On July 11, 2024, the Office of the Data Protection Commissioner (ODPC) published its decision in complaint No. 387 of 2024, as issued on June 3, 2024, in which it ordered Grain Industries Limited to pay KES 1 million (approx. $7,635) as compensation for violating the Data Protection Act following a complaint.

Background to the decision

The complainant stated that in 2023, they discovered that Grain Industries was using the complainant's images for marketing purposes on billboards and YouTube without the complainant's consent. Grain Industries claimed that they had obtained the images from the complainant's daughter. The claimant also stated that Grain Industries did not comply with a request by the complainant to stop using the images and pull down the billboards. 

Findings of the ODPC

After an investigation, the ODPC determined that Grain Industries had violated:

• Section 28(1) of the Act by failing to obtain personal data directly from the complainant;
• Sections 32(1) and 30(1)(b) of the Act by failing to obtain consent from the complainant to process the personal data;
• Section 40(1)(b) of the Act by failing to pull down the complainant's images upon their request;
• Sections 26(a) and 29 of the Act by failing to inform the complainant that their image would be used for marketing purposes; and
• Section 37(1) of the Act by using images of the complainant for commercial gain without obtaining express consent.

Outcomes

As a result of the above, the ODPC ordered Grain Industries to pay the complainant KES 1 million (approx. $7,635) as compensation.

You can read the decision here.