| Authority | ODPC – Kenya |
|---|---|
| Jurisdiction | Kenya |
| Relevant law | Data Protection Act, 2019: ss. 2, 8(1)(f), 30(1)(a), 32(1), 37(1), 40, 56, 58, 65(1), 65(4); Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021: regs. 11, 14(2), 14(3)(e), 16; Data Protection (General) Regulations, 2021: reg. 14(1) |
| Type | Complaint |
| Outcome | Violation (partial — consent violation upheld; erasure violation not upheld) |
| Started | 13 May 2025 |
| Decided | 8 August 2025 |
| Published | Yes |
| Fine | KES 250,000 (compensation) + Enforcement Notice |
| Parties | Winnie Nyakerario Charles vs. China Square Kenya Kisumu Branch |
| Case No. | ODPC/CIE/CON/2/3(092) — ODPC Complaint No. 0688 of 2025 |
| Appeal | N/A |
| Original Source | ODPC |
| Original Contributor | MZIZI Africa |
Winnie Nyakerario Charles complained that China Square Kenya used her image on an in-store promotional banner and on its official Facebook page without her consent. The ODPC found unlawful commercial use under section 37, awarded KES 250,000 compensation, and issued an Enforcement Notice. The respondent's disclaimer notice defence was expressly rejected.
The complainant lodged a complaint on 13 May 2025, alleging that on or about 20 December 2024 the respondent published her image on promotional banners at its Kisumu branch bearing the words "HOLIDAY PROMO: SHOP AT CHINA SQUARE AND ENJOY EXCLUSIVE CONNECT COFFEE DEALS." The same image and promotional material were also published on the respondent's official Facebook/Meta page under the handle "China Square Kenya." The complainant stated that the photograph was taken without her knowledge or consent, and that the use of her image was intended to enhance the respondent's store visibility and profitability through product promotion. She noted that while the respondent routinely blurred the images of other customers in its promotional postings, no such blurring was applied to her image — singling her out without justification. Her image remained in circulation from 20 December 2024 until 17 February 2025, when it was taken down following receipt of her demand letter. She further contended that the use created a false public perception that she was affiliated with the respondent as a brand ambassador, which she characterised as false and misleading. The complainant submitted photographic evidence of the in-store banner and screenshots of the Facebook page showing the banner.
The respondent responded on 31 July 2025. It asserted that all its stores, including the Kisumu branch, display a disclaimer notice at the entrance notifying customers that photography and videography may occur for marketing purposes, and that entry into the premises amounts to implied consent unless an objection is raised at the customer service desk. It maintained that this constituted valid consent. It denied that the complainant's image was used for commercial exploitation, characterising it as part of a general festive promotional banner not linked to the complainant by name, endorsement, or association with any specific product or role. The respondent further claimed that the image was not captured covertly, was taken in a public area of the store, and that the data processing was lawful. As mitigation, it stated that upon receipt of the demand letter it had reviewed its internal media and image use policies, developed image release forms for future campaigns, and intended to conduct staff training on data protection compliance.
The ODPC determined three issues: whether the respondent obtained valid consent, whether the complainant's right to erasure was violated, and whether remedies were available. On consent, the ODPC applied the statutory definition under section 2 of the Act — requiring consent to be express, unequivocal, free, specific, and informed, demonstrated by a statement or a clear affirmative action — and section 32(1), which places the burden of proof on the data controller. The ODPC found that the respondent's disclaimer notices at the store entrance did not satisfy the threshold of valid consent under the Act. The ODPC held that disclaimers of this nature constitute mere notification that photography may occur, and cannot substitute for the informed, affirmative, and explicit agreement required by section 2. The ODPC further found that the "free" element of consent requires real choice and control — where a person would face negative consequences for not consenting, such as being refused entry to the store, consent cannot be considered freely given. The respondent did not produce evidence of express consent from the complainant to process her image on a public banner or social media platform, and accordingly failed to discharge its burden of proof under sections 32(1) and 37(1).
On the right to erasure, the ODPC found under section 40 of the Act and Regulation 12(3) of the General Regulations that the respondent, upon receipt of the complainant's demand letter via her advocates on 17 February 2025, promptly and effectively complied with the request by removing the image from both the physical store and its Facebook page. Both parties acknowledged this. The ODPC accordingly found that the respondent did not violate the complainant's right to erasure. On remedies, the ODPC applied section 65(1) and (4) — noting that damage includes financial and non-financial loss including distress — and took into account that the images had since been removed. It directed compensation of KES 250,000. The ODPC also found that the respondent had violated the complainant's right to be informed and had failed to fulfil its obligations under the Act, and accordingly issued an Enforcement Notice under section 58.