |
| Type: | Complaint |
| Outcome: | Violation |
| Started: | 2 January 2024 |
| Decided: | 28 March 2024 |
| Published: | Yes |
| Fine: | KES.750,000/- |
| Parties: | Anne Wanjiru Irungu vs. Lintons Academy |
| Case No.: | 0010 of 2024 |
| Appeal: | N/A |
| Original Source: | ODPC |
| Original contributor: | MZIZI Africa |
Linton's Academy violated the Complainant's right to privacy and the Data Protection Act of 2019 by using her images for commercial purposes without her consent. Additionally, the college failed to remove all the offending images from their social media pages, thereby infringing on her right to object to the processing of her personal data.
Anne W. Irungu (the “Complainant”) alleged that Lintons College (the “Respondent”) used her image to promote their college without her consent.
The Respondent, a beauty college that trains professionals and creative artists, averrwd that in an effort to promote its courses they invested in promotional material that contained imagery. They averred that they sourced images from stock websites specifically Pexels who offered the images on a commercial basis through subscriptions.
They further averred that they were not responsible for sourcing the images as this role was by Pexel and could not have known that the Complainant’s consent was not provided prior to the images being made available. They averred that they purchased full commercial rights from Pexel as per their terms of service.
Notwithstanding the above, the Respondent also averred that they immediately removed the offending images from their web assets when first contacted by the Complainant, but that two images remained on their social media pages due to a mistake made by a new member of staff.
The ODPC reviewed the terms of service by Pexel limited their liability as regards IP rights noting that the site notified users of the need to anticipate and review additional IP rights emanating from image owners, and to resolve the same.
The ODPC also found that while some offending images were removed within a day of the Complainant alerting the Respondent of them, other images posted about a month before the initial complaint was filed, were still available on the site 2 weeks and 1 month after the complaint was filed with the ODPC.
The ODPC found that the Complainant was never informed of the use of her image by the Respondent and her right to object to that use was also also violated by the Respondent contrary to the requirements of the Data Protection Act, 2019 (DPA,19). The consent of the Complainant was also not obtained bybthe Respondent prior to the commercial use of her images.
The ODPC held that: