Background
In Antonate Rombo Aiko v Goodtimes Africa t/a Blankets & Wine, the Complainant lodged a complaint with the Office of the Data Protection Commissioner (ODPC), alleging that the Respondent used her image for commercial purposes on its social media platforms without her consent. The Complainant alleged that the Respondent deprived her of control over her personal data by falsely implying her endorsement of the use of her image in advertisements promoting the “Blankets and Wine Tupatane Onja Onja Summer Events 2025.”
The Complainant further averred that the use of her image was undertaken without her consent and amounted to the unauthorised use of her likeness. She contended that her image held commercial value and that its use by the Respondent for advertising purposes constituted inappropriate commercial exploitation for the Respondent’s benefit, while potentially diminishing its value for future commercial engagements and denying her the opportunity to license its use on fair and mutually agreed terms.
The Respondent’s Response
The Respondent maintained that the Complainant’s consent had been obtained through the event’s terms and conditions.
The Respondent further contended that the use of the Complainant’s image was within the scope of those terms and conditions and was not undertaken for any improper or extraneous commercial purpose.
Determination
The Data Commissioner held as follows:
- Section 37(1)(a) of the Data Protection Act, 2019 provides that a person shall not use personal data for commercial purposes unless such person has sought and obtained the express consent of the data subject.
- Regulation 14 (1) of the Data Protection (General) Regulations, 2021 provides that a data controller or data processor is considered to use personal data for commercial purposes where such data is used to advance commercial or economic interests, including inducing a person to buy, subscribe to, or otherwise obtain products, services, information, or enabling or effecting a commercial transaction, directly or indirectly. Further, Regulation 14(2) provides that personal data is also deemed to be used for commercial purposes where it is applied in direct marketing, including sending promotional material or displaying advertisements on online platforms where a data subject is identifiable.
- The ODPC held that the key question was whether the Complainant’s personal data used to promote, advertise, or facilitate a commercial transaction or economic benefit, whether directly or indirectly.
On this issue, the ODPC found that the Complainant’s image had been used in promotional material for the “Blankets and Wine Tupatane Onja Onja Summer Events 2025” with the intention of attracting attendance and participation in a paid or revenue- generating event. This amounted to “advancing the Respondent’s commercial and economic interests within the meaning of section 37 (1) (a) of the Act and Regulation 14 (1) of the Data Protection Regulations, 2021. - The ODPC then considered whether valid consent had been obtained for the commercial use of the Complainant’s image use and held as follows: –
- Section 2 of the Act defines consent as “any manifestation of an express, unequivocal, free, specific, and informed indication of a data subject’s wishes, by a statement or clear affirmative action, signifying agreement to the processing of personal data relating to the data subject.”
- Section 30 of the Act provides that personal data may only be processed where a lawful basis exists, including where a data subject has given consent to the processing of their personal data for one or more specific purposes. Further, section 32 places the burden on the data controller to prove that such consent was obtained and requires, in determining whether consent was freely given, regard to be had to the circumstances under which it was obtained.
- These provisions collectively establish that consent must be purpose-specific, informed, and capable of proof by the data controller.
- The Respondent’s assertion that consent was obtained through terms and conditions shared with event attendees did not demonstrate that such consent specifically extended to the use of the Complainant’s image for commercial advertising and promotional purposes.
- There was no evidence that the Complainant was adequately informed that her image would be used in promotional materials, or that she took any clear affirmative action indicating agreement to such use.
- Accordingly, the Data Commissioner found that the Respondent had not obtained valid express consent from the Complainant for the processing of her personal data for commercial purposes and that such processing was unlawful under sections 30 and 32 of the Act.
Consequently, the Respondent was found liable for using the Complainant’s image without obtaining her express consent and directed the Respondent to pay the Complainant Kenya Shillings Three Hundred Thousand (KES 300,000/-) as compensation.
