Four firms, including a battery distributor, a health centre, a telecommunications service provider, and a video producer, have been fined a combined Sh2.2 million for using photos and a video clip without permission, adding to the growing list of entities struggling to comply with the new privacy laws.
The Office of the Data Protection Commissioner (ODPC) has fined car battery distributor Elite Power Craft Limited Sh750,000 for posting a man’s image on their Facebook account for marketing purposes without obtaining his consent.
Tech firm, Liquid has been fined Sh500,000 for using a man’s image for commercial purposes without his ‘express consent’, while another firm, Off Grid Concepts, which produced a video on behalf of the National Social Security Fund (NSSF), has also been fined Sh450,000, for publishing a woman’s video without her consent, albeit not for commercial gain.
St Joseph Health Centre in Nairobi has been penalised Sh500,000 for using a man’s image on a public signpost and different print media including calendars, which amounts to commercial use, without his permission nor compensation.
These new rulings, coming after several other similar complaints lodged with the ODPC ended with such penalties, point to the regulatory burden of the recently enacted Data Protection Act, and unlearnt lessons from previous cases.
An analysis by the Business Daily shows that the use of unauthorised photos and videos dominated complaints lodged with the Data Commissioner Immaculate Kassait.
In her latest rulings, Ms Kassait emphasised the need for “express consent” for the specific use of personal data collected from a data subject, without which the processing of that data is a violation of their right.
“The Act provides that a data controller or data processor shall not process personal data unless the data subject consents to the processing for one or more specified purposes,” Ms Kassait said in her ruling on the complaint against Liquid.
Yet, it is the lack of “express consent” that has continuously landed companies, big and small – including universities and large corporates – in trouble with the regulator, as more Kenyans complained of similar data privacy breaches.
Data protection experts aver that many institutions are yet to grasp the idea of consent even as the new regulations that came into force in 2020 continue to sink in, forcing companies to change tack and modes of operation.
“It seems there’s been so much ignorance in the commercial space as to what amounts to personal data and what amounts to consent,” observes William Karoki, a data protection lawyer and Managing Partner at WKA Advocates.
“Consent must be express; it is not implied. It must be clear, free of duress, and must be specific for a specific purpose. This is where most people get it wrong, they assume that one consent for a specific data use is blanket consent.”
