The Office of the Data Protection Commissioner (ODPC) has ruled against Elite Power Craft Ltd, trading as Amaron Batteries Kenya, in a case of unauthorized use of employee photographs for commercial purposes.
The firm was ordered to pay KES 750,000 in compensation to the complainant, Kelvin Nyambane Angwenyi, and to remove the images from its social media accounts within seven days.
The complaint, filed on 17 May 2024, alleged that Elite Power Craft Ltd, operating under the Amaron Batteries Kenya brand, posted Angwenyi’s photographs on its Facebook page without obtaining his consent. Despite Angwenyi’s attempts to engage the company to remove the photos, the images remained accessible on the company’s social media platforms as of the date of the ruling.
Violation of Privacy Rights
Under Kenya’s Constitution, Article 31(c) and (d) guarantee the right to privacy, a right further enshrined in the Data Protection Act of 2019. The Act mandates that organizations must seek express consent from individuals before processing their personal data for commercial purposes. Angwenyi’s case highlights a breach of this requirement, as Elite Power Craft Ltd failed to obtain consent for using his photographs, which were taken during his employment.
In a letter to the ODPC, the company contended that the photos were taken with the employee’s knowledge and consent, arguing that Angwenyi had even interacted with social media users in the comments section of the Facebook posts. The company further stated that the images were posted to showcase the team rather than for commercial gain.
However, investigations by the ODPC revealed that the photographs were still available on the company’s Facebook page well after Angwenyi had made a formal request for their removal through a demand letter dated 27 March 2024. The ODPC found that the company had no legitimate basis to retain and use the images after Angwenyi’s employment ended, especially without his explicit consent.
Findings and Determination
In its determination, the ODPC emphasized that Section 30 of the Data Protection Act requires data controllers, such as Elite Power Craft Ltd, to obtain consent from data subjects when processing their personal data for commercial purposes. This includes any use of personal data, such as images, that could advance a company’s commercial interests. The ODPC further noted that the burden of proof lies with the data controller to demonstrate that consent was obtained and that it was given freely.
The ODPC’s investigation concluded that the consent obtained by Elite Power Craft Ltd did not meet the legal requirements outlined in the Act. According to the ruling, “it is questionable whether the consent was freely given” given the employer-employee relationship between Angwenyi and the company. Moreover, the company failed to provide proof of express consent, leaving it in violation of the Act’s provisions on consent and data subject rights.
In addition to violating Angwenyi’s right to erasure under Section 40(1)(b) of the Data Protection Act, Elite Power Craft Ltd was found to have continued using his personal data unlawfully after his repeated requests for the removal of his photographs from the company’s social media pages.
Compensation and Enforcement
Angwenyi had initially sought compensation of KES 5,000,000 for the violation of his data protection rights. However, the ODPC found this figure to be “inordinately high and unjustified” and instead awarded him KES 750,000 in damages. The ruling also ordered the company to remove all of Angwenyi’s images from its Facebook page within seven days, failure to which an enforcement notice would be issued.
The ODPC stressed the importance of organizations putting in place clear consent mechanisms to avoid similar violations in the future. The ruling directed Elite Power Craft Ltd to implement policies ensuring that express consent is sought and obtained before publishing personal data, particularly photographs, on its social media platforms. The Commissioner also noted that any consent mechanism must include provisions for the withdrawal of consent, which must be acted upon in a timely manner.
In the final determination, the Data Commissioner stated, “The Respondent is liable for using the Complainant’s personal data for commercial purposes without obtaining express consent and is also liable for violating the Complainant’s right of erasure.”
