Cases
Abdinur Kassim & Luqman Hussein Kassim (Minor suing through his father & next friend) vs. Joyce Njoki Ngugi T/A Kora Spa
Case Summary
The Complainants, Abdinur Kassim and his minor son, Luqman Hussein Kassim, lodged a complaint against Joyce Njoki Ngugi T/A Kora Spa (the Respondent). They alleged that the Respondent unlawfully took and published photographs of the minor on its social media platforms for commercial purposes without obtaining the express consent of the Complainant (the father and legal guardian). The Complainant sought for the Respondent to cease processing the images, remove them from all platforms, and acknowledge the violation of the minor's privacy rights. The Respondent contended that the Complainants had visited the spa on multiple occasions and had given implied consent through their presence and participation in spa activities. The Respondent also claimed that upon receiving the complaint, they promptly removed the photographs.
Issues for Determination
The Office of the Data Protection Commissioner identified the following key issues for determination:
- Whether the Respondent obtained express consent from the Complainants to process their personal data (photographs) for commercial purposes.
- Whether the processing of the minor's personal data was lawful.
- Whether the Complainants are entitled to the remedies sought.
Determination
The Office of the Data Protection Commissioner made the following final determination:
- A declaration is hereby issued that the Respondent did not obtain the express consent of the Complainants to process their personal data for commercial purposes, contrary to Section 37 of the Data Protection Act, 2019.
- An Enforcement Notice is hereby issued against the Respondent.
- Parties have the right to appeal this determination to the High Court of Kenya.
Analysis
The ODPC's analysis strongly emphasized the heightened requirements for processing the personal data of minors and the strict principle of consent under the Data Protection Act, 2019.Firstly, the Commissioner reiterated that photographs constitute personal data, and their use, especially for commercial purposes, requires a lawful basis, typically consent.
Secondly, the ODPC focused on Section 37 of the Data Protection Act, 2019, which specifically addresses the processing of personal data relating to a child. This section mandates that such processing must be done in a manner that protects and safeguards the best interests of the child, and importantly, requires explicit consent from the child's parent or guardian. The Respondent's argument of "implied consent" was explicitly rejected as insufficient, particularly when dealing with a minor's data and for commercial use. The Commissioner found that no express consent was ever sought or obtained from the Complainant (the father) for the commercial use of his minor son's image.
Thirdly, while acknowledging that the Respondent removed the photographs upon receiving the complaint, the ODPC noted that this action did not negate the initial unlawful processing. The core violation was the lack of express consent from the outset for commercial purposes, and for a minor's data, this threshold is particularly high.
In conclusion, the ODPC found the Respondent liable for unlawful processing due to the absence of express consent, especially pertinent given the data subject was a minor. The issuance of an Enforcement Notice serves as a directive for the Respondent to rectify its practices and ensure future compliance with the Act's stringent requirements, particularly concerning children's data.