MERCY WAMBUA & MINORS vs. BOLD DECISIVE DIGITAL LAB & EQUITY AFIA
1. Introduction
Mercy Wambua and her two minor children allege that Bold Decisive Digital Lab used their photo for marketing purposes in a proposal to Equity Afia without their knowledge or consent, violating the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The 1st Respondent used a photo of the 1st Complainant and her two minor children in a pamphlet bearing the 2nd Respondent’s company logo without consent. The pamphlet was acquired at one of the 2nd Respondent’s branches and appeared to be a marketing proposal. The 1st Complainant had posted the photo on her social media page but never consented to its use for marketing or advertisement purposes, and the 1st Respondent failed to respond when she reached out upon learning of the use.
3. Analysis of Evidence
Complainant’s Position
- Adduced printed screenshots of the pamphlets/brochures in question
- Provided birth certificates of the minor children (2nd and 3rd Complainants)
- Demonstrated that she had no contractual or consent-based relationship with either Respondent
- Stated that while she posts pictures on social media, this should not constitute an invitation for commercial use
Respondents’ Defense
1st Respondent (Bold Decisive Digital Lab):
- Argued that the document was a “proposal document” to Equity Afia, not a marketing brochure
- Claimed the proposal was internal, confidential, and meant solely for a private pitch to Equity Afia
- Stated only two copies were delivered to Equity Afia’s head office, not to any public facility
- Contended that it is not its policy to use photos publicly without consent and that no commercial benefit was derived as the proposal was never adopted
- Asserted the photo was publicly available on the 1st Complainant’s social media page
2nd Respondent (Equity Afia):
- Denied any formal or informal engagement with the 1st Respondent
- Stated that while a meeting was held, it was made clear that it would not engage the 1st Respondent
- Affirmed it was never formally engaged as a vendor and therefore had no partnership with the 1st Respondent
4. Issues for Determination
- Whether the Complainants’ claim on infringement of their right to privacy by the Respondents has merit according to the Act
- Whether the Respondents in their actions or otherwise caused a personal data breach against the Complainants
- Whether the Complainants are entitled to the remedies sought for the alleged breach
5. Final Determination
The Data Commissioner found:
- The 1st Respondent collected and processed the Complainants’ personal data without consent despite claiming the photo was publicly available.
- The 1st Respondent failed to discharge its burden under Section 32 to prove consent for processing.
- The complaint against the 2nd Respondent was dismissed as there was no contractual relationship.
Orders:
-
Compensation of:
- 1st Complainant (Mercy Wambua): KES 500,000.00
- 2nd Complainant (Minor – N.R): KES 700,000.00
- 3rd Complainant (Minor – K.W): KES 700,000.00
- The 2nd Respondent dismissed as there was no contractual relationship.
- Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.
6. Significance and Impact
Minors’ Data Protection
- Reinforces the stringent requirements under Section 33 for processing children’s data, requiring parental consent and protection of the child’s best interests
- Sets a high bar for compensatory damages for minors (KES 700,000 each) reflecting the heightened sensitivity of children’s data
Marketing Agency Accountability
- Holds marketing agencies accountable as data controllers even when using data for “confidential proposals” or pitches
- Establishes that internal documents with no public distribution still require consent if they involve processing of personal data
Vicarious Liability and Partnerships
- Clarifies that liability attaches only where there is a direct legal relationship with the data subject
- Organizations receiving unsolicited marketing proposals are not liable where no formal engagement or partnership exists
Broader Impact: This determination warns marketing agencies that using publicly available images for commercial pitches requires explicit consent, especially when minors are involved. It reinforces that “confidentiality” does not exempt data protection obligations and the burden of proof lies with the data controller.