DATA PROTECTION AND MARKETING CAMPAIGNS: AN ANALYSIS OF ESTHER MBUVU V GRAIN INDUSTRIES

As Kenya becomes increasingly connected through digital platforms, protecting personal information is more important than ever. Whether shopping online, signing up for services, or even participating in marketing campaigns, people are constantly sharing their data. Unfortunately, many are unaware of how their information is being used, which can lead to privacy violations. The Kenyan Data Protection Act, 2019 was established to ensure that individuals have control over their data and that it is not misused by companies or other entities.?

The Office of the Data Protection Commissioner (ODPC), as outlined in Section 5 of the Kenyan Data Protection Act, 2019, is responsible for ensuring compliance with data protection laws and handling complaints regarding violations. The office also advises organizations on data protection, enforces penalties for breaches, and collaborates with other regulatory bodies to ensure consistent practices.

Any complaints related to rights in the Data Protection Act are therefore brought to the ODPC. The recent case of Esther Kanza Mbuvu V Grain Industries Limited [Complaint 387 of 2024]? highlights the importance of these protections. In this case,? a woman discovered that her image had been used in a company’s marketing campaign without her consent. The photo was submitted by her daughter as part of the campaign, but the company failed to get the mother’s approval, which is a clear violation of the law. The Data Protection Act requires that any organization using someone’s personal data—including images—must obtain consent from the individual, not through a third party.

The allegations brought up against the Company:

1. The company used the complainant’s image without her consent.
2. The company’s use of the complainant’s data for marketing purposes amounted to a breach of her privacy under the Data Protection Act.
3. The complainant requested the Office of the Data Commissioner to impose a fine on the company for posting her image without her consent.
4. The complainant also sought damages for the inconvenience caused by the use of her image without her consent.

ODP C's Determinations:

1. The ODPC found that the company failed to obtain direct consent from the complainant to use her images. The complainant’s daughter had entered the marketing campaign and submitted photos of her mother, thus not meeting the requirement in Section 28(1) of the Data Protection Act to obtain consent directly from the subject.
2. Section 26(a) of the Act provides that a data subject has the right to be informed of the use of her data and the right to request erasure of her data by Section 40(1)(b) of the Act. Despite the complainant sending a demand letter exercising her right of erasure, the company failed to respond within fourteen days as required by Regulation 12(3) of the Data Protection Regulations. The ODPC found that the complainant’s rights to be informed and to erasure were violated.
3. Regarding the company’s obligations under the Act, since the company used the complainant’s photo to attract other customers, they were required to seek and obtain express consent from the subject to fulfil their obligations as stated in Section 37(1) of the Data Protection Act.
4. The complainant’s request to have the company fined for breach of her privacy could not be imposed, as this could only be done after an enforcement notice was given and the company refused to comply.
5. Section 65 of the Act provides guidelines for damages, stating that compensation is not limited to financial loss; distress is also a substantial claim. Regulation 14(3)(e) gives the Data Commissioner the power to order compensation to the aggrieved party. The company was ordered to pay a sum of Kenya Shillings one million (KES 1,000,000) after considering the breach and denial of the right to be informed and the right to erasure.

What this case teaches us is that it is crucial to obtain express consent before using someone’s pictures in your marketing campaigns.? A failure to procure express consent can lead to lawsuits and penalties from the Data Commissioner.?