Cases
Mohammed Orukoh vs Koru Country Club
Case Summary
The Complainant, Mr. Mohammed Orukoh alleged that the respondent posted and used his photo in their official Facebook account to advertise their facilities including a swimming pool on 24th May 2022. The Complainant further alleged that the photo was taken without his consent and the respondent has maintained the picture on its Facebook page for over a year. Mr. Orukoh claims that the half-naked picture of him is hurting his reputation as a father and a teacher and that he comes from a strong Christian background.
The Respondent stated that a staff member personally spoke to the Complainant and took his consent and that it is malicious to complain 17 months after the post was posted.
Issues For Determination:
1. Whether the Complainant's personal data was processed as per the law;
2. Whether the Complainant's rights were infringed upon; and
3. Whether the Complainant is entitled to any remedy under the Act.
Determination:
The Complainant’s data was not processed as per the law since section 30(1)(a) sets out that the data subject must consent to the processing of his or her data for one or more specified purposes. The Complaint did not expressly consent to his image being used by the Respondent. Having established there was no valid consent given, it therefore follows that the Complainant was never informed of the use of his photograph as per Section 26(a) of the Act.
The Complainant is entitled to Kshs 750,000/= for the use of his image for commercial gain without consent.
Analysis:
Article 31 (c) and (d) of the Constitution of Kenya provides for the right to privacy. Additionally Section 30 and 32 of The Data Protection Act outlines that consent must be obtained from data subjects. What this case demonstrates is that before any personal data is used for any activity, including commercial use, then the data subject must have given his or her consent. Central to this principle is the requirement for data controllers to obtain explicit consent from individuals before utilizing their personal data for any purpose, especially in commercial endeavours. This means that individuals must be fully informed about how their data will be used and must actively consent to its processing.
Without such consent, the use of personal data could potentially infringe upon individuals' privacy rights. Furthermore, the case underscores the potential legal and financial consequences of failing to comply with data protection regulations. Data protection laws typically include provisions for penalties, such as fines and enforcement notices, for non-compliance. These penalties serve as deterrents against improper data handling practices and help safeguard individuals' privacy rights.