DANIEL ODHIAMBO OPIYO & JEREMIAH BARASA MUKAWALE VERSUS TULIA AMBOSELI SAFARI CAMP LIMITED
1. Introduction
This complaint arises from the grievances of Daniel Odhiambo Opiyo and Jeremiah Barasa Mukawale against Tulia Amboseli Safari Camp Limited on the commercial use of their images on its website to promote hospitality services without their authority or consent. This action offends the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainants were former employees of Airborne African Antiques Ltd, which was later acquired by the Respondent. The Respondent published their images on its website, passing them off as an advertisement for bush breakfast services, creating an untrue impression that the Complainants worked for the Respondent despite them never having worked for the entity.
3. Analysis of Evidence
Complainants’ Position
- The Respondent published their images on its website passing them off as an advertisement for bush breakfast
- The images created an untrue impression that they worked for the Respondent
- At the time the images were taken, they were working for Airborne African Antiques Ltd
- Adduced the demand letter and the Respondent’s website pages containing their images
Respondent’s Defense
- Admitted the Complainants were employees of Airborne African Antiques Ltd and the photograph was uploaded to AAAL’s website
- Acquired AAAL in 2018 and the image was on the website at the time of acquisition
- Denied using the image for commercial purposes or generating any commercial benefit
- Pulled down the image immediately as a demonstration of good faith
- Proposed to solve the matter through alternative dispute resolution
4. Issues for Determination
- Whether the Complainants’ personal data was lawfully processed
- Whether the Complainants are entitled to any remedy under the Act
5. Final Determination
The Data Commissioner found:
- The Respondent continued using the Complainants’ images for commercial purposes after acquiring the business without obtaining fresh consent.
- Acquiring a business does not automatically transfer rights to use former employees’ personal data.
- The Respondent failed to discharge its burden of proving consent under Section 32.
- The Respondent is liable for violation of the Complainants’ rights under the Act.
Orders:
-
Compensation totaling KES 1,000,000:
- 1st Complainant: KES 500,000
- 2nd Complainant: KES 500,000
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Business Acquisition and Data Protection
- Clarifies that acquiring a business does not automatically transfer rights to use employees’ personal data
- New owners must obtain fresh consent before using existing employee images for commercial purposes
Commercial Use of Images and Consent
- Reinforces that using images to promote hospitality services constitutes commercial use
- Express consent is required for commercial use, even if images were previously used by a predecessor company
Broader Impact: This determination confronts the assumption that business acquisitions automatically transfer rights to use employee images. It establishes that consent does not survive corporate transactions, and new owners bear the burden of obtaining fresh consent before repurposing personal data for commercial gain.