CHRISTINE OCHOLLA VERSUS NATIONAL SOCIAL SECURITY FUND & OFF GRID CONCEPTS LIMITED
1. Introduction
This complaint arises from Christine Ocholla’s grievance against the National Social Security Fund and Off Grid Concepts Limited on the publication and circulation of her video without obtaining prior consent, and the Respondents’ financial benefit without compensating her. This action is incompatible with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant was approached to provide a testimonial on her retirement experience. She alleged that the 1st Respondent (NSSF) engaged a third-party contractor (2nd Respondent) to conduct the interview, and her video was aired during the NSSF Strategic Plan Launch on national TV stations without her consent. Despite her demand for compensation, the Respondents failed to compensate her.
3. Analysis of Evidence
Complainant’s Position
- On 19th April 2024, an NSSF representative contacted her about a testimonial video, offering a token of Kshs. 20,000
- She was told that an Indemnity Agreement Form would be sent after the interview and that the video would only be played after she had signed it
- On 7th May 2024, she was sent the edited video for review, and the same day it was played on national TV stations (NTV, KTN, KBC, TV47) without her knowledge
- On 8th May 2024, she received the Indemnity Agreement Form, which stated she would not be paid anything
- She demanded Kshs. 150,000 for a two-year contract, but NSSF stated they could not afford it and would not continue with the video
- A friend informed her on 16th May 2024 that her video had been played during the NSSF National Strategic Launch
1st Respondent’s Defense
- Engaged the 2nd Respondent as an independent contractor to provide photography and videography services
- Expected the 2nd Respondent to adhere to legal requirements, including the Data Protection Act
- Instructed the 2nd Respondent not to publish the content until properly edited and an indemnity was executed
- The 2nd Respondent published the unfinished content during the launch without the 1st Respondent’s permission
- The 1st Respondent immediately instructed the 2nd Respondent to pull down the content
- Asserts that it is not liable for the actions of an independent service provider
2nd Respondent’s Defense
- Admitted that the video was aired erroneously and pulled it down immediately
- Explained that all NSSF materials were in one folder and his technical team aired the Complainant’s clip without his knowledge
- Contacted the Complainant and admitted it was his mistake, not the 1st Respondent’s
- Stated the clip is purely non-commercial as it is about the Complainant’s life story
- Absolved the 1st Respondent from liability
4. Issues for Determination
- Whether the Respondents fulfilled their obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The 2nd Respondent published and circulated the Complainant’s video without obtaining her prior consent.
- The 1st Respondent took reasonable steps to ensure compliance and acted promptly upon discovering the breach.
- The 2nd Respondent, having acted outside the 1st Respondent’s instructions, is personally liable as a data controller.
- The complaint against the 1st Respondent is hereby dismissed.
Orders:
- Compensation of Ksh 450,000 to the Complainant from the 2nd Respondent.
- The complaint against the 1st Respondent is dismissed.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Data Controller and Data Processor Liability
- Clarifies that data processors who act outside the instructions of the data controller are deemed data controllers under Section 42(3)
- Data processors are liable for damages when they act contrary to the data controller’s lawful instructions
Consent and Fairness Principle
- Reinforces that consent must be obtained before processing personal data
- Data controllers must handle personal data in ways data subjects would reasonably expect
Broader Impact: This outcome sends a strong message to public institutions and their contractors that independent processors cannot evade liability by claiming error or ignorance. Data controllers who engage third parties must ensure contractual safeguards, while processors who act outside instructions face personal accountability.