Kenya’s data privacy watchdog has ordered Moja Expressway Company, the private operator of Nairobi’s toll road, to pay KES 500,000 in compensation for unlawfully using a former employee’s image and likeness in promotional videos after he left the company last year.
In a 12-page determination seen by the Sharp Daily, the Office of the Data Protection Commissioner ruled that Moja Expressway violated data protection laws by publishing marketing videos in October 2023 that depicted Cyrus Mwaniki Ndungu as still working for the toll road operator nearly a year after his resignation in late November 2022.
“The Respondent did not seek consent from the Complainant to further process his personal data after he resigned from employment,” Data Commissioner Immaculate Kassait wrote, referring to Mr. Ndungu as the Complainant.
The ruling marks one of the largest fines levied so far under Kenya’s relatively new data privacy laws, which were enacted in 2019 to align the country with strict European GDPR standards and protect individuals’ rights over use of their personal information.
In her determination, Ms. Kassait said Moja Expressway had no legal basis to use video footage and images of Mr. Ndungu, a former toll attendant and salesperson, for commercial purposes after he left the company in late 2022. The videos in question featured him explaining how to subscribe to Moja’s Electronic Toll Collection service.
Moja Expressway had argued that as a sales employee, it was part of Mr. Ndungu’s job duties to appear in such operational videos, and that he had orally consented while working there. The company presented an unsigned consent form it claimed was for that purpose.
However, the regulator rejected those arguments, saying any alleged oral approval ceased being valid once Mr. Ndungu’s employment contract ended in November 2022. The determination stated that by publishing the videos seven months later, Moja failed to obtain the “express consent” required by law for commercial use of his personal data.
“The Respondent relied on the variation contract dated 5th October 2022 which contained the Complainant’s job description…However, once the Complainant resigned from his employment, the Respondent should not have further processed his personal data in a manner that was incompatible with the purpose for collection in the first place,” Ms. Kassait wrote.
“Again, to be consistent with the purpose for collection, the Respondent should have obtained further consent from the Complainant to use his image in the video in question.”
The decision outlines how Kenyan regulators view use of an individual’s image, video, or likeness to promote a company’s products or services as constituting unlawful “commercial use of personal data” unless explicit consent is granted, even for former employees.
“Posting the video containing the Complainant’s image to explain to customers on how to subscribe to and install the ETC and OBU is considered as commercial use of personal data,” the determination stated, referring to Moja’s electronic toll collection system and on-board units for motorists.
In addition to the KES 500,000 fine, which Moja can appeal to the High Court within 30 days, the Data Commissioner also directed the company to revise its data practices. Her written decision instructed Moja Expressway “to ensure that all its employees are notified that their personal data is being collected and that they establish a lawful basis for use of personal data and more importantly, a record of consent, when the use of personal data is for commercial purposes.”
In her ruling, Ms. Kassait emphasized that Kenyan laws require data controllers like Moja to demonstrate they had obtained a data subject’s “express, unequivocal, free and specific consent” before processing their personal information for any purpose.
