Cases Detail

Cases

Shimlon Kuria v University of Kabianga (2022)

Country: Kenya
Court: High Court, Kericho
Status: Judgment
Tags: Digital identity,Right to privacy,Data protection

Attachments:

Summary

On February 10 2023, the Kericho High Court ruled that the university violated Shimlon Mwangi Kuria's fundamental rights to privacy and human dignity by publishing an image of him without his express consent. The petitioner was awarded Sh500,000 plus costs and interest at court rates from the date of this judgment until payment in full.

The petitioner was photographed at a University of Kabianga graduation ceremony on December 20, 2019, and the respondent used the petitioner’s image and persona for marketing purposes to solicit funds from the African Development Bank without his express consent. The respondent filed an opposition to the petition, claiming that the issue raised by Mwangi was not within the scope of the constitutional dispute to be resolved by the High Court and should have been litigated in a small claims court or magistrate court. The respondent, through a representative, denied being in a profit-making business and claimed that the petitioner's picture on its website did not constitute an infringement of his rights, but rather portrayed him in a positive light as a graduate.

Analysis

The Courts in Kenya have clearly established the place of image rights through precedents over the past five years. Precedents have developed a constitutional disposition in the claim for image rights, and ways to seek remedy for the infringement of such rights. Image rights are established under the right to privacy and the right to publicity. The case of Jessicar Clarise Wanjiru v. Davinci Aesthetics & Reconstruction Centre & 2 Others[2017] eKLR, established the three prerequisites for a successful claim on image rights.

  1. Use of a Protected Attribute: this is the use of an aspect of a person’s identity that is protected by the law. This ordinarily means a person’s name or likeness. Notably, the law protects certain other personal attributes as well (data protection laws include personal data).
  2. For an Exploitative Purpose: the use of the name, likeness, or other personal attributes for commercial or other exploitative purposes. The use of someone’s name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the identity and a matter of legitimate public interest.’
  3. No Consent: establish that a person did not give permission for the offending use.

In the case of Shimlo, all three grounds were established, the most important ground being consent. The respondents did not seek consent to use Shimlo’s images for marketing purposes. Further, it was clearly established that the use of images would lead to commercial benefits for the respondent. A further analysis of the case notes that remedies to image rights may also be sought under data protection laws. Data protection laws are designed to protect personal data from unlawful use.

Claims for image rights may be established under data protection. The majority of image rights cases in the Kenyan jurisdiction were filed prior to the enactment of the Data Protection Act (DPA) and were often grounded on infringement of constitutional rights. With the enactment of the DPA and operationalization of the office of the Data Commissioner, data protection may offer remedies to the unlawful use of images and or videos. In order to establish the remedy it is necessary to establish that images can be categorised as personal data.

Images as personal data

In establishing whether an image can be classified as personal data, we derive inference from the The General Data Protection Regulation (GDPR)and co-relate the same with the DPA. The Office of the Data Protection Commissioner (ODPC) is yet to establish guidance notes on images as personal data. Referencing the GDPR is meant to give more of a comparative highlight as well as derive understanding from other jurisdictions that have already clearly established images as personal data. GDPR recognizes images/photographs and even videos as personal data. The GDPR defines personal data as, “all information that relates to an identified or identifiable living individual, and also includes pieces of information that can lead to the identification of someone when collected together.” Images and videos alike form part of the information that can lead to the identification of a person as such they can be under the category of personal data. Similarly, the DPA defines personal data as, “any information relating to an identified or identifiable natural person.” The term any information leaves room for interpretation, images whether captured individually or as a group, or even randomly create instances for easy identification. Although there is no precedent on whether images form part of personal data in Kenya. Following an enforcement notice issued by the Office of the Data Protection Commissioner (ODPC) it may be inferred that images form part of personal data. An enforcement notice (notice issued upon complaint of failure to comply with the Data Protection Act Sec 58) was issued to Ecological Industries after a complaint was made with the Data Commissioner of the company’s use of an individual's personal photos for marketing purposes without her consent. The company was requested to remedy the situation by taking down all marketing materials that contained the images. Failure to comply with such a statutory notice would attract a fine not exceeding five million Kenyan shillings or imprisonment for not more than 2 years.

What is observable in remedies is that filing A complaint with the ODPC seeks more of an administrative remedy and in such instances, the complainant does not derive any form of monetary compensation as a result of the breach in comparison to seeking a judicial remedy.

Frequently Asked Questions

Frequently Asked Questions

A data subject is a natural person who is the subject of personal data held by a controller and who can be identified, directly or indirectly, through that personal data.

Each data subject has the right:

  • to be informed whether or not his or her personal data is being processed,
  • to request information about the processing, if data has been processed,
  • to be informed of the purpose of the processing and whether the data is being used in accordance with those purposes,
  • to be informed about third parties who receive personal data in Kenya and abroad,
  • to request the rectification of incomplete or inaccurate processed data, and
  • to request the erasure or destruction of personal data.

Data processing refers to any operation performed on personal data, either entirely or partially, automatically or manually. This includes collection, recording, storage, preservation, modification, revision, disclosure, transmission, assignment, making available, classification, or prevention of use.

Data controller: is a natural or legal person who determines the purposes and means of personal data processing and is accountable for the data filing system's establishment and administration.

Data processor: is a natural or legal person that processes personal data on the basis of a data controller's authorization.

The data controller or processor is required to provide the following information: the purpose of the processing, the recipients of the processed data and the purpose of the transfer, the method used to collect personal data and its legal basis, and any other rights granted to the data subject by law.

The principles governing data processing are as follows: it must be processed fairly and lawfully, it must be accurate and up to date, it must be processed for specified, explicit, and legitimate purposes, it must be adequate, relevant, and not excessive in relation to the purposes for which it is processed, and it must be retained for the duration specified by law or for no longer than is necessary for the subsequent processing.

A Data Protection Impact Assessment can be used to identify and mitigate high risks associated with data processing that may impact the rights and freedoms of data subjects.