In the current age, the influence of digital media has seeped through the very cracks of day-to-day life in all spheres. Due to the expansion of digital media and the extensive sharing of images on multiple platforms, data protection and image rights are of utmost relevance today. These rights encompass the ability to legally manage and safeguard a person’s image by preventing the use of their likeness or images without their consent. With the rise of social media, data protection and image rights have grown to be an urgent concern because improper usage or manipulation of photographs may infringe on one’s privacy, harm one’s reputation, resulting in unauthorized commercial use of likeness and possibly identity theft or fraud.

Article 28 of the Constitution of Kenya, 2010, states that every person has inherent dignity and the right to have that dignity respected and protected. This ties in with Article 31 which highlights the right to privacy. Consequently, as an effort to further guarantee the same, the Data Protection Act (“Act”) was enacted.

The Act defines a “data subject” as an identified or identifiable natural person who is the subject of personal data. Section 26 of the Act sets out the rights of a data subject as the right:

(a) to be informed of the use to which their personal data is to be put;

(b) to access their personal data in custody of data controller or data processor;

(c) to object to the processing of all or part of their personal data;

(d) to correction of false or misleading data; and

(e) to deletion of false or misleading data about them.

Section 2 states that any consent given to allow the processing of personal data must be express, unequivocal, free, specific and informed. The Act places a big responsibility on data controllers and processors and further stipulates that the unlawful disclosure of personal data in any manner that is incompatible with the purpose for which they collected such data amounts to an offence.

The Von Hannover v. Germany (no.2) case explained that one of the most essential components of a person’s personality is their appearance since it showcases their individual traits and sets them apart from other people. Thus, one of the key aspects of personal growth is the right to the protection of one’s image. This encompasses an individual’s right to decide how their photograph is used, including the right to prevent its publication.

Kenyan courts have continued to address image rights more and more extensively. On the 3^rd of August 2022, the High Court rendered its decision in the landmark case of Catherine Njeri Wanjiru v. Machakos University (Petition E021 of 2021) (2022) KEHC 10599, eKLR, where the petitioner, a former student at the university, claimed that the university had used a photo of her taken at a graduation ceremony to advertise its training programs without her permission. The institution denied that it had taken the image or utilized it for profit. It claimed that the photo was taken at a public graduation ceremony and that additional images had been utilized that showed other graduating students. The Court ruled in favour of the petitioner and held that the image of the petitioner was personal data, and as such, the respondent had violated the petitioner’s right to privacy by failing to get her permission before taking the picture. The court further held that respondent’s use of the petitioner’s picture was financially exploitative and not in the public interest because her image and publicity rights were a protected attribute. In the end, the court determined that the non-consensual publishing of the petitioner’s photo had violated her rights to privacy, dignity, and property. Nominal damages, amounting to Kshs 700,000.00, were paid to the Petitioner. More significantly, the court emphasized the two-pronged nature of image rights; namely the right to privacy, which is the right to stop others from using one’s picture for commercial benefit, and the right to publicity, which is the right to financial gain or remuneration from the use of one’s image.

In the earlier case of Jessicar Clarise Wanjiru v Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR, the respondent marketed reconstruction and plastic surgery services using the petitioner’s image on its billboards without permission and made profits. The court, in this instance, recognized that there are two different kinds of rights that make up personality rights. Firstly, the right to privacy protects individuals from having their image and likeness used without their consent or receiving payment. Secondly, the right to publicity gives an individual the sole right to market his or her image, likeness, or persona for monetary gain. The Court held that:

“…from the key elements of a Claim for unlawful use of Name or image which a petitioner must establish to succeed in a case of this nature are:-

1. Use of a Protected Attribute:The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff’s name or likeness, but the law protects certain other personal attributes as well.
2. For an Exploitative Purpose:The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone’s name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the plaintiff’s identity and a matter of legitimate public interest.
3. No Consent:The plaintiff must establish that he or she did not give permission for the offending use…”

In the case of Dhabiti Sacco Ltd v Sharon Nyaga [2022] eKLR, the High Court of Kenya in Meru upheld a ruling ordering the Sacco to pay a lady Ksh. 1,500,000.00 for using her image without her permission to promote its services and goods in its calendar. In so doing, it stated:

“…This is an unequivocal admission that the appellant used and published photograph of the respondent in its calendar without her consent, then distributed the same to its staff and customers in some five or so branches spread over four counties. The use of the photograph without deference to the plaintiff was evidently in violation of the respondent’s right to privacy and to be accorded her dignity under Articles 31(c) and 28 of the Constitution. There was a financial benefit that the appellant expected to derive and reap from the publication which must have flowed to it contrary to the concurrence of the 1^st respondent. I find that to have been an exploitation of the 1^st respondent and her photograph by the appellant. The appellant having admitted to have been the beneficiary of such exploitation, it became liable to the 1^st respondent who was then entitled to compensation…”

Similarly, in the case Kamande v Nation Media Group (Constitutional Petition E004 of 2021) [2022] KEHC 16017 (KLR), the Court awarded the petitioner damages of compensation worth Kshs. 1,500,000.00 by the respondent who published the petitioner’s image in its various newspaper publications without her consent. The court stated, “…the law protects the petitioner’s right to control her image, name or likeness and if it used for publicity or commercial gain by a third party, her consent must be obtained. Therefore, I am persuaded that the respondent violated the petitioner’s right to property. In conclusion, I find that the Petitioner has demonstrated the violation of her rights under Articles 28, 31 and 40 of the Constitution…”

The Court has been consistent in its stand on this issue of image rights and this can be seen in the case of Ann Njoki Kumena v KTDA Agency Ltd [2019] eKLR where the court relied on the same rationale to issue a similar award of Kshs. 1,500,000.00 as compensation to the Plaintiff because the defendant published her image in their marketing brochures without her consent.

Further fortifying the gravity of data protection, the Office of the Data Protection Commissioner (ODPC), in a press release dated 26^th September 2023, issued three penalty notices to three Data Controllers for failing to observe data protection rights of data subjects and failing to comply with the Data Protection Act. The first Data Controller, a Digital Credit Provider, used the complainants’ names and contact information obtained from a third party to send them threatening messages and calls. They were issued with a penalty of Kshs. 2,975,000.00 which ought to act as a deterrent to digital lenders from the same and to ensure they aptly inform data subjects on the purpose of the acquisition and processing of their information and seek their consent first. The second data controller, a restaurant that posted a customer’s photo to their social media platform without their consent, was fined Kshs. 1,850,000.00 to deter establishments from posting clients’ photos online without their consent. The last data controller, which received the highest penalty of Kshs 4,550,000.00, was a school that posted minors’ pictures without parental consent. This sends a message to educational facilities handling minors’ data to seek parental consent before processing such data.

Ultimately, any entity handling the data of a data subject, in whatever capacity, ought to be mindful of the provisions of the Constitution of Kenya, 2010 and the Data Protection Act. It is crucial, first and foremost, that such data is obtained legally and if so, any use of such data for whatever purpose, should be expressly consented to by the relevant data subject. The foregoing clearly demonstrates the hefty implications of non-compliance with data protection rights.

Even so, data protection rights stretch beyond legal culpability into the confines of a fundamental ethical and practical necessity as we make further strides into the digital era. With our lives becoming increasingly intertwined with data-driven systems, the acknowledgement of such rights to safeguard the privacy of individuals builds and maintains trust in a digital ecosystem with checks and balances. Data protection rights form the cornerstone of a fair and secure digital society that upholds the privacy and autonomy of data subjects.

Evangel Njeri Ngari

Benson M. Muringo