Summary

A Kenyan brand influencer complained that Michael's Bouquet used her image on print media and pull-up banners across multiple shopping malls, well beyond the agreed three-month Instagram campaign and without her express consent. The ODPC found violations of the commercial use and consent provisions of the Act and ordered KES 500,000 in compensation.

Facts

The complainant lodged her complaint with the ODPC on 23 May 2025. She alleged that in December 2021, she entered into an agreement with the respondent (Michael's Bouquet) to market its brand strictly through Instagram postings, for a defined period of three months only. She stated that she had not authorised the use of her image in print media, on pull-up banners, or in any campaign extending beyond the agreed period. Contrary to the agreement, her photographs subsequently appeared on pull-up banners displayed at multiple shopping malls, including Nextgen, Naivas Rongai, Imaara, and later in Mombasa and at The Hub Karen, well after the agreed campaign period had lapsed. In July 2022, the complainant issued a demand letter requiring the respondent to immediately cease the unauthorised use of her image, but the respondent disregarded the demand. She averred that the respondent's unauthorised commercial exploitation of her image and likeness caused reputational and financial harm, including the loss of two business opportunities with beauty product brands. She sought compensation for the losses and damage suffered, as well as removal of the material from all platforms.

The respondent failed, refused and/or neglected to respond to the notification of complaint. Consequently, the allegations against it remained uncontroverted.

The ODPC addressed two issues: whether the respondent obtained the complainant's consent for commercial use, and whether the respondent violated the complainant's right to erasure. On consent, the ODPC applied Section 2 of the Act, which defines consent as an express, unequivocal, free, specific, and informed indication of a data subject's wishes by a statement or clear affirmative action. Section 30(1)(a) provides that a data controller shall not process personal data unless the data subject consents for one or more specified purposes. Section 32(1) places the burden of proof for establishing consent squarely on the data controller. The evidence established that the respondent had agreed to use the complainant's image exclusively on Instagram for a fixed period; it failed to provide any evidence demonstrating that the complainant expressly consented to the use of her image on print media and public banners, or for a duration extending beyond the agreed period. The ODPC also applied Section 37(1) and Regulation 14(1) of the Data Protection (General) Regulations, 2021, which prohibit using personal data for commercial purposes without express consent, defining commercial use as including use of personal data to advance commercial or economic interests. The respondent's conduct fell within this definition. On erasure, Section 40(1)(a) provides the right to require erasure of data no longer authorised to be retained or obtained unlawfully. The complainant had demanded removal of all print and banner materials, but the respondent neither responded nor acted on this request, in violation of Regulation 12(3) of the General Regulations, which requires a response to an erasure request within 14 days. The ODPC accordingly found the respondent in violation of the complainant's right to rectification and erasure.

• Legal Provisions Reviewed

Holding

• The respondent, Michael's Bouquet, is found liable for the use of the complainant's image for commercial purposes without express consent, in violation of Sections 30(1)(a), 32, and 37(1) of the Act.
• The respondent is found to have violated the complainant's right to rectification and erasure under Section 40(1)(a) of the Act.
• The respondent is ordered to pay the complainant KES 500,000 as compensation.
• Parties have the right to appeal this determination to the High Court of Kenya within thirty (30) days.

Comment

This case is significant for practitioners advising on influencer and brand partnership agreements. The determination makes clear that consent given for a specific medium (Instagram) and a defined time period does not carry over to other media (print, banners) or extended campaigns — even where a commercial relationship existed. Brands relying on pre-existing paid engagements as an implied licence for ongoing use of an influencer's likeness do so at considerable legal and financial risk. The KES 500,000 award — among the higher compensation orders in ODPC jurisprudence — appears to reflect both the breadth of the unauthorised commercial exploitation and the reputational harm alleged, setting a meaningful benchmark for image-rights cases.