Cases
Mercy Wambua & 2 others vs Bold Decisive & 1 other
Case Summary
The 1st Complainant came across her image and that of the 2nd and 3rd Complainants (Collectively, 'the Complainants’) on a pamphlet bearing the company logo of the 2nd Respondent. The pamphlet contained a picture of her and her two children, which she has previously posted on her social media page. The pamphlet was allegedly used as a marketing proposal. The 1st Respondent avers that the proposal document was an internal and confidential document meant solely for purposes of a private pitch and illustration to Equity Afia only, and was not meant for any public consumption whatsoever.
Issues for determination:
- Whether the Complainants' claim on infringement of their right to privacy by the Respondent has merit according to the Act;
- Whether the respondent in its actions or otherwise caused a personal data breach against the Complainants.
- Whether the Complainants are entitled to the remedies sought for the alleged breach.
Determination
The ODPC concluded that the1st Respondent had a duty and responsibility as a data controller and processor to the Complainants as data subjects and it was indeed, according to the Act and Regulations, mandatory for it to seek for consent from the 1st Complainant. The complaint against the 1st Respondent is therefore merited.
The Respondent through its actions of printing the pamphlet with the picture of the Complainant and her children caused a personal data breach.
The Complainant is entitled to Kshs. 1,900,000.00/= for the use of their images for commercial gain without her consent and for the infringement and/or violation of her rights.
Case Analysis
According to the ODPC, the existence of the right to privacy means that there exists a duty either not to disclose information or prevent unauthorized access. Section 28(2)(b) provides that data may be collected indirectly where the data subject has deliberately made the data public. However, Regulation 6(3) of the Data Protection Regulations provides that where a data controller collects personal data indirectly, they must inform the data subject within fourteen days. This case has the added dimension of the privacy of children. Section 33 of the Act provides for processing of personal data relating to a child. It provides that every data controller not process personal data relating to a child unless consent is given by the child's parent or guardian. This once again underscores the importance of consent especially when relating to children.
In addition, section 25 dictates that that personal data must be processed lawfully, fairly, and transparently. Additionally, data should only be collected for explicit, specified, and legitimate purposes, with measures in place to ensure its accuracy and relevance. The failure to adhere to these principles can result in violations of individuals' privacy rights and lead to legal repercussions.
By providing remedies to data subjects, it reinforces the significance of safeguarding privacy in an era of increasing digitalization. This process not only serves as a means of redress for individuals whose rights have been infringed upon but also acts as a deterrent against future breaches of data protection laws. It sends a clear message to data controllers and processors that non-compliance with data protection regulations can result in significant financial consequences. Moreover, by holding entities accountable for their actions, this determination promotes a culture of transparency and accountability in data handling practices.