Food producer Grain Industries Limited has been ordered to pay KES 1 million in damages for violating the Data Protection Act, 2019. The company was found liable for using a woman’s image in a national billboard and YouTube marketing campaign without her consent.
This decision, handed down by the Office of the Data Protection Commissioner (ODPC), underscores the growing significance of data privacy in Kenya’s digital age.
The case, which was first lodged in March 2024 by complainant Esther Kanza Mbuvu, revolves around Grain Industries Limited’s promotional campaign titled “Tunashukuru Mama Wa Ajabu.” This campaign, designed to celebrate mothers, featured photos of various individuals on billboards, including Ms. Mbuvu’s, which were displayed prominently along busy roads in Mombasa and Kilifi counties. According to the ODPC’s determination, Ms. Mbuvu’s image was used without her explicit consent, a violation of Kenya’s data privacy laws.
The promotional materials appeared on billboards in several locations, including Nyali, Kibarani, and Likoni. Ms. Mbuvu, upon discovering her unauthorized likeness on one such billboard in August 2023, promptly contacted Grain Industries, demanding the removal of the materials and seeking compensation. However, her requests went unanswered.
In her formal complaint to the ODPC, Ms. Mbuvu provided evidence including photographs of the billboards and links to YouTube promotions. She stated that she had never been approached for consent and found the usage of her image exploitative and unlawful.
Kenya’s Data Protection Act, enacted in 2019, requires companies to obtain explicit consent before using personal data, including images, for commercial purposes. The ODPC is tasked with ensuring that individuals’ rights under the Act are upheld, and companies adhere to legal standards regarding personal data usage.
During the proceedings, Grain Industries acknowledged using Ms. Mbuvu’s image but argued that they had obtained implied consent through her daughter, who had submitted her mother’s photo as part of the campaign. The company claimed they assumed the daughter had sought and received permission, as stipulated in the campaign’s terms and conditions. However, the ODPC found this defense insufficient, ruling that third-party consent is not adequate unless the data subject themselves directly provides it.
“The respondent did not obtain valid consent from the complainant to use her image for commercial purposes. Relying on consent obtained from a third party, in this case, the complainant’s daughter, was invalid under the law,” the Data Commissioner ruled.
The ODPC awarded Ms. Mbuvu KES 1 million in damages, citing both the unauthorized use of her image and the company’s failure to comply with her right to erasure. Grain Industries had only taken down the billboards and YouTube video in March 2024, several months after receiving a demand letter from Ms. Mbuvu in October 2023.
“This decision marks a critical moment for data privacy in Kenya,” commented a legal expert. “It sends a clear message that companies must be vigilant in obtaining explicit consent for all forms of data, especially in marketing campaigns. Failing to do so can result in significant penalties.”
In addition to the fine, Grain Industries has been issued with an enforcement notice by the ODPC to ensure future compliance with the Data Protection Act.
