ESTHER KANZA MBUVU VERSUS GRAIN INDUSTRIES LIMITED
1. Introduction
The case is in respect to the complainant, Esther Kanza Mbuvu against Grain Industries Limited, a food processing company, on the use of her image for marketing purposes on billboards and YouTube without obtaining her consent. This action contravenes the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Respondent used the Complainant’s image in a promotional campaign on billboards and YouTube through its marketing agency. The Complainant alleged that the Respondent relied on consent from her daughter, never obtained her direct consent, and ignored her demand letter for removal and compensation.
3. Analysis of Evidence
Complainant’s Position
- Saw a billboard erected along Malindi Road at Bamburi featuring her image on 30th August 2023
- Later discovered her image was also on a YouTube promotional advert
- Provided photos of the billboards as proof
- Provided a copy of the consent form used by the Respondent as proof that consent was obtained from third parties
- Provided a copy of a demand letter dated 31st October 2023
Respondent’s Defense
- Launched a promotional campaign titled “TUNASHUKURU MAMA WA AJABU” to celebrate mothers during Mother’s Day
- Engaged Brainwave Communications Limited as its marketing agency to run the Campaign
- Relied on consent obtained from the Complainant’s daughter, who enrolled as a participant and accepted the Terms & Conditions
- Claimed the T&Cs required participants to confirm they had obtained express consents from their mothers
- Stated that all billboards were taken down by 17th October 2023, and the YouTube video on 27th March 2024
- Is registered as both a data controller and processor and has a data protection policy
4. Issues for Determination
- Whether the Respondent obtained valid consent to process the personal data of the Complainant
- Whether there was an infringement of the Complainant’s rights under the Act
- Whether the Respondent fulfilled its obligations under the Act
- Whether the Complainant is entitled to any remedies under the Act and the attendant Regulations
5. Final Determination
The Data Commissioner found:
- The Respondent used the Complainant’s image on billboards and YouTube without obtaining her express consent.
- Consent obtained from the Complainant’s daughter was invalid without proof that the Complainant consented to collection from that source.
- The Respondent failed to respond to the Complainant’s demand letter seeking removal of her image.
- The Respondent is liable for violation of the Complainant’s rights under the Act.
Orders:
- Compensation of Ksh 1,000,000 to the Complainant.
- An Enforcement Notice is issued against the Respondent.
- Right of appeal to the High Court within 30 days.
6. Significance and Impact
Right to be Informed and Right of Erasure
- Reinforces the obligation to inform data subjects of the use of their personal data
- Data controllers must act on erasure requests promptly
Commercial Use of Images and Agency Liability
- Establishes that principals are liable for the actions of their marketing agencies
- Using images on billboards and YouTube for promotional campaigns constitutes commercial use
Broader Impact: This determination reinforces that businesses across Africa cannot rely on third parties or marketing agencies to obtain consent on their behalf. Express, direct consent from data subjects is mandatory before using personal data for commercial purposes.