A series of promotional posts on TikTok and Instagram has landed social media influencer Waithera Imani, popularly known as Cera Imani, in trouble with the data protection regulator for allegedly breaching the privacy rights of a fellow citizen.
Cera Imani, who boasts over 200,000 followers on Instagram and 139,000 on TikTok, has now been ordered to pay Sh50,000 as compensation for the violation.
The complaint was lodged by Ian Itolondo Mutoro, who accused the influencer of collecting, processing, and disclosing his personal data without his knowledge or consent.
Mutoro alleged that Ms Imani featured his full name and photograph in a promotional video published on her Instagram and TikTok accounts while promoting ESHE, a brand with which she is affiliated.
Mr Mutoro maintained that he did not at any time consent to the collection, use, or disclosure of his personal data for promotional or marketing purposes on social media platforms.
He argued that the publication unlawfully associated him with a commercial product, creating the misleading impression that he had endorsed or was affiliated with ESHE.
He further claimed that the posts had caused him emotional distress and reputational harm, exposing him to risks of impersonation, misrepresentation, and further unauthorised use of his personal data by third parties.
In her defense, Ms Imani claimed that Mr Mutoro had given express consent to being featured on the ESHE digital application and in related promotional activities.
She argued that Mr Mutoro had requested visibility on the platform as a medical professional in the hope of attracting referrals and new clients.
The social influencer further claimed that Mr Mutoro was aware of the content before publication, as the video was shared with him in advance, and no objection was raised at that time. Moreover, both parties understood the content to be promotional in nature and consistent with Mr Mutoro’s request for visibility.
Social media influencer Waithera Imani, popularly known as Cera Imani.
Photo credit: Pool
“Any appearance of his details was connected to his own request for professional exposure and client acquisition,” Ms Imani told the Office of the Data Protection Commissioner.
She further maintained that Mr Mutoro’s professional information, including his name, photographs, and practice details, was publicly available through independent sources, including general internet search engines and that she did not introduce any new private or confidential data into the public.
But in a rejoinder, Mr Mutoro challenged the claim of consent, citing the absence of proper documentation and failure to comply with data protection standards.
“ESHE did not have clear, transparent, or effective mechanisms in place when the data was used for marketing, and this omission materially contributed to the harm suffered,” Mr Mutoro argued.
He went on to state that upon discovering the publication, he immediately contacted the ESHE chief growth officer to have the video removed, but his request was dismissed, and the content remained accessible on TikTok and Instagram.
Mr Mutoro also alleged that the videos contained false and misleading statements, including an inaccurate representation of his professional role.
He said individuals who viewed the video approached him with inappropriate and uncomfortable comments, causing embarrassment and psychological distress.
Social media influencer Waithera Imani, popularly known as Cera Imani.
Photo credit: Pool
In the ruling, the Data Commissioner noted that Ms Imani was not able to prove her claims of having obtained express consent.
“The Office observes that the Respondent alleges that the Complainant consented to being featured on the ESHE application and in promotional activities. However, the Respondent did not provide any documentary, verifiable, or auditable evidence demonstrating that the Complainant gave express, informed, and specific consent for the use of his name and image in social media promotional videos on TikTok and Instagram. The Respondent's assertion of consent is therefore unsupported,” stated the Data Commissioner.
“The Respondent is hereby found liable for unlawfully processing and publishing the Complainant's name and image on TikTok and Instagram for promotional and commercial purposes without obtaining express, specific, and informed consent as required under the Data Protection Act. The Office hereby orders the Respondent to pay the Complainant Sh50,000 as compensation.”
