(Nairobi) – A woman whose image was used in a Mother’s Day marketing campaign without her consent has won a legal battle against the company responsible. The Office of the Data Protection Commissioner (ODPC) ordered Grain Industries Ltd to pay Esther Kanza Mbuvu KSh 1 million in compensation for violating her rights under the Data Protection Act (DPA). The High Court upheld this ruling, dismissing the company’s appeal.
Ms. Mbuvu discovered her image on billboards and in YouTube promotions in August 2023. The campaign, captioned “Tunashukuru Mama wa Ajabu,” was created by Grain Industries to celebrate mothers. However, Ms. Mbuvu said she had not been informed or asked for permission to use her photograph. The promotional materials were prominently displayed along major highways in Nyali, Kibarani, and Likoni areas.
Grain Industries explained that the images were submitted by participants of a campaign through its marketing agency, Brainwave Communications. The company stated that Ms. Mbuvu’s image was uploaded by her daughter, who allegedly consented to the terms and conditions of the campaign on her mother’s behalf.
Ms. Mbuvu filed a complaint with the ODPC in March 2024, arguing that the company’s use of her personal data without direct consent was a breach of her privacy. She demanded the removal of the billboards, a public acknowledgment of the violation, a fine against the company, and compensation for damages.
The ODPC’s investigation confirmed that the billboards had been removed and ruled that Grain Industries violated Ms. Mbuvu’s rights to information and erasure. The company was ordered to compensate her with KSh 1 million.
Grain Industries appealed the ruling, arguing that it had relied on valid consent from the participant, Ms. Mbuvu’s daughter. The company also disputed the ODPC’s timeline in delivering its decision, claimed it was not given a chance to respond to new evidence, and challenged the ruling on damages.
High Court Justice Julius Nga’ngar dismissed the appeal. He ruled that the company failed to obtain direct consent from Ms. Mbuvu, as required by the DPA. Justice Nga’ngar emphasized that the law requires express consent from the data subject, not from a third party, unless an exemption is formally granted.
The judge also dismissed the company’s claim that the campaign was not commercial. He noted that any marketing initiative ultimately aims to boost brand awareness and sales.
Justice Nga’ngar upheld the KSh 1 million compensation, stating it was appropriate given the unauthorized use of personal data. He concluded that Grain Industries’ actions breached the DPA from the outset and found no reason to overturn the ODPC’s decision.
Table: Key Details of the Case
| Aspect | Details |
|---|---|
| Complainant | Esther Kanza Mbuvu |
| Respondent | Grain Industries Ltd |
| Issue | Unauthorized use of personal data (image) |
| ODPC Ruling | KSh 1 million compensation; violation of DPA |
| High Court Ruling | Appeal dismissed; ODPC decision upheld |
| Key Legal Basis | Requirement for express consent under DPA |