Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Comfort Muthoni Gachiri complained The Storage Trading Company used her images for marketing without consent, continuing after her employment ended. The ODPC found the Respondent failed to obtain express consent for commercial use. The Data Commissioner ruled the Respondent liable and ordered compensation of KES 500,000 for the infringement of her rights.

Facts

The Complainant, Comfort Muthoni Gachiri, lodged a complaint on 13th March 2025, alleging that the Respondent, The Storage Trading Company Limited, was using her personal data in the form of images for marketing without her consent. The Complainant stated that she was an employee of the Respondent but her employment was terminated on 27th November 2024. Despite the termination of her employment, the Respondent continued to use her images in its marketing campaigns.

Specifically, she contended that the Respondent continued to use her images in advertisements across Meta platforms (Facebook, Instagram, YouTube), and on the Respondent's website. She further stated that she never consented to the use of her images for marketing, advertising, or any other commercial purposes. She claimed the images were used in aggressive advertising campaigns on social media platforms, leading to significant client acquisition and substantial profits for the company. She also alleged that the Respondent failed to anonymize her images, making her easily identifiable in advertisements, and that the Respondent shared her image with other third parties who continued using it for advertisement. Furthermore, the Respondent continued using her personal images for advertisement even after her employment termination, prompting her to issue a formal demand letter to cease the use.

The Respondent, The Storage Trading Company Limited, acknowledged that the Complainant was employed by the company from 1st May 2019 to 30th November 2024, serving as a Sales Manager. The Respondent's position was that the images were taken with the Complainant’s full knowledge and consent during her employment, specifically in her capacity as a sales manager. They asserted that the images were used to support the company’s marketing and sales strategy. Crucially, the Respondents claimed that no economic benefit had been derived from the use of the images beyond what was earned during the Complainant's employment. They also supported their case by adducing the employment contract between the Complainant and the Respondent.

However, the sources note that as of the date of the determination, the Respondent failed, refused, or neglected to respond to the Notification of Complaint regarding several important details, including the contractual agreement, details on how the Complainant's personal data was obtained, and whether the Complainant gave express consent for commercial use pursuant to Section 37 of the Act.

The Office of the Data Protection Commissioner (ODPC) determined two primary issues: whether the Respondent obtained express consent to process the Complainant's personal data for commercial purposes, and whether the Complainant was entitled to remedies.

The ODPC found that the Complainant's personal images were used to advertise the Respondent’s products. This constituted the use of the Complainant’s image for commercial purposes, which required express consent. The Office analyzed the employment contract and found no contractual term relating to the use of her image for advertisement.

Under the Act, the data controller or data processor bears the burden of proof for establishing a data subject's consent for a specified purpose. Express consent requires a clear written statement confirming agreement or can take forms such as clicking an opt-in button or linking, granting a signature, or responding to an email request. The Respondent's contention that an implied consent was inferred through the Complainant's action or position (such as being a Sales Manager) was not sufficient to meet the requirement for express consent as required by the Act.

The ODPC ultimately found that the Respondent did not obtain the requisite express consent required by the Act to use the Complainant’s image for commercial purposes, thereby infringing her rights.

• Legal Provisions Reviewed

Holding