CHARLES CHARAGU KINYUA VERSUS CALLTRONIX KENYA LIMITED
1. Introduction
The dispute in this matter arises from Charles Charagu Kinyua’s complaint against Calltronix Kenya Limited on the use of his image on Instagram for marketing purposes without his consent, despite having submitted it for internal Intranet use. This action is in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant submitted his photo during employment onboarding for the specific purpose of creating an official staff profile on the Intranet. The Respondent subsequently used his image on its Instagram page on two separate occasions (2nd August 2024 and 2nd September 2024) to advertise, market, and promote its services without his consent, and he became aware of the use on 23rd September 2024 after receiving threatening messages on X (formerly Twitter).
3. Analysis of Evidence
Complainant’s Position
- Submitted his photo together with other documents during employment onboarding for the Intranet profile
- Became aware of the Instagram posts on 23rd September 2024
- The unauthorized use has contributed to harassment he has experienced on X
- Attached two screenshots of the Respondent’s Instagram page showing the two posts
Respondent’s Defense
- Stated it takes data protection and employee privacy seriously
- Claimed staff have signed photography consent forms
- The image was promptly removed following the Complainant’s initial concern
- Enclosed a copy of the company’s disclaimer notice
4. Issues for Determination
- Whether the Respondent fulfilled its obligations under the Act
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent repurposed the Complainant’s image from internal use to social media marketing without his consent.
- General disclaimers do not constitute valid consent under the Act.
- The Respondent failed to obtain express consent for commercial use of the Complainant’s image.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 450,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Purpose Limitation in Employment
- Clarifies that images collected for internal use (Intranet) cannot be repurposed for social media marketing
- Employers must respect the purpose limitation principle under Section 25(c)
Employer-Employee Data Use
- Reinforces that employment does not grant automatic consent for use of employee images for commercial purposes
- Employers must obtain express consent for each purpose
Broader Impact: This determination establishes that general disclaimers and photography consent forms do not constitute valid consent for repurposing employee images for commercial use. Employers across Africa must obtain express, specific consent for each distinct use of employee personal data.