Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Faith Kadeiza Agosa, a former trainee, complained that Wigot Gardens Hotel used her image for commercial marketing on social media for two years post-attachment, without her consent or remuneration. The Respondent failed to prove consent for commercial use. The ODPC found Wigot Gardens liable for unlawful processing and ordered them to pay KES 250,000/- compensation.

Facts

The Complainant, Faith Kadeiza Agosa, was a former trainee who undertook her industrial attachment with Wigot Gardens Hotel between October 2021 and January 2022. The Complainant alleged that the Respondent unlawfully and without justifiable cause collected and processed her image for commercial purposes, including marketing, advertising, and promotional activities to further its business interests. She stated that during her attachment, the Respondent took photographs, which it then used on its public platforms to advertise and market its hospitality training school. Crucially, the Complainant asserted that she was neither informed nor consulted about the purposes for which her data was being collected and used, nor did she sign any consent or approval for her images to be collected or processed. She maintained that the Respondent's continuous use of her images for commercial purposes and economic gain, persisting for a period of approximately two years after the completion of her attachment, was unauthorized, unfair, unjust, and unlawful, constituting an unauthorized exploitation of her likeness and a violation of her rights.

The Respondent, Wigot Gardens Hotel, acknowledged that the Complainant undertook an industrial attachment with them from October 2021 to February 2022. The Respondent stated that its subsidiary, Wigot School of Hospitality, requested the Complainant and other students to participate in a photo and video session, which they claimed was clearly explained to all participants to be used for marketing and promotional purposes. The Respondent alleged that the Complainant voluntarily consented to participate in the session. Furthermore, the Respondent claimed that all participants, including the Complainant, signed consent forms authorizing the use of their images for marketing purposes. However, the Respondent admitted that the Complainant’s signed consent form was presently unavailable, having been misplaced "due to the lapse of time" since the marketing campaign was undertaken. The Respondent also noted that the photographs were uploaded during the course of the industrial attachment.

The ODPC focused its investigation on three key issues: whether the Respondent obtained the required consent for commercial purposes, whether the Respondent violated the Complainant’s rights under the Act, and whether the Complainant was entitled to remedies.

1. Consent for Commercial Purposes: It was undisputed that the Respondent used the Complainant’s image on its social media marketing platform to advertise and market its services, constituting use for commercial purposes. For commercial use, the law requires that a person shall not use personal data unless they have sought and obtained express consent from the data subject. The law places the burden of proof on the data controller (the Respondent) to establish a data subject’s consent for the processing of personal data for a specified purpose. The ODPC found that the Respondent failed to furnish evidence of the Complainant's express consent to the use of her image for commercial purposes, particularly since the signed forms were "unavailable". Therefore, the ODPC concluded that the Respondent did not obtain the requisite consent required by the Act to process the Complainant's images for commercial purposes.
2. Violation of Rights: The ODPC reviewed the claimed violation of rights, including the right to object to processing and the right to erasure of data. However, the ODPC found that the Complainant did not furnish the Office with any evidence demonstrating that she sought to exercise her rights under the Act prior to lodging the complaint. Consequently, the ODPC was unable to establish a violation in this regard.
3. Entitlement to Remedies: Based on the finding that the Respondent processed the Complainant's image for commercial purposes without the requisite consent stipulated under the Act, the ODPC found that there had been a violation of the Act. The Complainant was entitled to compensation for damage, which includes distress. The ODPC also took cognizance that the Complainant's images had been pulled down by the Respondent in a bid to resolve the complaint.

• Legal Provisions Reviewed

Holding

In its final determination dated 31st July 2025, the Data Commissioner made the following orders:

1. The Respondent (Wigot Gardens Hotel) was found liable.