1. On 12th August 2024 the Office of the Data Protection Commissioner at Nairobi (Hon. Immaculate Kassait, MBS) delivered a judgment in favour of the Respondent.
2. Being dissatisfied with the whole of the Determination ,the appellant filed a Memorandum of Appeal dated 10.9.24 raising the following grounds:
1) The Honourable Data Commissioner erred in law and in fact by misconstruing the provisions of section 37 (I) of the Data Protection Act 2019 and consequently finding that the Appellant had not obtained the Respondent's express consent.
2) The Honourable Data Commissioner erred in law and in fact by finding that the Appellant used the Respondent's image for commercial gain without proof of the alleged commercial gain and consequently awarding the Respondent KShs. 500,000.00 as compensation.
3) The Honourable Data Commissioner erred in law and in fact by finding the Respondent's images were used for commercial purposes and consequently wrongfully invoked the provisions of Regulation 14 (1) of the Data Protection (General) Regulations 2021.
4) The Honourable Data Commissioner erred in law and in fact by failing to consider the fact that the Appellant is a non-profit institution and serves the public interest and therefore does not seek any commercial gain from the medical services it offers to the public.
5) The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant which demonstrated that the Respondent expressly consented to the use of his photos
6) The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant's employees which demonstrated that consent for the use of the Appellant's employees had been sought and was freely given by the employees including the Respondent.
7) The Honourable Data Commissioner erred in law and in fact by failing to appreciate that the Respondent had been terminated from employment on the grounds of gross misconduct by the Appellant prior to lodging the complaint and consequently failing to find the complaint was a profiteering attempt by a former employee of the Appellant.
8) The Honourable Data Commissioner erred in law and in fact by failing to find that the statutory mandate for employee grievances falls under the Employment Act 2007.
9) The Honourable Data Commissioner erred in law and in fact by awarding the Respondent the sum of KShs. 500,000.00 as compensation even after finding that there was no violation of the Respondent's rights under the Data Protection Act 2019.
3. According to the appellant on the 15 May 2024 the Respondent lodged a complaint with the office of the data commissioner alleging that his image has been used without his consent.
4. Subsequently on 10 June 2024, the appellant filed a response to the complaint with the argument that the respondent’s image was used with his consent.
5. On 12 August 2024 the office of the data commissioner arrived at the determination which the appellant seeks to overturn. It is its case that there is no requirement under The Data Protection Act that calls for the consent to be reduced into writing.
6. It is the appellant’s case that the respondent consented to the use of his image and that the same was used for awareness creation purposes and not for Commercial gain.
7. It argues that the respondent did not tender any evidence to prove that the image was being used for commercial purposes.
8. It is its case that the complaint was a reaction to the termination of the Respondent's employment.
9. The Applicant seeks the following orders:
1) The Appeal is allowed set aside in Respondent's
2) The Determination of Hon. Immaculate Kassait delivered on 12th August 2024 be its entirety and be substituted with a judgment that the Appellant obtained the express consent to use the Respondent's image for the Appellant's publication.
The Appellant’s submissions.
10. The Appellant advances the argument The Appellant sought and obtained the Respondent's express consent prior to use the use of the Respondent's images.
11. It submits that The Respondent's images were not used for commercial gain and that the consistency of the evidence pointed out that there was motive for malice on the part of the Respondent after he was summarily dismissed by the Appellant.
12. It submits that there was no basis on which the compensation of Kshs.500,000.00 was awarded by the Data Commissioner noting that she found that there was no violation of the Respondent's rights under the Data Protection Act 2019.
13. The Appellant filed and served a Supplementary Record of Appeal dated 19th February 2025.It submits that from the evidence adduced before the Office of the Data Protection Commissioner, it is evident that the Appellant used the images of its employees in a number of publications of the Appellant and the Data Commissioner erred in law and in fact when she found that there was need for the Appellant to obtain the consent of the Respondent despite the contents of the Appellants letter to dated 10th June 2024 demonstrating that the Appellant sought and obtain Consent of its employees including the Respondent at the time.
14. It submits that the Court has a role to re-evaluate the evidence tendered before the Data Commissioner and form its own independent finding on the issues arising as guided by Section 78 (2) of the Civil Procedure Act Cap 21 which provides as follows;
Subject as aforesaid, the appellate court shall have the same powers and shall perform as nearly as may be the same duties as are conferred and imposed by this Act on courts of original jurisdiction in respect of suits instituted therein.
15. Reliance is also placed in the case of Abok James Odera T/A Odera & Associates v John Patrick Muchira T/A Muchira & Co. Advocates (2013) eKLR where the Court of Appeal held as follows;
This being a first appeal we are reminded of our primary role as a first appellate court, namely to re-evaluate, re-assess and re-analyse the extracts on the record and then determine whether the conclusions reached by the learned trial Judge are to stand or not and give reasons either way." (Emphasis mine)
16. Under section 2 of the Data Protection Act 2019, consent is defined as follows;
"Consent" means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject.
17. The Data Commissioner therefore erred in law and in fact when she held that consent obtained orally must be reduced into writing or recorded electronically with an obtainable script.
18. Reliance is placed in the case of Jessicar Clarise Wanjiru v Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR where the Learned Judge enumerated the three tests that must be proved by a person claiming the exploitation of their image or likeliness as follows;
"...the key elements of a Claim for unlawful use of Name or image which a petitioner must establish to succeed in a case of this nature are:-
a. Use of a Protected Attribute: The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff's name or likeness, but the law protects certain other personal attributes as well.
b. For an Exploitative Purpose: The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone's name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the plaintiff's identity and a matter of legitimate public interest.
c. No Consent: The plaintiff must establish that he or she did not give permission for the offending use. (Emphasis mine)
19. The Leaned Judge cited the South African decision in the case of O'Keeffe v Argus Printing and Publishing Co Ltd and Another (1954) (3) SA 244 (C) where the Court outlined the considerations to be taken into account when determining such matters as follows;
The unauthorized publication or a person's photograph and name for advertising is in my view capable of constituting an aggression upon that person's dignity. It is not necessary for me in the present case to hold, and I do not hold, that this is always. Much must depend upon the circumstances of each particular case, the nature the photograph, the personality of the plaintiff, his station in life, his previous habits with reference to publicity and the like. ...
20. The Appellant satisfied the burden of proof of showing that the consent was obtained to use the images of the Appellant's employee as seen in the minutes of the meeting held on 1gth January 2021.
21. It invites the court to be guided by the holding of the Court in the case of Jessicar Clarrise Supra where the Court pronounced at paragraph 33.
22. This third test has not been established to the satisfaction of the court. The petitioner alleges she did not give consent at all while the Respondent states that he contracted a designer to do the work and that the designer informed him that he had used the image of his girlfriend. It is important to note that petitioner did not rebut these allegations nor did she find it fit to file a supplementary affidavit to shed light on this issue or even deny the allegations or cast doubts. Instead, she opted to leave it to the court to weigh the two accounts. In my view, she had a duty to discharge the burden of prove and prove to the court beyond doubt that she did not grant consent nor did she authorize the to the court beyond doubt that she did not grant consent nor did she authorize the designer to use her image (Emphasis mine)
23. In the instant suit the appellant submits that the Respondent had consented to the use of his image on the Appellants publications by clear affirmative action when he was an employee of the Appellant. The Respondent was part of a meeting where the issue of the use of the images was discussed. It was not until the Respondent was summarily dismissed that he raised the issue that his consent was not obtained.
24. It submits that this is a mischievous tactic to get back to the to the Appellant for the justifiable summary dismissal his contract. Notable, the Respondent has never filed a suit before a Court of law to challenge the summary dismissal.
25. The Appellant submits that it provided evidence from a number of its employees that show that the complaint by the Respondent was an afterthought. However, the Data Commissioner erred in law and in fact when she held that the Respondent did not furnish the Office of the Data Protection Commissioner with evidence regarding the employment status of the witnesses who were readily available to prove the Appellants case.
26. It submits that under Section B (1) (f) of the Data Protection Act 2019, the Office of the Data Protection Commissioner is mandated to receive and investigate any complaint by any person on infringements of the rights under this Act.
27. In the execution of the functions of the said office, section 57 (1) (a) of the Data Protection Act 2019 the said office is empowered to order any person to "attend at a specified time and place for the purpose of being examined orally in relation to the complaint."
28. The Appellant submits that the Data Commissioner wrongly opted to use the documents only approach as provided under section 57 (1) (b) of the Data Protection Act 2019 but without giving a reason for selecting that option.
29. It submits that in the circumstances of this matter, it was necessary for the parties to be given an opportunity to submit orally as this would have enabled the Office of the Data Protection Commissioner test the veracity of the conflicting evidence relating to the allegations in the complaint by the Respondent.
30. It submits that the Appellant herein was readily available to provide the Office of the Data Protection Commissioner with any information regarding the complaint filed against the Appellant herein.
31. At no point did the Office of the Data Protection Commissioner request for the any additionally evidence, specifically in relation to the employment status of the witnesses who appended their signatures to the statements submitted by the Appellant.
32. It submits that the Appellant obtained explicit and express consent to use the Respondents image in its publications.
33. When it comes to the issue whether the Appellant used the Respondent's images for the purposes it submits that they were used it submits that the Data Commissioner erred in law and in fact by finding that the Respondent's images were used for commercial purposes and/or gain.
34. In paragraphs 34 (i) and 42 the impugned Determination dated 12th August 2024, the Data Commissioner erred when she formulated the issue. It is our submission that the issue of whether the image had been used for commercial purposes was not proved.
35. The Appellant used the images of the Respondent in a number of publications as a way of sensitizing the public, creating awareness and highlighting the services that were being offered by the Appellant which is a non-profit making institution. There was no commercial gain that was derived by the Appellant in the use of the Respondent.
36. It places reliance on the South African case of Wells v Atoll Media (Pty) Ltd and Another (11961/2006) [2009] ZACHC 173; [2010] 4 All SA 548 (WCC) as cited with approval in the case of Maina v Talent Quest Africa (Petition E336 of 2023) [2024] KEHC where Mugambi, J held as follows with respect to the question of commercial exploitation;
"In the context of this case, therefore, the appropriation of a person's image or likeness for the commercial benefit or advantage of another may well call for legal intervention in order to protect the individual concerned. That may not apply to the kinds of photographs or television images of crowd scenes which contain images of individuals therein. However, when the photograph is employed, as in this case, for the benefit of a magazine sold to make profit, it constitutes an unjustifiable invasion of the personal rights of the individual, including the person's dignity and privacy. In this dispute, no care was exercised in respecting these core rights."
37. It submits that the Respondent herein did not provide any evidence of financial/commercial gain that was enjoyed by the Appellant as a result of the use of his images. The Appellant provides medical services to the community and public at large in the public interest.
38. It submits that the Appellant never made any profit as a result of the use of the Respondents images. Be that as it may, they re-emphasize that the Respondent had given consent to the use of his images to market and sensitize the public on the medical services offered by the Appellant before he was legally terminated from employment.
39. It submits that the Data Commissioner wrongfully invoked the provisions of section 37 of the Data Protection Act 2019 and regulation 14 of the Data Protection (General) Regulations 2021.
40. On the issue of the Data Commissioner erred in law and in fact when they awarded the Respondent compensation in the sum of Kshs.500,000.00 after making a finding that there was no violation of the Respondent's rights under the Act.
41. The Appellant has demonstrated that the Respondent had prior to his lawful termination from employment given express consent to the use of his image for advertising and marketing the Appellant's medical services to the public not for commercial gain, but in accordance with public interest.
42. It submits the Respondent failed to demonstrate with cogent evidence that he had suffered any loss/damage as a result of the publications. It is trite law under Section 107 (1) of the Evidence Act Cap 80 that he who alleges must prove. They therefore urge this Honourable Court to find that the Data Commissioner erred in law and in fact when she awarded the compensation of Kshs.500,000.00 to the Respondent.
43. Reliance is placed in the case of Jessicar Clarrise Wanjiru Supra where the Court held thus;
"41. On the quantum of damages, award of damages entails exercise of judicial discretion which should be exercised judicially and that means that it must be exercised upon reason and principle and not upon caprice or personal opinion.
42. From the material presented in this case, the evident lack of clarity as to whether or not there was consent and considering the swiftness with which the bill boards were removed, I find that there is no material before me to demonstrate that the petitioner suffered any loss.
43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costa.
43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costs. (Emphasis mine)
44. The Appellant submits that the Memorandum dated 10th September 2024 has merit.
The Respondent's case;
45. The Respondent was an employee of the Appellant. He complained to the Appellant that it was using his image in its publications called dream magazine and calendar without his consent.
46. He raised the issue with Appellant’s chairman of Board Management Mr. Kahiga. He also complained about his image being used by the Appellant during the 2022 General elections on signage which created a false image that he was vying for the MCA seat Kahawa Wendani ward.
47. On one occasion, he stumbled upon one publication lying on the streets which caused him mental anguish. He particularized that he fell out with the administrators of the Appellant for the unauthorized use of his image which he wanted to be pulled down.
48. It is the respondent's case that his image was used by the Appellant, and without his consent as a result of which he lodged a complaint with the office of the commission of data protection seeking compensation.
49. The appellant was not given an opportunity to respond to the issue whether the consent was obtained before the use of the respondent’s images in magazines, social media posts amongst other places.
50. Ultimately, the Appellant was found liable and it was condemned to pay compensation of the sum of 500,000 to the respondent. That has precipitated the filing of the appeal.
51. He submits that the Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise.
52. Reliance is placed in in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity.
53. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at paragraph 44, Rutto J held;
“in collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined. Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.”
54. In this appeal, the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image. The consent required is a conscious approval on how the data was to be used.
55. Despite collecting his image, the Appellant used it against his wishes which he objected to. They submit that the Appellant bulldozed the Respondent and used its position as his employer to publish his image without his consent.
56. On quantum of general damages, he argues that the amount awarded was not excessive.
57. He placed reliance in the case of the Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that:
‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours).
The Respondent’s submissions;
58. He submits that the Data Commissioner undertook investigations as per her finding at paragraphs 30 and 31. She held “During investigations, it was found that written, signed and executed witness statements from the employees and former employees who participated in the project uniformly indicated that, although consent was sought verbally, the Respondent explicitly obtained consent from all parties before publishing their photos.
59. Additionally, it was revealed that among the eight witnesses received, seven explicitly stated that the Respondent sought consent for use of their images and likeness for advertisement, marketing, and promotion of the Health Center.
60. Only one witness indicated that consent was sought solely for creating awareness.
61. However, based on the evidence provided, the Respondent did not furnish the Office with evidence as to whether the written, signed and executed witness statements were from actual employees and or/former employees of the Respondent who participated in the project alongside the Complainant as alleged.
62. He submits that the Appellant misapprehended the Data Commissioners finding on liability.
63. The commissioner was not satisfied with the evidence adduced by the Appellant that the said persons making the witness statement were indeed employees and or former employees of the Appellant and their employment status.
64. This is buttressed by the fact that the Office of the Data Commissioner had investigatory powers and the said statements were not subjected to scrutiny by cross examination from the Respondent.
65. Further, the said statements were not availed to the Respondent for a response, rather were only availed to the Data Commissioner’s office as can be seen from the correspondences at pages 32-33 and 34-35 of the record.
66. The Office of the Data Commissioner had the discretion to determine the authenticity of the evidence provided by the parties which ought not to be disregarded by this Honourable Court.
67. The Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data.
68. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise.
69. In Attorney General v Bala [2023] KECA 117 (KLR), the Court of Appeal, Okwengu, Omondi and Mativo JJAs held at paragraph 16
“… an appeal lay only as against a decree or as against an order passed under rules from which an appeal was expressly allowed by order 43, rule 1 of the Civil Procedure Rules. The first sentence in the two paragraphs the appellant cited were mere findings by the High Court. The last sentences were his views. No appeal could lie against a mere finding for the simple reason that the and the Civil Procedure Rules did not provide for any such appeal. ..An appeal does not lie against mere 'findings' recorded by a court unless the findings amount to a 'decree' or 'order'.”
70. Reliance is also placed in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, where the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity.
71. In Catherine Njeri Wanjiru v Machakos University (2022) KEHC 10599 eKLR, the Respondent had published the Petitioner’s image during public graduation and used it on its publications without her consent. It claimed that the image was not for commercial gain since it’s a public university. The court held that the use of the Petitioner’s image without her knowledge or consent was an intrusion of her right to privacy, right to dignity and right to property was infringed. It awarded her Kshs, 700,000.00.
72. The Data Protection Act, 2019 was enacted to inter alia, give effect to Article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner, make provision for the regulation of the processing of personal data and provide for the rights of data subjects and obligations of data controllers and processors.
73. He submits that a data subject has the right to be informed of the use to which his personal data is to be put to and to object to the processing of al or part of their subject data.
74. In this appeal, the data subject/Respondent complained that he was not informed that his image was to be used in the Appellant’s publications.
75. He demonstrated that despite that, his image was used in the Dream Magazine run by the data processor/Appellant, wall calendars and sign posts. He protested the use of his image during his employment by the Appellant which rubbed feathers with the Appellant which stated that it had rights to use his image as his employer.
76. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at
paragraph 44, Rutto J held “in collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined.Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.”
77. He submits that the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image.
78. The consent required is a conscious approval on how the data was to be used.
79. Despite collecting his image, the Appellant used it against his wishes which he objected to.
80. He submits that the Appellant bulldozed the Respondent and used its position as his employer to publish his image without his consent.
81. On quantum, this Honourable Court should be very reluctant in disturbing the decision of the trial court on quantum.
82. The governing principle was dutifully restated by Mrima J in Eunice Auma Onyango v Salin Akinyi Oluoch [2015] eKLR, citing the Court of Appeal in Kemfro Africa Limited T/A Meru Express Services, Gathogo Kanini Vs. A.M.M Lubia & Another (1982-88) 1 KAR 777 thus: -
‘the principles to be observed by an appellate court in deciding whether it is justified in disturbing the quantum of damages awarded by a trial Judge were held by the former Court of Appeal of Eastern Africa to be that it must be satisfied that either the Judge, in assessing the damages took into account an irrelevant factor, or left out of account a relevant one, or that; short of this, the amount is so inordinately low or so inordinately high that it must be a wholly erroneous estimate of the damage.’
83. The Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that:
‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours). In Muthoni v Solpia Kenya Limited t/a Sista Kenya, supra,the Respondent had
appropriated the Appellant’s image from he
[...truncated]
2. Being dissatisfied with the whole of the Determination ,the appellant filed a Memorandum of Appeal dated 10.9.24 raising the following grounds:
1) The Honourable Data Commissioner erred in law and in fact by misconstruing the provisions of section 37 (I) of the Data Protection Act 2019 and consequently finding that the Appellant had not obtained the Respondent's express consent.
2) The Honourable Data Commissioner erred in law and in fact by finding that the Appellant used the Respondent's image for commercial gain without proof of the alleged commercial gain and consequently awarding the Respondent KShs. 500,000.00 as compensation.
3) The Honourable Data Commissioner erred in law and in fact by finding the Respondent's images were used for commercial purposes and consequently wrongfully invoked the provisions of Regulation 14 (1) of the Data Protection (General) Regulations 2021.
4) The Honourable Data Commissioner erred in law and in fact by failing to consider the fact that the Appellant is a non-profit institution and serves the public interest and therefore does not seek any commercial gain from the medical services it offers to the public.
5) The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant which demonstrated that the Respondent expressly consented to the use of his photos
6) The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant's employees which demonstrated that consent for the use of the Appellant's employees had been sought and was freely given by the employees including the Respondent.
7) The Honourable Data Commissioner erred in law and in fact by failing to appreciate that the Respondent had been terminated from employment on the grounds of gross misconduct by the Appellant prior to lodging the complaint and consequently failing to find the complaint was a profiteering attempt by a former employee of the Appellant.
8) The Honourable Data Commissioner erred in law and in fact by failing to find that the statutory mandate for employee grievances falls under the Employment Act 2007.
9) The Honourable Data Commissioner erred in law and in fact by awarding the Respondent the sum of KShs. 500,000.00 as compensation even after finding that there was no violation of the Respondent's rights under the Data Protection Act 2019.
3. According to the appellant on the 15 May 2024 the Respondent lodged a complaint with the office of the data commissioner alleging that his image has been used without his consent.
4. Subsequently on 10 June 2024, the appellant filed a response to the complaint with the argument that the respondent’s image was used with his consent.
5. On 12 August 2024 the office of the data commissioner arrived at the determination which the appellant seeks to overturn. It is its case that there is no requirement under The Data Protection Act that calls for the consent to be reduced into writing.
6. It is the appellant’s case that the respondent consented to the use of his image and that the same was used for awareness creation purposes and not for Commercial gain.
7. It argues that the respondent did not tender any evidence to prove that the image was being used for commercial purposes.
8. It is its case that the complaint was a reaction to the termination of the Respondent's employment.
9. The Applicant seeks the following orders:
1) The Appeal is allowed set aside in Respondent's
2) The Determination of Hon. Immaculate Kassait delivered on 12th August 2024 be its entirety and be substituted with a judgment that the Appellant obtained the express consent to use the Respondent's image for the Appellant's publication.
The Appellant’s submissions.
10. The Appellant advances the argument The Appellant sought and obtained the Respondent's express consent prior to use the use of the Respondent's images.
11. It submits that The Respondent's images were not used for commercial gain and that the consistency of the evidence pointed out that there was motive for malice on the part of the Respondent after he was summarily dismissed by the Appellant.
12. It submits that there was no basis on which the compensation of Kshs.500,000.00 was awarded by the Data Commissioner noting that she found that there was no violation of the Respondent's rights under the Data Protection Act 2019.
13. The Appellant filed and served a Supplementary Record of Appeal dated 19th February 2025.It submits that from the evidence adduced before the Office of the Data Protection Commissioner, it is evident that the Appellant used the images of its employees in a number of publications of the Appellant and the Data Commissioner erred in law and in fact when she found that there was need for the Appellant to obtain the consent of the Respondent despite the contents of the Appellants letter to dated 10th June 2024 demonstrating that the Appellant sought and obtain Consent of its employees including the Respondent at the time.
14. It submits that the Court has a role to re-evaluate the evidence tendered before the Data Commissioner and form its own independent finding on the issues arising as guided by Section 78 (2) of the Civil Procedure Act Cap 21 which provides as follows;
Subject as aforesaid, the appellate court shall have the same powers and shall perform as nearly as may be the same duties as are conferred and imposed by this Act on courts of original jurisdiction in respect of suits instituted therein.
15. Reliance is also placed in the case of Abok James Odera T/A Odera & Associates v John Patrick Muchira T/A Muchira & Co. Advocates (2013) eKLR where the Court of Appeal held as follows;
This being a first appeal we are reminded of our primary role as a first appellate court, namely to re-evaluate, re-assess and re-analyse the extracts on the record and then determine whether the conclusions reached by the learned trial Judge are to stand or not and give reasons either way." (Emphasis mine)
16. Under section 2 of the Data Protection Act 2019, consent is defined as follows;
"Consent" means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject.
17. The Data Commissioner therefore erred in law and in fact when she held that consent obtained orally must be reduced into writing or recorded electronically with an obtainable script.
18. Reliance is placed in the case of Jessicar Clarise Wanjiru v Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR where the Learned Judge enumerated the three tests that must be proved by a person claiming the exploitation of their image or likeliness as follows;
"...the key elements of a Claim for unlawful use of Name or image which a petitioner must establish to succeed in a case of this nature are:-
a. Use of a Protected Attribute: The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff's name or likeness, but the law protects certain other personal attributes as well.
b. For an Exploitative Purpose: The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone's name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the plaintiff's identity and a matter of legitimate public interest.
c. No Consent: The plaintiff must establish that he or she did not give permission for the offending use. (Emphasis mine)
19. The Leaned Judge cited the South African decision in the case of O'Keeffe v Argus Printing and Publishing Co Ltd and Another (1954) (3) SA 244 (C) where the Court outlined the considerations to be taken into account when determining such matters as follows;
The unauthorized publication or a person's photograph and name for advertising is in my view capable of constituting an aggression upon that person's dignity. It is not necessary for me in the present case to hold, and I do not hold, that this is always. Much must depend upon the circumstances of each particular case, the nature the photograph, the personality of the plaintiff, his station in life, his previous habits with reference to publicity and the like. ...
20. The Appellant satisfied the burden of proof of showing that the consent was obtained to use the images of the Appellant's employee as seen in the minutes of the meeting held on 1gth January 2021.
21. It invites the court to be guided by the holding of the Court in the case of Jessicar Clarrise Supra where the Court pronounced at paragraph 33.
22. This third test has not been established to the satisfaction of the court. The petitioner alleges she did not give consent at all while the Respondent states that he contracted a designer to do the work and that the designer informed him that he had used the image of his girlfriend. It is important to note that petitioner did not rebut these allegations nor did she find it fit to file a supplementary affidavit to shed light on this issue or even deny the allegations or cast doubts. Instead, she opted to leave it to the court to weigh the two accounts. In my view, she had a duty to discharge the burden of prove and prove to the court beyond doubt that she did not grant consent nor did she authorize the to the court beyond doubt that she did not grant consent nor did she authorize the designer to use her image (Emphasis mine)
23. In the instant suit the appellant submits that the Respondent had consented to the use of his image on the Appellants publications by clear affirmative action when he was an employee of the Appellant. The Respondent was part of a meeting where the issue of the use of the images was discussed. It was not until the Respondent was summarily dismissed that he raised the issue that his consent was not obtained.
24. It submits that this is a mischievous tactic to get back to the to the Appellant for the justifiable summary dismissal his contract. Notable, the Respondent has never filed a suit before a Court of law to challenge the summary dismissal.
25. The Appellant submits that it provided evidence from a number of its employees that show that the complaint by the Respondent was an afterthought. However, the Data Commissioner erred in law and in fact when she held that the Respondent did not furnish the Office of the Data Protection Commissioner with evidence regarding the employment status of the witnesses who were readily available to prove the Appellants case.
26. It submits that under Section B (1) (f) of the Data Protection Act 2019, the Office of the Data Protection Commissioner is mandated to receive and investigate any complaint by any person on infringements of the rights under this Act.
27. In the execution of the functions of the said office, section 57 (1) (a) of the Data Protection Act 2019 the said office is empowered to order any person to "attend at a specified time and place for the purpose of being examined orally in relation to the complaint."
28. The Appellant submits that the Data Commissioner wrongly opted to use the documents only approach as provided under section 57 (1) (b) of the Data Protection Act 2019 but without giving a reason for selecting that option.
29. It submits that in the circumstances of this matter, it was necessary for the parties to be given an opportunity to submit orally as this would have enabled the Office of the Data Protection Commissioner test the veracity of the conflicting evidence relating to the allegations in the complaint by the Respondent.
30. It submits that the Appellant herein was readily available to provide the Office of the Data Protection Commissioner with any information regarding the complaint filed against the Appellant herein.
31. At no point did the Office of the Data Protection Commissioner request for the any additionally evidence, specifically in relation to the employment status of the witnesses who appended their signatures to the statements submitted by the Appellant.
32. It submits that the Appellant obtained explicit and express consent to use the Respondents image in its publications.
33. When it comes to the issue whether the Appellant used the Respondent's images for the purposes it submits that they were used it submits that the Data Commissioner erred in law and in fact by finding that the Respondent's images were used for commercial purposes and/or gain.
34. In paragraphs 34 (i) and 42 the impugned Determination dated 12th August 2024, the Data Commissioner erred when she formulated the issue. It is our submission that the issue of whether the image had been used for commercial purposes was not proved.
35. The Appellant used the images of the Respondent in a number of publications as a way of sensitizing the public, creating awareness and highlighting the services that were being offered by the Appellant which is a non-profit making institution. There was no commercial gain that was derived by the Appellant in the use of the Respondent.
36. It places reliance on the South African case of Wells v Atoll Media (Pty) Ltd and Another (11961/2006) [2009] ZACHC 173; [2010] 4 All SA 548 (WCC) as cited with approval in the case of Maina v Talent Quest Africa (Petition E336 of 2023) [2024] KEHC where Mugambi, J held as follows with respect to the question of commercial exploitation;
"In the context of this case, therefore, the appropriation of a person's image or likeness for the commercial benefit or advantage of another may well call for legal intervention in order to protect the individual concerned. That may not apply to the kinds of photographs or television images of crowd scenes which contain images of individuals therein. However, when the photograph is employed, as in this case, for the benefit of a magazine sold to make profit, it constitutes an unjustifiable invasion of the personal rights of the individual, including the person's dignity and privacy. In this dispute, no care was exercised in respecting these core rights."
37. It submits that the Respondent herein did not provide any evidence of financial/commercial gain that was enjoyed by the Appellant as a result of the use of his images. The Appellant provides medical services to the community and public at large in the public interest.
38. It submits that the Appellant never made any profit as a result of the use of the Respondents images. Be that as it may, they re-emphasize that the Respondent had given consent to the use of his images to market and sensitize the public on the medical services offered by the Appellant before he was legally terminated from employment.
39. It submits that the Data Commissioner wrongfully invoked the provisions of section 37 of the Data Protection Act 2019 and regulation 14 of the Data Protection (General) Regulations 2021.
40. On the issue of the Data Commissioner erred in law and in fact when they awarded the Respondent compensation in the sum of Kshs.500,000.00 after making a finding that there was no violation of the Respondent's rights under the Act.
41. The Appellant has demonstrated that the Respondent had prior to his lawful termination from employment given express consent to the use of his image for advertising and marketing the Appellant's medical services to the public not for commercial gain, but in accordance with public interest.
42. It submits the Respondent failed to demonstrate with cogent evidence that he had suffered any loss/damage as a result of the publications. It is trite law under Section 107 (1) of the Evidence Act Cap 80 that he who alleges must prove. They therefore urge this Honourable Court to find that the Data Commissioner erred in law and in fact when she awarded the compensation of Kshs.500,000.00 to the Respondent.
43. Reliance is placed in the case of Jessicar Clarrise Wanjiru Supra where the Court held thus;
"41. On the quantum of damages, award of damages entails exercise of judicial discretion which should be exercised judicially and that means that it must be exercised upon reason and principle and not upon caprice or personal opinion.
42. From the material presented in this case, the evident lack of clarity as to whether or not there was consent and considering the swiftness with which the bill boards were removed, I find that there is no material before me to demonstrate that the petitioner suffered any loss.
43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costa.
43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costs. (Emphasis mine)
44. The Appellant submits that the Memorandum dated 10th September 2024 has merit.
The Respondent's case;
45. The Respondent was an employee of the Appellant. He complained to the Appellant that it was using his image in its publications called dream magazine and calendar without his consent.
46. He raised the issue with Appellant’s chairman of Board Management Mr. Kahiga. He also complained about his image being used by the Appellant during the 2022 General elections on signage which created a false image that he was vying for the MCA seat Kahawa Wendani ward.
47. On one occasion, he stumbled upon one publication lying on the streets which caused him mental anguish. He particularized that he fell out with the administrators of the Appellant for the unauthorized use of his image which he wanted to be pulled down.
48. It is the respondent's case that his image was used by the Appellant, and without his consent as a result of which he lodged a complaint with the office of the commission of data protection seeking compensation.
49. The appellant was not given an opportunity to respond to the issue whether the consent was obtained before the use of the respondent’s images in magazines, social media posts amongst other places.
50. Ultimately, the Appellant was found liable and it was condemned to pay compensation of the sum of 500,000 to the respondent. That has precipitated the filing of the appeal.
51. He submits that the Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise.
52. Reliance is placed in in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity.
53. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at paragraph 44, Rutto J held;
“in collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined. Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.”
54. In this appeal, the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image. The consent required is a conscious approval on how the data was to be used.
55. Despite collecting his image, the Appellant used it against his wishes which he objected to. They submit that the Appellant bulldozed the Respondent and used its position as his employer to publish his image without his consent.
56. On quantum of general damages, he argues that the amount awarded was not excessive.
57. He placed reliance in the case of the Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that:
‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours).
The Respondent’s submissions;
58. He submits that the Data Commissioner undertook investigations as per her finding at paragraphs 30 and 31. She held “During investigations, it was found that written, signed and executed witness statements from the employees and former employees who participated in the project uniformly indicated that, although consent was sought verbally, the Respondent explicitly obtained consent from all parties before publishing their photos.
59. Additionally, it was revealed that among the eight witnesses received, seven explicitly stated that the Respondent sought consent for use of their images and likeness for advertisement, marketing, and promotion of the Health Center.
60. Only one witness indicated that consent was sought solely for creating awareness.
61. However, based on the evidence provided, the Respondent did not furnish the Office with evidence as to whether the written, signed and executed witness statements were from actual employees and or/former employees of the Respondent who participated in the project alongside the Complainant as alleged.
62. He submits that the Appellant misapprehended the Data Commissioners finding on liability.
63. The commissioner was not satisfied with the evidence adduced by the Appellant that the said persons making the witness statement were indeed employees and or former employees of the Appellant and their employment status.
64. This is buttressed by the fact that the Office of the Data Commissioner had investigatory powers and the said statements were not subjected to scrutiny by cross examination from the Respondent.
65. Further, the said statements were not availed to the Respondent for a response, rather were only availed to the Data Commissioner’s office as can be seen from the correspondences at pages 32-33 and 34-35 of the record.
66. The Office of the Data Commissioner had the discretion to determine the authenticity of the evidence provided by the parties which ought not to be disregarded by this Honourable Court.
67. The Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data.
68. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise.
69. In Attorney General v Bala [2023] KECA 117 (KLR), the Court of Appeal, Okwengu, Omondi and Mativo JJAs held at paragraph 16
“… an appeal lay only as against a decree or as against an order passed under rules from which an appeal was expressly allowed by order 43, rule 1 of the Civil Procedure Rules. The first sentence in the two paragraphs the appellant cited were mere findings by the High Court. The last sentences were his views. No appeal could lie against a mere finding for the simple reason that the and the Civil Procedure Rules did not provide for any such appeal. ..An appeal does not lie against mere 'findings' recorded by a court unless the findings amount to a 'decree' or 'order'.”
70. Reliance is also placed in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, where the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity.
71. In Catherine Njeri Wanjiru v Machakos University (2022) KEHC 10599 eKLR, the Respondent had published the Petitioner’s image during public graduation and used it on its publications without her consent. It claimed that the image was not for commercial gain since it’s a public university. The court held that the use of the Petitioner’s image without her knowledge or consent was an intrusion of her right to privacy, right to dignity and right to property was infringed. It awarded her Kshs, 700,000.00.
72. The Data Protection Act, 2019 was enacted to inter alia, give effect to Article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner, make provision for the regulation of the processing of personal data and provide for the rights of data subjects and obligations of data controllers and processors.
73. He submits that a data subject has the right to be informed of the use to which his personal data is to be put to and to object to the processing of al or part of their subject data.
74. In this appeal, the data subject/Respondent complained that he was not informed that his image was to be used in the Appellant’s publications.
75. He demonstrated that despite that, his image was used in the Dream Magazine run by the data processor/Appellant, wall calendars and sign posts. He protested the use of his image during his employment by the Appellant which rubbed feathers with the Appellant which stated that it had rights to use his image as his employer.
76. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at
paragraph 44, Rutto J held “in collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined.Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.”
77. He submits that the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image.
78. The consent required is a conscious approval on how the data was to be used.
79. Despite collecting his image, the Appellant used it against his wishes which he objected to.
80. He submits that the Appellant bulldozed the Respondent and used its position as his employer to publish his image without his consent.
81. On quantum, this Honourable Court should be very reluctant in disturbing the decision of the trial court on quantum.
82. The governing principle was dutifully restated by Mrima J in Eunice Auma Onyango v Salin Akinyi Oluoch [2015] eKLR, citing the Court of Appeal in Kemfro Africa Limited T/A Meru Express Services, Gathogo Kanini Vs. A.M.M Lubia & Another (1982-88) 1 KAR 777 thus: -
‘the principles to be observed by an appellate court in deciding whether it is justified in disturbing the quantum of damages awarded by a trial Judge were held by the former Court of Appeal of Eastern Africa to be that it must be satisfied that either the Judge, in assessing the damages took into account an irrelevant factor, or left out of account a relevant one, or that; short of this, the amount is so inordinately low or so inordinately high that it must be a wholly erroneous estimate of the damage.’
83. The Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that:
‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours). In Muthoni v Solpia Kenya Limited t/a Sista Kenya, supra,the Respondent had
appropriated the Appellant’s image from he
[...truncated]