Office of the Data Protection Commissioner (ODPC) has ordered Moja Expressway Company to pay its former employee identified as Cyrus Mwaniki Ndungu Kshs 500,000.
The company was found guilty of using Ndungu’s image for commercial purposes without his consent nearly a year after he had left the organization.
The case began when Cyrus Mwaniki Ndungu filed a complaint with the ODPC on February 16, 2024. Ndungu, who resigned from Moja Expressway in October 2022, discovered that the company continued to use his image in promotional videos for their Electronic Toll Collection (ETC) services.
These videos were designed to promote the ETC system to new customers, thus directly benefiting the company commercially.
Ndungu alleged that the continued use of his image without his explicit consent violated his right to privacy and caused him significant distress.
He argued that he had not given permission for his image to be used after his resignation and sought legal redress for this violation.
Legal Context
Kenya’s Data Protection Act, 2019, is central to this case, highlighting the importance of privacy and the necessity for clear consent when using personal data.
The Office of the Data Protection Commissioner was established to enforce this Act, with the authority to investigate complaints and ensure adherence to data protection principles.
The Act stipulates that personal data must be processed only for clear, specific, and legitimate purposes.
It also requires data controllers to obtain explicit consent from individuals before using their personal data for commercial purposes.
Additionally, the responsibility to prove that consent was obtained lies with the data controller.
Also Read: ICT Ministry Calls for Proactive Approach in Data Protection
The Investigation
After receiving Ndungu’s complaint, the ODPC notified Moja Expressway and requested a detailed response.
The company claimed that Ndungu had given oral consent to use his image, referencing a variation contract from October 2022, which they argued included promotional duties.
However, the ODPC’s investigation revealed critical flaws in the company’s defense.
There was no documented evidence that Ndungu had agreed to the continued use of his image after his resignation.
The ODPC stressed that oral consent must be corroborated by other evidence, particularly after the employment relationship has ended.
The continued use of Ndungu’s image post-resignation was deemed incompatible with the original purpose for which the data was collected.
ODPC highlighted that explicit consent is required for any further processing of personal data, especially for commercial use.
Also Read: Details of Africa’s First Data Center Ruto Has Partnered with Microsoft to Build
Verdict
On May 15, 2024, the ODPC ruled in favor of Ndungu, concluding that Moja Expressway had violated his data privacy rights.
The Commissioner ordered the company to compensate Ndungu with Kshs 500,000 for the unauthorized use of his image.
Additionally, Moja Expressway was directed to revise their data handling practices ensuring all employees are aware when their personal data is collected, and that explicit consent is obtained for any commercial use.
Do you want to be part of an updated community without the interruptions of unwanted messages? Click the link below and join our WhatsApp Channel!
https://whatsapp.com/channel/0029VaB3k54HltYFiQ1f2i2C
