21st March 2025
Ending the first quarter of the year on a high note, part of the data protection team #ourveryown John Mbaluto, FCIArb (Deputy Managing Partner) and Natalie Obago (Associate) successfully defended Artcaffe Coffee & Bakery (the “2nd Respondent”) in a claim before the Office of the Data Protection Commissioner (ODPC) in ODPC Complaint No. 1980 of 2024 – Nancy Wansato Maroa v. Vivo Energy Kenya Limited, Artcaffe Coffee & Bakery and Magic Reel Pictures Limited. The ODPC was called upon to determine whether there was unlawful use of the Complainant’s image on billboards without her consent and/or authorization.
In answering the question, ‘Did you handle the Complainant’s personal data in accordance with the Data Protection Act (Cap 411C, Laws of Kenya) (the “Act”)?’, the 2nd Respondent put forth a robust defence demonstrating that while it provided the necessary branding for the subject billboards; it was not privy to the intricacies between the Complainant and the other Respondents. This is because it was not responsible for marketing in its partnership with Vivo Energy Kenya Limited (the “1st Respondent”). It is on this basis that the ODPC determined that the 2nd Respondent was a third party to the arrangement between the parties and dismissed the claim against it in entirety.
Often described as the cornerstone of data protection, consent is a critical aspect of handling personal data. This decision goes to show that where a data subject is not informed of the specific purpose for which their personal data is to be used and to whom the said personal data will be transferred to, their consent will be deemed invalid under the Act.
Turning back to the question of compliance with the Act, the ODPC determined that there were valid agreements between the Complainant and Magic Reel Pictures Limited (the “3rd Respondent”) to use the Complainant’s image within its business. However, the said agreements did not specify how the said images would be used and that the said images would be used by third parties. Consequently, the ODPC found that while she agreed to the terms of the agreements, her consent was not informed as she was not advised of the purpose for which the images would be used and the transfer to third parties. In this regard, the ODPC found that the 1st and 3rd Respondents had failed in their obligation to obtain informed consent from the Complainant as required under the Act.
Download the Alert here.
Read the full Determination here.
