ODPC COMPLAINT NO. 1618 OF 2024
1. Introduction
This case involves a complaint by Lawrence M’Impwi Kirima (Complainant) against Solar Panda Company Kenya Limited (Respondent) regarding unauthorized commercial use of personal data (image) in violation of the Data Protection Act, 2019.
Table of Contents
2. Nature of Complaint
The Complainant alleged that the Respondent used his personal image in marketing materials for commercial purposes without his express consent, violating his right to privacy under the Data Protection Act, 2019.
3. Analysis of Evidence
Complainant’s Position
- Discovered in 2022 that his image was being used in Respondent’s marketing flyers without consent
- Made efforts to inquire with Respondent’s officials about the unauthorized use
- Provided copies of marketing flyers and email correspondence as evidence
Respondent’s Defense
- Admitted Complainant was a former field agent whose photo was taken for legitimate purposes
- Claimed the image was pulled from their library to improve field agent visibility
- Stated they revised procedures after Data Protection Act enactment but didn’t update Complainant’s agreement
- Offered compensation which they claimed was for sales improvement, not image use
- Stopped using Complainant’s image in flyers
4. Issues for Determination
- Whether the Respondent obtained the Complainant’s consent as required by the Act to use his image for commercial purposes
- Whether the Complainant is entitled to any remedies under the Act and attendant Regulations
5. Final Determination
- The Respondent was found liable for violating Sections 30(1)(a) and 37(1) of the Data Protection Act by failing to obtain express consent for commercial use of the Complainant’s image
- The Respondent was ordered to pay the Complainant KES 500,000 as compensation
- Parties retain the right to appeal the decision to the High Court of Kenya within 30 days
6. Significance and Impact
Consent Requirements
- Reinforces that consent must be express, unequivocal, free, specific, and informed
- Confirms burden of proof for consent lies with data controllers/processors
Commercial Use of Personal Data
- Clarifies that using personal data (including images) for commercial gain requires explicit consent
- Sets precedent for compensation amounts in image rights violations
Employee/Contractor Data Rights
- Affirms that employment relationships don’t automatically grant commercial use rights to personal data
- Highlights need to update existing agreements when new data protection laws are enacted
Broader Impact: This ruling strengthens enforcement of image rights under Kenya’s data protection framework and serves as a warning to businesses using personal data for commercial purposes without proper consent.
For full determination, click 🗃️
