In a groundbreaking application of the law, the Office of the Data Protection Commissioner (ODPC) has imposed a penalty on Casa Vera Lounge, a nightclub located along Ngong Road in Nairobi, for sharing a partygoer’s photograph on social media without their consent.
The ODPC issued a statement on September 26, announcing a fine of Sh1.85 million against the club.
The statement from the ODPC emphasized the objective of this penalty, stating, “This Penalty seeks to ensure that other lounges, clubs, etc., seek consent from their customers prior to posting their images online.”
This action aligns with Article 31 of the Constitution, which safeguards an individual’s right to privacy, with Article 31(c) specifically protecting an individual’s information related to family or private affairs from being unnecessarily disclosed.
In recent times, numerous nightclubs have begun employing professional photographers whose primary responsibility is to capture photos of revelers enjoying themselves, intending to later publish these images on the club’s respective social media platforms.
Club owners assert that nightclub photography serves several purposes, such as enhancing the club’s online visibility, promoting the club’s brand, attracting clientele, preserving a record of the club’s activities, and maintaining an active social media presence.
However, as this trend gains momentum and more nightclubs populate their social media accounts with snapshots of the previous night’s club activities, more partygoers are becoming apprehensive about the situation.
Article 31 of the Constitution protects the rights of an individual to his or her privacy, and Article 31(c) protects an individual’s information relating to family or private affairs unnecessarily required or revealed.
This means that no club has the right to disseminate your photos on social media without your explicit consent, unless it can be clearly demonstrated that you willingly posed for the photos or if both you and your partner, or the club management, can convincingly prove that you requested to be photographed.
Data Commissioner Immaculate Kassait has called upon data controllers and data processors to ensure that the processing of personal data adheres to the provisions of the Data Protection Act, 2019. She has issued a stern warning that failure to comply with the Act will lead to the initiation of enforcement procedures.
Additionally, the ODPC has imposed a penalty of Sh2.975 million on Mulla Pride Ltd, a Digital Credit Provider (DCP) that operates KeCredit and Faircash mobile lending apps.
This fine was imposed for utilizing names and contact information obtained from third parties. The statement emphasized that this penalty will compel digital lenders and financial institutions to inform data subjects when collecting and processing their data, along with outlining the intended purpose of processing said data.
It further enforces that data controllers are only allowed to engage with data subjects who have explicitly consented to the collection and processing of their data.
Lastly, Roma School, an educational institution located in Uthiru, has been fined Sh4.55 million for posting pictures of minors without obtaining parental consent. The ODPC highlighted that this penalty, being the first and the highest imposed on an educational institution, sends a clear message to schools and other facilities handling minors’ personal data to seek consent from parents or guardians before processing such data.
