BARBRA NJIRIRI VERSUS KEPTIS SYSTEMS
1. Introduction
The case is in respect to the complainant, Barbra Njiriri against Keptis Systems, on the posting of a video of her on its TikTok social media platform without her consent and the refusal to pull down the said post despite being requested to do so. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant alleged that the Respondent posted a TikTok video featuring her on 16th November 2023 without her consent, refused to pull down the said post despite being requested to do so on call and via WhatsApp message, and failed to respond to her request for deletion within the 14 days prescribed by law.
3. Analysis of Evidence
Complainant’s Position
- Provided a link to the video posted on the Respondent’s TikTok page as evidence
- Produced a screenshot of WhatsApp messages with the Respondent requesting deletion of the video
- Stated that she requested the Respondent to delete the video on call and via WhatsApp message
Respondent’s Defense
- The Respondent was non-responsive and did not respond to the notification of complaint filed against it
- Regulation 11(2) of the Enforcement Regulations provides that where a respondent does not take any action, the Data Commissioner shall proceed to determine the complaint
- As at 21st March 2024, investigations revealed that the video was still available and accessible at the Respondent’s TikTok page
- As at the date of this determination, the video had been deleted and was no longer available
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent posted a TikTok video featuring the Complainant on 16th November 2023 without her consent.
- The Respondent refused to pull down the post despite being requested to do so via call and WhatsApp message.
- The Respondent failed to respond to the complaint or cooperate with this Office.
- The Respondent is liable for infringement of the Complainant’s rights under the Act.
Orders:
- An Enforcement Notice is issued against the Respondent.
- The Respondent is directed to put in place clear consent mechanisms and seek prior consent before publishing data subjects’ images on social media.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Right of Erasure
- Reinforces the obligation of data controllers to inform data subjects of the use of their personal data
- Establishes that failure to act on erasure requests constitutes a violation of the right of erasure
Consequences of Non-Response
- Demonstrates that failure to respond to ODPC notifications results in default judgment
- Non-cooperation with the ODPC does not shield respondents from liability
Data Protection by Design and Default
- Requires organizations to embed data protection principles into their operations
- Clear consent mechanisms must be implemented before collecting or using personal data
Broader Impact: This determination addresses a growing challenge across Africa’s digital ecosystem, where businesses post customer or employee images on social media without consent and ignore deletion requests. It establishes that organizations cannot ignore data subject rights and must act promptly on erasure requests, setting a standard for social media content practices across the continent.