CHRISTINA BULIBA vs. DHAHABU KENYA
1. Introduction
Christina Buliba complains that Dhahabu Kenya recorded a video of her during a dress-fitting session for her traditional introduction ceremony and posted it on its Instagram and TikTok pages without her consent, violating the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant alleged that the Respondent recorded a video of her during a dress-fitting session for her traditional introduction ceremony without obtaining her consent to share it publicly, posted the video on its Instagram and TikTok pages where it was played over 7,000 times, failed to respond to her complaint when she raised it, and continued to use her image to market its business without her consent.
3. Analysis of Evidence
Complainant’s Position
- Provided links of the videos and images posted on the Respondent’s Instagram and TikTok pages
- Provided screenshots of WhatsApp conversations showing she informed the Respondent she did not consent to the videos being shared
- Stated that she received messages from colleagues and people who follow her on social media about the video circulating
- Stated that the Respondent requested to take the video and promised to share it with her, but never did
Respondent’s Defense
- Acknowledged that a video of the Complainant was recorded at its premises during the outfit fitting
- Claimed that consent was obtained to film the video and that it believed the Complainant understood it would be shared on social media as part of its practice of appreciating clients
- Stated that it took care not to identify the Complainant directly, using a pseudonym and not tagging any of her accounts
- Confirmed that it received the Complainant’s complaint on 4th October 2023 at 1734hrs and responded at 1902hrs offering to remove the posts
- Rendered an apology via letter dated 17th January 2024 and indicated it had deleted the posts from all its social media platforms
4. Issues for Determination
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent did not inform the Complainant that her video would be posted on its social media pages.
- The Complainant objected to the processing, but the Respondent only pulled down the videos after a complaint was filed.
- The Respondent did not prove that it obtained consent to post the image on social media for commercial purposes.
- The Respondent used the Complainant’s personal data for commercial purposes without obtaining express consent.
Orders:
- Compensation of Ksh 25,000 to the Complainant.
- The Respondent is directed to adhere to data protection principles and implement measures in line with data protection by design and by default.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Consent for Commercial Use
- Clarifies that consent must be specific, informed, and unequivocal
- Assumptions about consent do not satisfy the legal requirements under the Act
Right to be Informed and Right to Object
- Reinforces the obligation to inform data subjects of the use of their personal data
- Establishes that data controllers must act without undue delay when a data subject objects to processing
Purpose Limitation and Commercial Use
- Data collected for one purpose (sharing with the client) cannot be repurposed for commercial marketing without fresh consent
Broader Impact: This determination addresses the common practice of businesses recording and sharing customer images for marketing without explicit consent. Businesses cannot assume consent and must obtain specific, informed consent for each purpose. This sets a critical standard for service providers across Africa.