Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Tabitha Mwaniki discovered that her photo, taken during a salon visit, was posted online by the nail spa without her permission. When her request to remove it was ignored, she reported it to the ODPC. The spa claimed implied consent, but the ODPC ruled in Tabitha’s favor and ordered an apology and the creation of a data protection policy.

Facts

The complainant, Ms. Tabitha Mwaniki, lodged a complaint with the Office of the Data Protection Commissioner (ODPC) against the respondent, Ms. Rose Gatabai, trading as Tiara Nail Spa. The complaint arose from the unauthorized use of the complainant’s image, which was captured during a visit to the spa and subsequently published on the business's social media platforms for marketing purposes.

Ms. Mwaniki asserted that the respondent neither sought nor obtained her consent to capture or disseminate her image. Despite several requests for the removal of the image, no remedial action was taken by the respondent until after the complaint was escalated to the ODPC.

In response, the respondent contended that the image was used in good faith and that there was an assumption of implied consent. However, the respondent did not provide evidence of any explicit or informed consent, as required under the Data Protection Act, 2019.

Upon investigation, the ODPC found that the respondent had contravened Section 25 and Section 31 of the Act, particularly the principles of transparency and accountability, and the requirement for informed consent in processing personal data for commercial purposes. The Commissioner emphasized that the use of an individual’s image in marketing requires clear and affirmative consent.

Evaluation of Applicable Laws

• Section 25 of the Act: Sets out the principles of data protection, including lawful, fair, and transparent processing of personal data.
• Section 26(a) of the Act: Provides the right to be informed of the use of personal data.
• Section 26(d) of the Act: Provides the right to object to the processing of personal data.
• Section 31 of the Act: Requires that consent for processing personal data must be clear, informed, and unambiguous.

Holding

The Data Commissioner made the following final determination. The Respondent: