Background
The Complainant (Nancy Maroa) entered into an agreement with the 3rd Respondent (Magic Reel Pictures Limited) dated 1st April, 2024 for photography services intended for branding purposes. The contract allowed the 1st Respondent (Vivo Energy Kenya Limited) to use her images for marketing in Shell Select shops for a period of three years, expiring on 1st April, 2024. However, she later discovered that her images were being used beyond the agreed scope.
On 27th March, 2024, the Complainant found that her image had been displayed on Kiambu road for marketing purposes without her authorization by the 1st Respondent (Vivo Energy Kenya Limited) and 2nd Respondent (Artcaffe Coffee & Bakery Limited). Furthermore, despite the expiry of the agreement on 1st April, 2024, the 1st Respondent continued to use her images in Shell Select shops across the country without obtaining further authorization. Concerned about this, the Complainant wrote to the 1st and 3rd Respondent on 3rd April, 2024 seeking an explanation regarding the continued use of her images. The 3rd Respondent acknowledged receipt of her concerns and stated that they would dis- cuss and resolve the matter with the 1st Respondent. However, no further feedback or resolution was provided.
The Complainant mentioned that the unauthorized use of her images caused significant reputational and financial harm because her business contacts assumed she was still affiliated with the Respondents as their brand ambassador. As a result, she lost modelling opportunities with the potential clients leading to an estimated financial loss of Kenya Shillings Nine Hundred Thousand (Kshs. 900,000).
Issues for Determination
The following issues were determined by the Office:
1. Whether the Respondents fulfilled their duties under the Act
The Office of the Data Protection Commissioner (ODPC) found out that the 1st and 3rd Respon- dents did not fulfil their obligations under the Data Protection Act. As data handlers, their re- sponsibilities depended on their role as data controllers or processors. Vivo Energy confirmed that it had engaged Magic Reel Pictures Limited for advertising services while Artcaffe cited a Memorandum of Understanding assigning marketing responsibilities to Vivo Energy. Based on this, it was determined that Vivo Energy acted as a data controller and Artcaffe was a third party and Magic Reel Pictures Limited acted both as a data controller and processor depending on its relationship with the other parties.
Under the Act, Vivo Energy and Magic Reel Pictures Limited were required to process person- al data lawfully, fairly and transparently while notifying the data subject the collection and in- tended use of the image. Furthermore, the Act prohibits the use of personal data for commercial purposes without express consent. No evidence was adduced by Vivo Energy to demonstrate it entered into a data processing agreement with Magic Reel Pictures Limited to process the data of the Complainant on her instructions.
2. Whether the Respondents obtained valid consent to process the personal data of the Complainant
The Respondents relied on agreements between the Complainant and Magic Reel Pictures Limited to argue that the complainant had given express consent for the use of her image. However, upon review of the agreements and supporting evidence, the Office determined that the consent relied upon did not meet the legal threshold under the Act. Consent must be express, unequivocal, free, specific and informed with a clear affirmative action by the data subject.
While the Complainant’s images were taken at the 1st and 2nd Respondents premises and she may have appeared to be a willing participant, the agreements only granted consent for Magic Reel Pictures to use the images for branding its business, not for any third party. Since the 2nd Respondent (Artcaffe) was considered a third party in this processing, the 1st and 3rd Respondents failed to obtain valid consent for the commercial use of the Complainant’s image.
3. Whether there was infringement of Complainant’s rights under the Act
Section 26 of the Act grants the data subjects the right to be informed about how their personal data will be processed enabling them to make informed decisions. The office found that the 1st and 3rd Respondents failed to obtain valid consent and did not inform the Complainant about all parties involved in the processing of her images for commercial purposes.
4. Whether the Complainant is entitled to any remedies under the Act and its Regulations
The Office determined that the first and third Respondents violated the Act by processing the Complainant’s image for commercial purposes without her express consent, thereby infringing her right to be informed. Under the Act, data subject who suffers damage due to violation is en- titled to compensation.
Final Determination
The Complaint against the 2nd Respondent (Artcaffe) was dismissed. The 1st and 3rd Respondent were ordered to pay the Complainant Kenya Shillings Seven Hundred and Fifty Thousand (Kshs. 750,000) in the following manner; 1st Respondent (Vivo Energy) is to compensate the Complainant Kenya Shillings Five Hundred Thousand (Kshs.500,000) and the 3rd Respondent (Magic Reel Pictures Limited) Kenya Shillings Two Hundred and Fifty Thousand (Kshs.250,000).
