Summary

Brian Anyona Mogoi complained that Match Ventures Ltd used his image in advertising flyers for a land-selling business after photographing him covertly during a shamba site visit in April 2025, without his consent. The ODPC found unlawful commercial use of personal data and ordered KES 500,000 compensation.

Facts

The complainant alleged that in April 2025, while visiting a shamba site in Mangu, Nakuru County, the respondent photographed him without his knowledge. He discovered in May 2025 that his image had subsequently been used in advertising flyers for the respondent's land-selling business, which were circulated to members of the public for commercial promotion. He contended that the initial act of photography constituted unlawful collection of personal data, and its subsequent use in marketing materials compounded the violation. The complainant argued that the continued distribution of flyers caused him reputational harm, emotional distress, and infringement of his dignity and privacy under Articles 28, 31, and 40 of the Constitution. He characterised the use as unauthorized commercial exploitation of his likeness and noted that each day the flyers remained in circulation aggravated the harm. On 19 May 2025 he sent a demand letter to the respondent, which received no response. He sought compensation of KES 3,000,000, a cessation order, and recall of all advertising materials containing his image.

The respondent responded on 24 October 2025. It claimed the promotional campaign comprised images reasonably believed to be licensed stock photographs, and that the inclusion of the complainant's image was inadvertent and based on an honest belief that the image was authorised for use. It asserted that the flyer was prepared for a limited and controlled audience and was not intended for broad distribution, and that upon receiving notification of the complaint it promptly halted further distribution and retrieved remaining flyers. It attached a blank, unused consent form as evidence of its standard consent procedures, without producing any signed consent form from the complainant.

In his rejoinder, the complainant's advocates noted that the respondent had effectively admitted the central fact of processing — use of his image in commercial advertising flyers — and that the only remaining issue was the lawfulness of that processing. The complainant pointed out that the burden of proof lay entirely with the respondent to demonstrate consent, that the respondent's reliance on an unsubstantiated "reasonable belief" about stock library sourcing was unsupported by any evidence, and that the blank consent form merely underscored the absence of explicit consent. He further noted the respondent's failure to act on the May 2025 demand letter undermined its claimed good faith. He submitted that data protection operates under a strict liability regime and that lack of intent was relevant only to mitigation, not to the existence of liability.

The ODPC applied the consent framework under sections 2 and 30(1)(a) of the Act and the conditions of consent under section 32, finding the respondent had not demonstrated that the complainant was informed about the intended use of his image, had not shown any agreement by the complainant, and had produced no signed or recorded consent. The respondent's stock library assumption and blank consent form did not discharge the statutory burden of proof. The ODPC further applied section 37(1)(a) and Regulation 14(1) of the General Regulations, finding that use of the complainant's image in land-sales advertising flyers to promote the respondent's commercial business constituted use for commercial purposes requiring express consent that was not obtained. The ODPC accordingly found a violation and directed compensation of KES 500,000.

• Legal Provisions Reviewed

Holding

• The respondent is found liable for unlawful processing of the complainant's personal data for commercial purposes without express consent, in violation of sections 30(1)(a), 32(1), and 37(1)(a) of the Data Protection Act, 2019
• The respondent is ordered to pay the complainant KES 500,000 (Kenya Shillings Five Hundred Thousand Only) as compensation
• Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days

Comment

This case adds an important dimension to the ODPC's growing body of commercial image-use jurisprudence: the "stock library assumption" defence. Match Ventures argued that the image was reasonably believed to be a licensed stock photograph, and that its inclusion was therefore inadvertent. The ODPC dismissed this entirely, and correctly so — section 32(1) places the burden of proof on the data controller to establish consent, and a subjective belief about the source of an image, unaccompanied by any documentation, is not evidence of consent. The complainant's rejoinder framing is also notable: by conceding that processing occurred and directing the analysis solely to its lawfulness, the complainant's advocates efficiently reduced the dispute to a burden-of-proof question that the respondent could not answer. The case reinforces that due diligence on image sourcing is a compliance obligation, not an afterthought — and that producing a blank consent form as evidence of consent procedures is counterproductive, as it demonstrates the procedure exists while confirming it was not followed.