E.K.M. vs. BVB LOUNGE MERU
1. Introduction
The case is in respect to the complainant, E.K.M. against BVB Lounge Meru, on the use of his image for commercial purposes on its social media pages without his consent. This action contravenes the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant attended the Respondent’s premises and the Respondent posted his images on its Facebook and Instagram pages with the aim of deriving monetary benefit. The complainant alleged that the Respondent uploaded and posted his images on its social media platforms without his consent, ignored his demand letter seeking removal of his images, and only removed the image from Instagram but left the image on Facebook.
3. Analysis of Evidence
Complainant’s Position
- Attended the Respondent’s premises on 2nd December 2023
- On the same date, the Respondent posted his images on its social media platforms
- Provided screenshots from the Respondent’s social media pages as proof
- Issued a demand letter on 13th December 2023 which yielded no results
- Stated that his clientele is being diverted, directly affecting his livelihood
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the notification of complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- As at the time of lodging the complaint, the images were still available on both Facebook and Instagram
- After notification, the image on Instagram was pulled down, but the image on Facebook remained available as of the date of determination
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent posted the Complainant’s images on its social media platforms for commercial purposes without his consent.
- The Respondent ignored the Complainant’s demand letter and only partially removed the images after notification.
- The Respondent is liable for infringement of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 800,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right of Erasure
- Reinforces the obligation of data controllers to act without undue delay when a data subject requests erasure
- Failure to act on erasure requests constitutes a violation of the right of erasure
Commercial Use of Customer Images
- Establishes that using customer images for promotional purposes on social media constitutes commercial use
- Businesses must obtain express consent before using customer images for marketing
Corporate Accountability and Duty to Respond
- Establishes that ignoring ODPC notifications and demand letters does not shield data controllers from liability
- Non-responsive data controllers face default judgments and heightened enforcement measures
Broader Impact: Across Africa, businesses in the hospitality and entertainment sector routinely use customer images on social media without obtaining consent. This determination establishes that such practices constitute unlawful commercial exploitation of personal data. As more African countries enact data protection laws, businesses must adopt clear consent mechanisms before using customer images for promotional purposes.