Executive Summary
The right to be forgotten entails the right of any party to request to have a data processor stop processing their data. This can involve a person requesting that a website, search engine or even employer, who have published their information, photos etc, to take it down and remove it from general circulation.
The Office of the Data Protection Commissioner rehashed the importance of seeking express consent before processing a person’s data, and the need to cease processing when consent is withdrawn or a complaint is received.
Background
The case before the Data Protection Commissioner(ODPC) pitted Mr. Kelvin Nyamabane against his former employer Elite Power Craft which traded as Amaron Batteries Kenya. Mr. Kelvin was previously an employee of Amaron Batteries, during which the latter operated various social media handles including a Facebook page. In 2021 while still an employee, Amaron took and published his photo while in their brand uniform. The photo was published on their Facebook page which had over 4,000 active followers.
The relationship between the two would later sour when Mr. Nyamabane allegedly stole from his employer culminating in his dismissal. The former employee, on learning that the Respondent continued to maintain the published image of himself on their social media account, sent requests and a demand letter through an advocate, demanding that the photo be brought down, which the Respondent failed to do.
The Case
The Claimant argued that proper consent to use his image for commercial advertisement was not sought by his former employer. He also argued that Amaron violated his right to privacy by continuing to use his image after the termination of his employment and despite numerous requests and demands that they stop.
The employer on the other hand argued that the Respondent had given his consent and was well aware of the image’s existence. They highlighted the former employee’s comments in the comment section of the post with the image. In addition, they stated that the image was not used in a commercial manner, but used to show their staff at work.
The Data Protection Commissioner’s Holding
The Data Protection Commissioner stated that it was the employer’s responsibility to prove that they had sought prior consent from the employee, and added that the mere fact that the claimant was their former employee was not itself sufficient proof of consent.
The Commissioner also stated that any data processor is required to stop processing information within 14 days of receiving a complaint or withdrawal of consent, and that failing to take down the photos after receiving a demand was a violation of Mr. Nyamabane’s right to privacy. The ODPC awarded Mr. Nyambane Kshs 750,000 for the infringement of his right to privacy.
Importance Of the Decision
To avoid a similar outcome, it is important for Employers to:
- Seek express permission for use of images and/or information. This can be done through a clause in the Employment contract where the Employee agrees to their details and their likeness being used by the employer for informational and promotional purposes without further compensation. The clause should also outline the procedure the employee can use to request that their information is taken down in the event that the relationship terminates.
- Ensure that records of complaints and withdrawal of consent are acted upon within the requisite deadline of 14 days.
It is also prudent to ensure that Employees are informed (in writing) and sign off, prior to the release of any images or publications with their information.
