Background
In Dennis Mbogoro Muthoni v Africa International University (ODPC Complaint No. 0590 of 2025), the Complainant, an alumnus of the Respondent University, lodged a complaint alleging that the Respondent had used his photograph in the University’s official introduction pamphlet without his knowledge or consent.
The Complainant stated that, during a visit to the campus, he discovered that his photograph had been included in a pamphlet outlining the University’s academic programs and containing a data collection form for prospective students. According to the Complainant, the pamphlet was actively distributed to visitors and prominently displayed on the University’s notice boards.
According to the Complainant, the photograph had been taken during a private photoshoot that he had personally arranged and paid for through an independent consultant. He maintained that the photoshoot had not been commissioned by or affiliated with the University. He further stated that the photoshoot had included his then-girlfriend, whose photograph appeared on the front of the pamphlet. Since they were no longer in a relationship, he contended that the continued use of the photographs compounded the personal and emotional distress he experienced.
The Complainant further stated that the University purported to rely on a clause in its Student Handbook which provided that, by registering as a student, a student consented to the use of their name, voice, image or likeness without further permission or compensation. However, the Complainant maintained that he had not received or signed the Student Handbook. He stated that he had requested the University to provide a signed copy of the Handbook or other documentation showing that he had agreed to the clause, but the University had not provided such documentation.
Upon discovering the use of his photograph, the Complainant requested the University to withdraw the pamphlet from circulation and remove it from all public display areas within the institution. He stated that the University did not comply with his request.
The Respondent’s Response:
The University denied using the Complainant’s photograph without his consent. According to the University, students received a Student Handbook during admission and signed an Admission Acceptance Form confirming that they had read, understood and agreed to comply with its provisions. The Complainant had signed the Admission Acceptance Form when he enrolled for his diploma course in 2017 and again in 2023, acknowledging the revised Student Handbook issued in 2020.
In support of its position, the University relied on clause 8.8 of the revised Student Handbook, which provided that by registering as a student, a student consented to the use of their name, voice, image or likeness for official purposes without further permission or compensation. The University maintained that this provision established the Complainant’s consent to the use of his photograph.
The University also disputed the Complainant’s account that the photograph came from a private photoshoot unrelated to the institution. According to its account, the photoshoot took place on campus, with the Complainant dressed in full graduation attire, and involved the University’s photographer working alongside the photographer whom the Complainant described as his private consultant.
As further evidence of consent, the University pointed to communications between the Complainant and a University official after the photoshoot. The Complainant shared a link to the graduation photographs and wrote, “Now AIU has good photos to post.” In the University’s view, this communication amounted to a clear affirmative act authorising the use of the photographs. The University also referred to a later WhatsApp communication in which the Complainant commented that some of its brochures contained outdated photographs.
The University acknowledged that the Complainant subsequently sent an email formally withdrawing his consent. However, an email filtering error directed the message to the recipient’s junk folder, and the University only became aware of the withdrawal after the ODPC notified it of the complaint. Upon discovering the email, the University withdrew the brochures containing the Complainant’s image and stopped further use of the photograph. The University also deleted his images from its platforms and introduced enhanced consent measures.
On this basis, the University maintained that the Complainant had consented to the use of his photograph through the Student Handbook and his subsequent conduct and communications. In its view, the later withdrawal of consent did not invalidate the consent previously given, and the University took steps to discontinue the use of the photograph once it became aware of the withdrawal.
The Data Commissioner’s Determination The Data Commissioner held as follows:
1. The University failed to demonstrate that it had obtained the Complainant’s express consent to use his photograph.
The Data Commissioner noted that section 2 of the Data Protection Act defines consent as an express, unequivocal, free, specific and informed indication of a data subject’s wishes, through a statement or clear affirmative action, signifying agreement to the processing of personal data relating to the data subject. Further, under section 32 of the Act, the burden of proving consent rests with the data controller or data processor. The University did not provide sufficient documentary evidence, such as a signed consent form or formal communication specifying the purpose for which it would process the Complainant’s photograph.
2. The University could not rely on an unsigned Student Handbook as evidence of the Complainant’s consent.
The Data Commissioner held that, in the absence of a signed copy of the Student Handbook evidencing the Complainant’s consent, the University could not rely on the consent clause in the Handbook. The Data Commissioner further held that reliance on the clause did not satisfy the standard of express or unequivocal consent required under the Data Protection Act.
3. Using the Complainant’s photograph in the University’s promotional pamphlet amounted to use of personal data for commercial purposes.
The Data Commissioner found that the pamphlet was public-facing promotional material intended to highlight campus life and attract new students. Its purpose was therefore to advance the University’s visibility and reputation, which the Data Commissioner considered to constitute a commercial or public relations function. Accordingly, the University’s use of the Complainant’s photograph in the pamphlet amounted to use of personal data for commercial purposes under section 37 of the Data Protection Act.
4. The use of the Complainant’s photograph in the promotional pamphlet amounted to direct marketing.
The Data Commissioner held that the University’s use of the Complainant’s recognizable image in its promotional brochure constituted direct marketing under Regulation 14(2) of the Data Protection (General) Regulations, 2021. The Commissioner distinguished direct marketing from general advertising, noting that under Regulation 14(3), marketing is not direct where personal data is not used to identify or target particular individuals. In this case, the University used the Complainant’s identifiable image to promote the University and therefore engaged in direct marketing.
5. The Complainant was entitled to compensation for the unlawful use of his personal data.
The Data Commissioner relied on section 65 of the Data Protection Act, which entitles a data subject to compensation for damage suffered as a result of a contravention of the Act and recognizes that damage includes financial loss and non-financial harm, including distress. In assessing compensation, the Commissioner took into account the University’s remedial measures, including withdrawing and discontinuing the promotional pamphlets containing the Complainant’s image.
The Commissioner ultimately found the University liable and awarded the Complainant Kes. 250,000/- in compensation.
