In today’s digital world, the unauthorized use of photographs is a growing concern. With the widespread use of social media, surveillance, and digital marketing, individuals’ images are often shared or used without their consent.
To address these concerns, the Kenyan Data Protection Act, 2019 was enacted to safeguard individuals’ privacy and ensure that organizations handle personal data responsibly. Under this law, personal data includes any information that identifies an individual, such as their name, contact details, and photographs. Since images fall under personal data, using them without consent may constitute a legal violation.
Legal Protections and the Role of the ODPC
The Office of the Data Protection Commissioner (ODPC), as outlined in Section 5 of the Kenyan Data Protection Act, 2019, is responsible for:
- Ensuring compliance with data protection laws.
- Handling complaints regarding data protection violations.
- Advising organizations on data protection best practices.
- Enforcing penalties for breaches.
If an individual’s rights under the Data Protection Act are violated, they can file a complaint with the ODPC for redress.
Case Study: Unauthorized Use of an Employee’s Photograph
A recent case, KNA v. Elite Power Craft Limited T/A Amaron Batteries Kenya (Complaint No. 679 of 2024), illustrates the importance of obtaining consent before using someone’s images for commercial purposes.
Case Background
The complainant, an employee of the respondent, discovered that his photographs were used for commercial advertising on the company’s Facebook page without his consent. This was a clear violation of the Data Protection Act, which requires institutions to obtain permission before using someone’s personal data, including photographs.
Issues for Determination
The ODPC examined three key issues:
- Whether the complainant’s rights under the Data Protection Act were infringed.
- Whether the respondent obtained express consent before using the complainant’s image for commercial purposes.
- Whether the complainant was entitled to any legal remedy.
ODPC’s Findings and Ruling
The ODPC ruled as follows:
- Violation of Rights:
- Section 26(a) of the Act grants individuals the right to be informed when their personal data is being used.
- Section 40(1)(b) gives individuals the right to request the erasure of their data if used without consent.
- The complainant exercised this right by sending a demand letter requesting the removal of his images, but the respondent failed to respond within the legally required 14 days (Regulation 12(3) of the Data Protection Regulations).
- Failure to Prove Consent:
- As a data controller, the respondent was legally required under Section 30 of the Act to obtain consent before processing personal data.
- Section 37(1) states that personal data cannot be used for commercial purposes without express consent.
- The burden of proof was on the respondent to demonstrate that they had obtained consent—but they failed to do so.
- Remedies Granted:
- Regulation 14(2) and 14(3) of the Enforcement Regulations outline the remedies available to complainants.
- The complainant sought the removal of his images from the company’s Facebook page and KES 5,000,000 in compensation.
- The ODPC ordered the immediate removal of the images but found the compensation request excessive. Instead, the complainant was awarded KES 750,000 in damages.
Key Takeaways
This case highlights the importance of data protection compliance. Key points to note include:
✔️ Organizations must obtain clear, verifiable consent before using personal images for commercial purposes.
✔️ Individuals have the right to request the removal of their images if used without permission.
✔️ Failure to comply with the Data Protection Act can lead to legal action and financial penalties.
Conclusion
The unauthorized use of personal images is a serious violation of privacy laws. Organizations and individuals must adhere to the Data Protection Act to avoid legal consequences. Obtaining explicit consent before using someone’s image for marketing or advertising is not just ethical—it is a legal requirement.
Leave a Reply