The Office of the Data Protection Commissioner (ODPC) has ordered a corporate employer to pay a former staff member Ksh500,000 for using his image in promotional campaigns after his employment had ended. The regulator found that the prolonged display of the photograph on the company’s website and social media channels constituted commercial processing of personal data. This practice violated Section 37 of the Data Protection Act, 2019.
The use of employee images is a common practice in many organizations, often used to create staff identification badges, maintain security records, and satisfy HR administrative needs. However, few contractual agreements define what happens to those digital assets once an employee departs. Kenya’s Data Protection Act mandates that institutions retain personal information only for as long as reasonably necessary to fulfill the specific purpose for which it was gathered.
The dispute brought before the ODPC involved a former employee who discovered his photo actively featuring in corporate promotional campaigns after resigning. The complainant informed the regulator that the company used his likeness in marketing materials promoting specialized VIP protection services without seeking or obtaining his fresh consent. The employer acknowledged that the photograph remained visible online but attributed the oversight to an administrative error.
The ODPC rejected the employer’s defense, ruling that a terminated employment contract automatically terminates any implied consent or lawful basis for processing a worker’s personal data. Finding no legal basis for the continued commercial exploitation of the former employee’s image, the regulator held the firm liable and awarded Ksh500,000 in statutory compensation. The company eventually pulled down the website in December 2024 after receiving complaints.
The landmark determination sheds light on workplace privacy rights and highlights the legal obligations employers face regarding employee imagery after staff departures. Employers must enforce clear retention policies and systematically erase, delete, anonymize, or pseudonymize personal data once the original processing purpose lapses. This ruling serves as a reminder for organizations to review their data handling practices.
The Data Protection (General) Regulations require organizations to enforce clear retention policies, and the ODPC's decision emphasizes the importance of obtaining express consent for commercial data use. The regulator's action demonstrates its commitment to protecting individuals' personal data and enforcing the provisions of the Data Protection Act, 2019. Organizations must ensure they have adequate measures in place to handle employee data.
The fine imposed on the company serves as a warning to organizations to prioritize data protection and respect employees' rights. The ODPC's decision is a significant step towards ensuring that employers handle employee data responsibly and in accordance with the law. Employers must take steps to ensure that they are compliant with the Data Protection Act, 2019, and respect the rights of their employees.
Key points
- The ODPC fined a company Ksh500,000 for using a former employee's photo in advertisements without consent.
- The Data Protection Act, 2019, requires express consent for commercial data use unless otherwise authorized by law.
- Employers must enforce clear retention policies and systematically erase personal data once the original processing purpose lapses.
