Data Subject Awarded Compensation For Use of his Wedding Photos Without Consent
Background
The Complainant lodged a complaint alleging that the Respondent captured and used images and videos of him, his wife, and their guests during their wedding without consent. He further claimed that these visuals were subsequently used by the Respondent in branded and personalised advertisements.
The Complainant had booked the reception of their wedding at the Respondent’s establishment. However, shortly after the event, the Respondent allegedly proceeded to share the images on social media without the knowledge or consent of the Complainant or the individuals depicted.
The Respondent did not respond to the notification of complaint dated 9th December 2024.
Determination
The Data Commissioner found the Respondent in breach of the Data Protection Act and held as follows:-
- Section 40(1)(b) of the Data Protection Act gives a data subject the right to request the deletion of personal data that a data controller or processor is no longer authorised to retain, or data that is irrelevant, excessive, or unlawfully obtained.
- The Respondent failed to respond to the Complainant’s demand letter dated 3rd October 2024 and, by the time of the determination, continued to publish the Complainant’s images and videos on its Facebook and Instagram accounts.
- The Respondent failed to inform the Complainant of his rights under the Data Protection Act, including the intended use of the images for social media advertising purposes.
- Contrary to section 37 of the Data Protection Act 2019 and Regulation 14 of the Data Protection (General) Regulations 2021, the Respondent published the Complainant’s photograph on its Facebook and Instagram pages to advance its economic interests, without the Complainant’s consent.
- The Data Commissioner ordered the Respondent to erase the Complainant’s personal data from its social media platforms and awarded the Complainant compensation of Kenya Shillings Seven Hundred and Fifty Thousand (KES 750,000). Additionally, an Enforcement Notice was issued against the Respondent.
Why This Matters
- This decision reinforces the fundamental principle that personal images constitute personal data under the Data Protection Act. Businesses must seek valid consent before collecting or using such data — especially when it will be used for marketing or commercial purposes.
- The ruling also highlights the importance of complying with data subject rights, including the right to erasure, and the need to respond promptly to complaints and data related requests.
- Failure to meet these obligations can expose businesses to regulatory action, financial penalties, and reputational harm.
- Organizations operating in the hospitality and events sectors should review their photography, marketing, and data processing practices to ensure full compliance with Kenya’s data protection laws.
