Appeal Court sets aside orders directing Kenya Railways Corporation to refund Sh127.4 million overpaid as rent by a company that leased its land in Mombasa.
Imagine waking up to the soft glow of dawn, stepping out to begin your daily routine when suddenly, you come face-to-face with an unanticipated sight — your own image!
The picture, larger than life and gazing down from billboards across the city, has been used in a promotional campaign you know nothing about.
This is the situation that Esther Kanza Mbuvu found herself in.
Without her knowledge or consent, her photograph had become the centre-piece of a promotional campaign used by Grain Industries Ltd, which the firm argues was intended to celebrate mothers across Kenya during Mother’s Day.
This did not sit well with Ms Mbuvu, so she lodged a complaint with the Office of the Data Protection Commissioner (ODPC) on March 6.
She took issue with the use of her image in the firm’s marketing billboards, YouTube promotions, and social media platforms under the caption “Tunashukuru mama wa Ajabu” without her consent.
She explained that it was around August 30, 2023, while she was going about her daily errands, that she encountered her images in these promotions.
“I saw a billboard that featured several photographic images, including one of myself,” she said.
The billboards in question were situated along the Mombasa Malindi Highway at Nyali, Kibarani, and in the Likoni area. Her primary concern was that the company did not seek her consent before using her images.
Ms Mbuvu then requested various remedies from the ODPC, including a declaration that the use of her image was without her consent and that the firm’s use of personal data for commercial purposes without consent constituted a breach of the Data Protection Act (DPA).
“I pray that the ODPC imposes a fine on the company for posting my image without consent, and another order for general damages for the unauthorised use of my image, along with any other order that this office may find appropriate to grant,” the woman said.
In its response, Grain Industries Ltd explained how it obtained the woman’s image.
The company stated that on July 13, 2023, it launched a promotional campaign aimed at celebrating mothers across Kenya during the Mother’s Day period by inviting participants to submit pictures of their mothers for public display on billboards and social media platforms.
“The campaign was open to individuals nationwide and was subject to Terms and Conditions that were made available to participants,” it said in a letter to the ODPC, addressing the woman’s complaint.
The firm further explained that it engaged Brainwave Communications Limited (Brainwave) as its marketing agency, which hosted a webpage through which participants enrolled to take part in the campaign.
The company stated that it indirectly collected Ms Mbuvu’s personal data from her daughter, relying on her (daughter’s) acceptance of the terms and conditions.
“The confirmation contained therein indicated that the woman’s daughter had sought her express written consent,” it argued.
Grain Industries Ltd informed the ODPC that the first billboard was erected on August 10, 2023, and throughout the campaign, the woman’s image was featured only on one billboard and one video on YouTube.
It further claimed that the first letter dated October 31, 2023, from the woman was sent to its general email address, which receives a high volume of emails daily, and that she did not provide the firm with a physical copy of the demand letter or any follow-up emails regarding the demand letter.
The company stated that the demand letter came to the management's attention in March of this year.
ODPC reviewed the woman’s complaint, the firm’s response, and all supporting documents provided by both parties. Records indicate that investigation officers visited the alleged locations where the billboards in question were situated and confirmed that they had been removed.
Violation of right
In its decision dated June 3, 2024, ODPC found Grain Industries Ltd liable for violating Ms Mbuvu’s right to be informed, her right of erasure, and for using her personal data for commercial purposes without obtaining her explicit consent.
ODPC then ordered the company to pay Ms Mbuvu Sh1 million as compensation.
The company, dissatisfied with the ODPC's ruling, filed an appeal at the High Court, requesting that the decision be fully overturned.
It contended that ODPC communicated its decision three days past the statutory deadline outlined in Section 56(5) of the Data Protection Act, 2019 (DPA), which it argues constitutes a legal error.
The firm further claims that ODPC improperly based its decision on Ms Mbuvu’s rejoinder without allowing the company an opportunity to review and respond.
It argued ODPC wrongly concluded that the company lacked a lawful basis for processing the woman’s data under the DPA and failed to recognise that the woman's adult daughter, acting as a data controller, bore the responsibility of securing consent.
“ODPC erred in law and fact in failing to appreciate that the burden of proving consent was validly obtained and was with her daughter,” the firm said.
Additionally, the company asserted that ODPC erred in ruling it had denied the woman her right to be informed of her data’s use and to request its erasure.
It disputed ODPC’s finding that its use of her data was “wholly commercial,” and argues that ODPC disregarded evidence presented by its service provider, Brainwave Communication Limited.
The company further disputed the Sh1 million award, stating it was unproven, and contests ODPC’s decision to absolve Brainwave of liability solely because of lack of a formal data processing agreement.
But Justice Julius Nga’ngar ruled that the firm had a duty to collect personal data directly from Ms Mbuvu unless it had sought an exemption to use information gathered from third parties.
“There is nowhere in the form signed by Ms Mbuvu’s daughter that indicates she herself had given consent for the use of her images. The only consent obtained was from a third party who was not the data subject,” said the judge.
Justice Nga’ngar noted that there was no evidence proving that the woman had consented to the collection of her data from another source; thus, the company could not rely on the exemption under Section 28(2)(c) of the Act.
“It was the appellant's responsibility to ensure that the participants of the campaign directly gave their consent. Therefore, this court finds that the appellant unlawfully processed the woman’s personal data. I see no reason to interfere with the ODPC’s finding,” he said.
The judge noted that although the company denied that the campaign was for commercial purposes and claimed it only aimed to celebrate mothers, the court recognised that a primary objective of marketing is to create brand awareness, which in turn attracts customers to purchase from the business entity.
The judge emphasised that the Act requires express consent before any personal data is obtained, processed, and used, and that the company was in breach from the very beginning.
“It matters not whether the billboards and YouTube videos lasted a day or four months. The appellant should not have used the woman’s personal data until it fully complied with its obligations under the Act,” he stated.
The judge dismissed the firm’s appeal, noting that the court found no fault in the ODPC’s award of Sh1 million for damages, adding that the amount was not excessively high to warrant interference from the court.
