DENNIS GITONGA NDURURI VERSUS TWIGA FOODS LIMITED
1. Introduction
The case is in respect to the complainant, Dennis Gitonga Ndururi against Twiga Foods Limited, on the use of his image for commercial purposes on a worldwide scale without his consent or compensation. This action is against the Data Protection Act, 2019 provisions.
Table of Contents
2. Nature of Complaint
The complainant was an employee of the Respondent when his photograph was taken on 12th April 2018. The complainant alleged that the Respondent entered into a joint study agreement with IBM Research and uploaded his photograph onto a public IBM Flickr account without his consent, and his image was subsequently used in at least 100 online articles worldwide, depicting him as a brand ambassador for the Respondent. No consent was obtained and no compensation was provided for the use of his image.
3. Analysis of Evidence
Complainant’s Position
- Provided links to 88 online articles and social media platforms where his image appeared
- Alleged the Respondent and IBM did not obtain his express consent and did not inform him of such use
- Claimed the image was taken to promote and advertise the Respondent’s proposed joint venture
- Stated the Respondent has since become one of the most heavily funded startups in the world but he got no benefit
Respondent’s Defense
- Confirmed the Complainant was an employee between 1st April 2018 and 31st July 2018
- Stated the photograph was taken on 12th April 2018 while the Complainant was an employee in the course of his work
- Claimed the Complainant was fully informed that his photograph would be taken and published as part of the joint study, and he voluntarily consented
- Stated the data was only used for research purposes, not for marketing or advertisement
- Upon receiving the complaint, the Respondent contacted IBM to pull down the photograph and IBM complied
- Argued the cause of action arose in 2018 before the Data Protection Act, 2019 came into force
4. Issues for Determination
- Whether the demand letter dated 18th June 2023 was served upon the Respondent
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The photograph was taken and published in 2018, before the Data Protection Act, 2019 came into force.
- The Respondent had no obligation under the Act at the time the photograph was taken and published.
- The Respondent acted promptly upon receiving the complaint by contacting IBM to pull down the photograph.
- The complaint lacks merit and is hereby dismissed.
Orders:
- No compensation awarded as the complaint was dismissed.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Non-Retrospective Application of the Act
- Clarifies that the Data Protection Act, 2019 does not apply retrospectively
- Data controllers are not required to comply with the Act for processing that occurred before its enactment
Right of Erasure and Exercise of Rights
- Reinforces that data subjects must first exercise their rights under the Act before lodging a complaint
- Data controllers who act promptly upon notification of a complaint may avoid liability
Broader Impact: This determination provides important guidance on the application of the Data Protection Act to historical data processing. It establishes that the Act does not apply retrospectively and that data subjects must actively exercise their rights before seeking redress from the ODPC.