Summary

Alexander Mwendia complained that Hello Tractor Kenya Limited used his image on a promotional roll-up banner at the 2024 Nairobi International Trade Fair without his consent. The ODPC found Hello Tractor was the data controller responsible for the processing and ordered KES 500,000 compensation for commercial use without express consent.

Facts

The complaint concerned the use of the complainant's image on a promotional roll-up banner displayed at the Nairobi International Trade Fair at Jamhuri Park between 23 and 29 September 2024. The complainant had previously filed Complaint No. ODPC/COMP/0816/2025 against Hello Tractor directly, following the Office's earlier decision to decline admission of that complaint on the grounds that the issues mirrored those addressed in Complaint No. ODPC/COMP/0535/2025 filed against AGRA, which had been resolved through ADR. Through his advocates, the complainant contended that Hello Tractor's processing was independent of and different from AGRA's — that Hello Tractor sourced, designed, and displayed the image on the banner without valid consent, and in doing so acted as data controller, contrary to sections 25 and 32 of the Act. He further argued that AGRA had denied any data controller or data subject relationship with him, and that neither AGRA nor Hello Tractor had produced evidence of a valid consent or contractual arrangement authorising the use of his image. He adduced a photograph of the roll-up banner and AGRA's response letter from the earlier complaint.

The respondent's case was that upon internal review, it found no liability on its part, as it understood AGRA had taken full responsibility for the use of the complainant's image. Hello Tractor asserted it had not shared the image with AGRA for commercialisation or publication, and that any communication between the parties was solely for internal or household use between business partners. The respondent characterised the complaint as an attempt at unjust enrichment, describing the events as a single series of related occurrences conclusively addressed through the earlier AGRA settlement.

The ODPC examined the letter from AGRA's legal representatives, which the complainant submitted as evidence. AGRA's letter distanced AGRA from the respondent's position entirely: AGRA confirmed it had retained Hello Tractor's promotional services for the 2024 Trade Fair and stated that in the processing of the complainant's image, Hello Tractor was the data controller, responsible for ensuring that image processing complied with the Act. AGRA stated that it was Hello Tractor that created and disseminated the image on the roll-up banner, and that AGRA's only involvement was that its logo appeared on the banner. The respondent did not adduce any evidence to rebut AGRA's position. The ODPC accordingly found that responsibility for the processing rested with Hello Tractor.

Applying sections 30(1)(a) and 32(1) of the Act and Regulation 4 of the General Regulations, the ODPC found that the burden of proof for consent lies with the data controller, and that the respondent had neither sought nor obtained the complainant's express consent to process his personal data for commercial gain. Under section 37(1)(a) and Regulation 14(1) of the General Regulations, the ODPC found the use of the complainant's image at a trade fair to be commercial in nature — intended to induce members of the public to become clients of the respondent's business. The ODPC accordingly found a violation and directed compensation of KES 500,000.

• Legal Provisions Reviewed

Holding

• The respondent is found liable for use of the complainant's personal data for commercial purposes without express consent, in violation of sections 30(1)(a) and 32(1) of the Data Protection Act, 2019, read with section 37(1)(a) and Regulation 14(1) of the General Regulations
• The respondent is ordered to pay the complainant KES 500,000 (Five Hundred Thousand Kenya Shillings Only) as compensation
• Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days

Comment

This case raises an important data controller identification question in commercial supply chains: where a service provider creates and distributes promotional materials featuring a third party's image on behalf of a client, which entity bears data controller responsibility under the Act? The ODPC's answer — that the entity that sourced, designed, and disseminated the image bears controller liability — is reinforced here by AGRA's own written disavowal of responsibility. Practitioners advising marketing agencies and promotional services businesses should note that outsourcing event marketing to a third party does not transfer data controller obligations to the commissioning party. The respondent's inability to produce any evidence rebutting AGRA's position was fatal to its defence.