ELIJAH KARIUKI MBUTHIA VERSUS ST. JOSEPH HEALTH CENTRE
1. Introduction
The dispute before this Office concerns Elijah Kariuki Mbuthia’s complaint against St. Joseph Health Centre on the use of his image on a public signpost and print media for commercial gain without his express consent. This action is inconsistent with the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The complainant, a Clinical Officer and former employee, was photographed for staff identification but his image was later used on a public signpost and print media for promotional purposes without his consent.
3. Analysis of Evidence
Complainant’s Position
- While employed, the Respondent arranged for his photo to be taken, informing him it would be used solely for staff identification cards
- The photos were never used on staff identification cards but instead on various promotional materials
- The materials remained in circulation for more than a year after he ceased to be an employee
- Raised an issue on the infringement of his privacy and demanded compensation, but the Respondent refused to acknowledge wrongdoing
- Adduced photographs of the 2022 Calendar and published segments with his image
Respondent’s Defense
- Maintained it used the Complainant’s image with his express consent
- Claimed oral consent was obtained during a staff meeting and included meeting minutes as evidence
- Argued the use of public signposts and materials was for awareness purposes and not for commercial gain
- Acknowledged it did not have written consent but argued active participation implied consent
- Provided written witness statements from other employees who participated in the project
4. Issues for Determination
- Whether the Respondent obtained the Complainant’s consent as required by the Act to use his image for commercial purposes
- Whether there was a violation of the Complainant’s rights under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent used the Complainant’s image for marketing purposes without obtaining express consent.
- The Respondent repurposed data collected for staff identification for promotional use without consent.
- Oral consent without written or electronic verification is insufficient under the Act.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 500,000 to the Complainant.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Purpose Limitation and Consent
- Clarifies that data collected for one purpose (staff identification) cannot be used for another (marketing) without express consent
- Data controllers are obligated to inform data subjects of all intended uses at the point of collection
Employer-Employee Image Use
- Establishes that employment does not grant automatic consent for use of employee images for commercial purposes
- Employers are required to obtain express consent for marketing and promotional use
Broader Impact: This determination reinforces the obligation on healthcare institutions to secure express consent before using employee images for marketing. It underscores that data collected for internal administrative purposes cannot be repurposed for commercial use without the data subject’s informed consent.