[2025] KEHC 34 (KLR)

Muthoni v Solpia Kenya Limited t/a Sista Kenya (Civil Appeal E164 & 178 of 2024 (Consolidated)) [2025] KEHC 34 (KLR) (Civ) (13 January 2025) (Judgment)

Neutral citation: [2025] KEHC 34 (KLR)

Republic of Kenya

In the High Court at Nairobi (Milimani Law Courts)

Civil

Civil Appeal E164 & 178 of 2024 (Consolidated)

RC Rutto, J

January 13, 2025

Between

Hellen Muthoni

Appellant

and

Solpia Kenya Limited t/a Sista Kenya

Respondent

(An appeal from the decision of the Data Commissioner, (I. Kassait) delivered on 6th January 2024 in ODPC Complaint No. 1963 of 2023)

Judgment

1. By order of the court dated 16th July 2024 in Civil Appeal No. E174 of 2024, Civil Appeal No. E178 of 2024 and Civil Appeal No. E164 of 2024 were consolidated. This appeal, that is Civil Appeal No. E164 of 2024, was directed to be the lead filed with Civil Appeal No. E178 of 2024 being the cross appeal. To avoid incertitude when addressing the issues in both appeals, I will refer to Hellen Muthoni as the appellant and Solpia Kenya Limited T/A Sista Kenya shall be referred to as the respondent.

2. The appellant describes herself as an established and renowned television host, gospel artist, youth mentor, public figure, entrepreneur and media personality working at Inooro TV; a kikuyu dialect television broadcast station owned by Royal Media Service. In it, she hosts Inooro TV’s Sunday show called Rurumuka. She stated that she started working for Royal Media Service from 2016 and has since elevated her professional image as a TV personality, influencer, artist, entrepreneur and marketer.

3. Consequent to her influencing and media personality status, the appellant contended that her image has overtime been used to commercially market and advertise different products on her social media page subject to mutually agreed terms. According to her statistical empirical data, the appellant has amassed a following of 406,000 persons from Facebook, 17,000 followers on Twitter and 153,000 people from Instagram.

4. In October 2020, the appellant advanced that she went for a salon appointment. Upon execution of the hairstyle, she took a photo with her phone gadget and posted the same on her Instagram account @hellen_msoo and Facebook account Hellen Muthoni Kenya on 2nd October 2020 with the following caption:“how long can you stay without food? A year? Or more” noooo you cannot survive, and so it is when you stay without feeding your spirit man with the word of God, you cannot survive!!!!”

5. On 6th October 2020, the appellant came across the said image on the respondent’s Facebook account registered as Sistar Kenya and Instagram account named @sistarkenya with the following post:“<Afro Bulk Twist> Crochet braidGirls with natural hair styles (three fire emojis) We found a hair inspiration by @hellen_msoo in #afrobulktwistA true fire ball (three hand image emojis)#Repost @hellen_msoo (with @report.for.insta)”

6. According to the appellant, the above publication was done in contravention of section 37 of the Data Protection Act and Part III of the Data Protection (General) Regulations 2021 as the appellant did not authorize its publication. She averred that this breached her fundamental rights and freedoms on her right to privacy guaranteed in Article 31 of the Constitution as the respondent gained financially and commercially through those advertisements under the pretext that the appellant endorsed its products.

7. The appellant contended that following those posts, her employment was placed in jeopardy at the risk of breaching advertisement guidelines provided by her employer. Furthermore, she suffered mental and psychological distress as long as the posts remained on the social media platforms.

8. Resultantly, the appellant filed a constitutional petition in the Nairobi High Court Constitutional Petition No. E457 of 2021 suing the respondent. By judgment of the court dated 21st September 2023, the learned judge (Mrima, J.) directed the appellant to explore the internal dispute resolution mechanism provided in the Data Protection Act.

9. Abiding by the court’s orders, the appellant lodged a complaint dated 6th October 2023 before the Data Protection Commissioner against the respondent praying for the following reliefs:i.Compensation for violation of right to privacy;ii.Compensation for breaches of data causing loss of control;iii.Compensation for loss of financial gain;iv.Compensation for anxiety, stress, emotional and psychological distress;v.Sanctions against the respondent for breach of the Data Protection Act.

10. On being notified of the complaint by the office of Data Protection Commissioner, through its letter dated 27th November 2023, the respondent filed its response through a letter dated 1st December 2023. It argued that the image complained of was not posted by the respondent on its social media accounts; that it did not access the appellant’s image which was taken by her with her phone; and that it did not advertise as alleged.

11. In the alternative, the respondent recounted that the appellant was styled by one John Mwangi, a hair stylist who used the respondent’s products to style the appellant. That the appellant took her photo, posted it on her social media pages and tagged the hair stylist under his Instagram handle @dghniehairarts. Further, that the appellant’s handles are in the public domain and accessible to any social media account holders. In addition, the hair stylist tagged the respondent and made brief comments which could not be edited by any third party; the respondent included. Thereafter, the respondent reposted that post with the following comment:“<AFRO BULK TWIST> crochet braid, girl with natural hair styles. We found a hair inspiration by @hellen_msoo in #afrotwist a true fire ball.Repost @hellen_msoo (with @report from insta)”

12. The respondent justified that the comment was a general admiration of the artist’s representation of art in transforming the appellant’s natural look and was not in any way intended to be an advertisement in the context that the appellant was marketing the respondent’s products. That the republishing was done in compliance with the social media practice guidelines. Hence, consent was gratuitous and the repost was harmless, lawful and did not breach any of the appellant’s rights.

13. The respondent contended that following that reposting, the appellant in fact garnered more following on account of the respondent’s actions. Taking cue from the above, the respondent urged that it complied with the principles of data protection as it was neither the data controller or collector nor the data processor. In the circumstances, it was urged that the respondent was not in breach of sections 25, 26 and 29 of the Data Protection Act.

14. The respondent acknowledged the proceedings in Constitutional Petition No. E457 of 2021 and stated that it unfollowed the appellant on all her social media platforms and no contractual relationship existed between them so as to find that it was in breach.

15. In determining the dispute, the Data Protection Commissioner relied on the pleadings and documentary evidence adduced by the parties. In her decision dated 6th January 2024, the Data Protection Commissioner (I, Kassait) found that the respondent was liable for unlawfully processing the appellant’s personal data. It ordered the respondent to compensate the appellant in the sum of Kshs. 500,000. 00 for the unlawful processing of her personal data. The appellant and the respondent are both dissatisfied with those findings and each party lodged an appeal.

16. In this appeal, the appellant filed her memorandum of appeal dated 5th February 2024. She raised seven grounds disputing the findings of the Data Protection Commissioner that can be summarized as follows: the award of Kshs.500,000. 00 was inordinately low as the Data Protection Commissioner failed to take into account relevant facts together with the evidence of the appellant and did not accord with comparable awards in respect of similar violations; the Data Protection Commissioner failed to establish the formula applied and relied upon to justify the award; the respondent unlawfully processed and controlled the appellant’s data violating her right to privacy; and the Data Protection Commissioner erroneously considered hearsay evidence to conclude that the respondent did not post the appellant’s photograph and instead made brief comments against the weight of the evidence adduced.

17. In view of the foregoing, the appellant prayed that this Court re-assesses the award on general damages; reconsiders the facts and evidence afresh to issue orders accordingly and award costs of this appeal.

18. In Nairobi Civil Appeal No. E178 of 2024, the respondent filed its memorandum of appeal dated 6th February 2024. It raised six grounds impugning the findings of the Data Protection Commissioner. The summarized grounds of appeal are as follows; it was not a data controller or processor of the appellant’s personal data and could not thus be held liable; the fact of liking, commenting and reposting comments on social media did not amount to advertisement in form of online marketing and commercial use of personal data; the Data Protection Commissioner erroneously relied on extraneous evidence outside the parameters of the Data Protection Act; the respondent was denied a fair hearing and hence condemned unheard; and the award of damages was excessive and unjustifiable.

19. For those reasons, the respondent urged this court to allow the appeal, set aside the decision of 6th January 2024 and allow costs of the appeal and those at trial.

20. The appeals were canvassed by way of written submissions that were orally highlighted on 29th July 2024. The appellant’s written submissions are dated 11th June 2024. She argued that the Data Protection Commissioner rightly established that the respondent was a data controller and processer within the meaning set out in the Act having preserved her personal data. That the use of that data violated the provisions of section 37 of the Data Protection Act and regulation 14 of the Data Protection (General) Regulations 2021. Her complaint, however, was that the Commissioner erred in holding that the comments posted by the respondent were merely an appreciation post against the weight of the evidence adduced.

21. She submitted that the Commissioner failed to take into account the following: the appellant was a renowned influencer; she had gained a large following; the respondent benefited from her data commercially and financially; she was bound by her former employer’s guidelines regarding marketing; her digital marketing platform was her tool of trade; and the respondent ignored her letter of demand dated 12th August 2021. Taking this into account, the appellant submitted that the award of general damages was inordinately low as to warrant an interference from this court. It was her opinion that she ought to be awarded Kshs. 5,000,000. 00.

22. The appellant submitted that by using her photograph, the respondent engaged followers to purchase its products. That while she posted a religious message, the respondent used this post for commercial purposes. According to her, this was unlawful and in contravention of her data privacy rights because followers sought for pricing and the respondent thereto responded. That the conduct herein violated her rights enshrined in Articles 28, 30 and 31 of the Constitution.

23. Regarding the assertion that the respondent was not accorded a fair hearing, the appellant submitted that no fault could be attributed to the Commissioner regarding the procedure for hearing. That the process complied with sections 56 – 66 of the Act as well as regulations 11, 13 and 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021. They urged this court to invoke its jurisdiction and interfere with the findings on the award of general damages as the Data Protection Commissioner failed to apply the proper principles.

24. On the other hand, the respondent relied on its written submissions in both appeals both dated 2nd July 2024 to argue that the appellant’s right to data privacy under Article 31 of the Constitution was not infracted since the appellant posted the subject photo on her social media platform and was therefore public. In this regard, the property belonged to the application builders who remain the data controllers and processor in line with the definitions set out in section 2 of the Data Protection Act. As such, there was no need to obtain consent from the respondent. It emphasized the holding of the Data Protection Commissioner stating that consent was not required as the photograph was made public by the appellant. It was its submission that, it was the appellant who commercialized her photograph the moment she posted it. Being a public figure using her account to increase engagements, this granted any user and visitor to her account permission to actively view and engage with her posts by liking, commenting and reposting her posts in line with section 28 (2) and 32 of the Data Protection Act and regulation 14 of the Data Protection (General) Regulations 2021.

25. In addition, the respondent submitted that the Data Protection Act was inapplicable to social media posts insofar as it is appurtenant to liking the user posts and/or commenting. Since the appellant’s account was public, the respondent could not be held culpable for any wrongdoing. In any event, the appellant tagged John Mwangi in her post who in turn tagged the respondent that made brief comments on the artistry. Had the appellant wanted to exercise her privacy, the respondent opined that she ought to have controlled the visibility of the post in managing her privacy and privatize her account generally. She was therefore the author of her misfortune.

26. On the award of damages, the respondent urged this court to consider that the appellant failed to adduce data demonstrating how the respondent benefited commercially. It contended that privacy rights did not exist in a social media account for business purposes. It urged this court to apply the 3-pronged test as follows: the use of protected attribute; for an exploitative purpose, commercially or otherwise; and the absence of consent of use of the image.

27. The respondent invited this court to consider the marketing social media campaign #sww9seekenya promotion. The same attracted entrants by submitting their photographs of Kenya’s diversity including its people and culture. The campaign whose winner would be accolated with a C9 Techno phone/camera, ran for two weeks. It was this campaign, and not the appellant’s photograph, that amassed increase of clientele and business growth. Consequently, the appellant was not deserving of an award for general damages.

28. In any event, the Commissioner stated that no presentations or prayers by the appellant were made regarding compensation yet it still awarded damages. That, there was no justification for award of the same. Furthermore, her right to privacy was extinguished on account of the fact that her account was used for marketing for financial gain. Her actions thus amounted to constructive consent.

29. Finally, the respondent submitted that it was not given a fair hearing by the office of Data Protection Commissioner which failed to serve it with the appellant’s pleadings and to notify it of the hearing. Further, that the said office was in breach of section 57 of the Data Protection Act as no investigations were carried out.

30. The respondent’s case was that the appellant failed to establish her claim to the required standard of proof being on a balance of probabilities. It urged that, the appellant was only entitled to the right of erasure of her data which right was exercised by the respondent. It prayed that the appellant’s appeal be dismissed and that its appeal be allowed.

31. I have considered the memorandum of appeal and the appellants’ written submissions, examined the record of appeal and analyzed the law. As the first appellate court my primary role is to re-evaluate, re-assess and reanalyze the extracts on the record and then determine whether the conclusions reached by the learned trial magistrate, the Data Protection Commissioner in this instance, are to stand or not and give reasons either way. [See Abok James Odera T/A A.J Odera & Associates vs. John Patrick Machira T/A Machira & Co. Advocates [2013] eKLR]. Having summarized the facts as above, the following three issues arise for determination; Whether;i.the respondent violated the appellant’s data protection rights when it reposted her photographii.the Respondent was afforded a fair hearing in line with section 57 of the Data Protection Actiii.the award of general damages was appropriate and reasonable

Whether the respondent violated the appellant’s data protection rights when it reposted her photograph? 32. It is not in dispute that on 2nd October 2020, the appellant uploaded a photograph on her Instagram and Facebook handles namely @hellen_msoo and Hellen Muthoni Kenya respectively. The photograph was uploaded with the following caption:“how long can you stay without food? A year? Or more” noooo you cannot survive, and so it is when you stay without feeding your spirit man with the word of God, you cannot survive!!!!”

33. It is common ground that the same photograph was later, on 6th October 2020, uploaded by the respondent on both its Facebook account known as Sistar Kenya and Instagram account named @sistarkenya as follows:“<Afro Bulk Twist> Crochet braidGirls with natural hair styles (three fire emojis) We found a hair inspiration by @hellen_msoo in #afrobulktwistA true fire ball (three hand image emojis)#Repost @hellen_msoo (with @report.for.insta)”

34. The respondent cited several reasons justifying its actions: firstly, the appellant took her photo and when she posted it, she tagged John Mwangi, her hair stylist, on his Instagram handle @dghniehairarts. That the hair stylist used the respondent’s products to style the appellant. Secondly, the appellant’s social media handles are in the public domain accessible to any social media account holder. Thirdly, the stylist tagged the respondent who made brief comments that could not be edited by any third party. Fourthly, the respondent posted the comment as a general admiration of the artist’s representation of transforming the appellant’s natural look and was not in any way intended to be an advertisement in the context that the appellant was marketing the respondent’s products. Fifthly, the republishing was done in compliance with the social media practice guidelines. If anything, it was the appellant who benefitted from the respondent’s actions as she received more followers. In the circumstances, the respondent averred that the repost was harmless, lawful and did not breach any of the appellant’s rights.

35. Taking cue from the above, the respondent urged that it complied with the principles of data protection as it was neither the data controller or collector nor the data processor. In the circumstances, the respondent was not in breach of sections 25, 26 and 29 of the Data Protection Act.

36. In determining the issues, the Data Protection Commissioner found that the respondent was a data controller and data processor upon establishing that it was in a position to like, comment, repost, not to like, not to comment, not to repost or even ignore the photograph.

37. Article 31 of our Constitution provides that every person has the right to privacy. This includes the right not to have their person, home or property searched, their possessions seized, information relating to their family or private affairs unnecessarily required or revealed, or the privacy of their communications infringed (emphasize added). The Court in Jessicar Clarise Wanjiru vs Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR described the right to privacy as follows:“‘Privacy’, ‘dignity’, ‘identity’ and ‘reputation’ are facets of personality. All of us have a right to privacy and this right, together with the broader, inherent right to dignity, contributes to our humanity. It is the personality rights of dignity and privacy that underscore individuality and set both the limits of humanity and of human interaction. But, the reasons for protecting privacy are wider than just protecting the dignity of the individual.”

38. This provides that a person’s privacy is so sacrosanct that it cannot be violated as a person so pleases. So sanctified is this right to privacy that the Data Protection Act (the Act) was enacted in November 2019. Under its preamble, the Act is purposed to inter alia, give effect to Article 31(c) and (d) of the Constitution, establish the Office of the Data Protection Commissioner, make provision for the regulation of the processing of personal data and provide for the rights of data subjects and obligations of data controllers and processors. It is this statute that will assist this court in determining the issues before hand.

39. Section 2 of the Act, defines several relevant and critical words as follows; Data means inter alia information which is processed by means of equipment operating automatically in response to instructions given for that purpose. A data controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data. Data processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller. Personal data means any information relating to an identified or identifiable natural person.

40. In this case, it has been established that the appellant was the data subject and her personal data (her photograph) was posted on 2nd October 2020 by herself and subsequently reposted on 6th October 2020 by the respondent. It is not denied that the respondent posted the photograph but gave a myriad of reasons justifying it.

41. The respondent purported that it was tagged by John Mwangi, the appellant’s hair stylist and respondent’s partner from his Instagram handle @dghniehairarts. However, that information is not apparent from the evidence adduced and when the post is viewed. I agree with the appellant that it indeed appears to be a screenshot from the appellant’s Instagram handle.

42. Under its rights, a data subject, the subject of personal data, bears the right to be informed of the use to which their personal data is to be put and to object to the processing of all or part of their personal data. From the facts of this case, the appellant was not notified of the respondent’s post but only discovered the same with incredulity. The respondent justified that it was an admiration of the works previously done by the hair stylist.

43. A data controller or data processor is given the liberty to collect personal data directly from the data subject or indirectly in the following instances:(a)the data is contained in a public record;(b)the data subject has deliberately made the data public;(c)the data subject has consented to the collection from another source;(d)the data subject has an incapacity, the guardian appointed has consented to the collection from another source;(e)the collection from another source would not prejudice the interests of the data subject;(f)collection of data from another source is necessary:(i)for the prevention, detection, investigation, prosecution and punishment of crime;(ii)for the enforcement of a law which imposes a pecuniary penalty; or(iii)for the protection of the interests of the data subject or another person.

44. In collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined. Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.

45. The respondent justified that the photograph was imported from the appellant’s social media platforms which are in the public domain and accessible to a myriad of people. It opined that the appellant ought to have installed privacy settings barring the sharing of her personal data. Furthermore, it was the appellant who benefitted from the respondent’s actions as she received more followers.

46. This case brings to perspective the emerging aspects accruing from the continued use of social media. On one hand, the appellant, an active social media user who also termed herself as an influencer, voluntarily posted a photograph of herself. The photograph in question was taken after the appellant’s visit to her hair stylist. In my understanding, an influencer, such as the appellant gains such a status on the basis of the online following and the engagement with her online posts. Such engagement comes in form of liking, commenting or even reposting the appellant’s posts. Indeed, the appellant confirms that she uses her social media pages to commercially market different products at an agreed remuneration with the product owners. On the other hand, the respondent, a commercial enterprise engaged in hair products and styling came across the appellant’s photograph and reposted the same. Of note is that the appellant did not limit through her privacy settings the extent of engagement with her online posts leaving it open for anyone to engage with it.

47. On the face of it, this was nothing unusual as there is an implied expectation that engagements are possible by anyone to the extent that the engagement does not violate the social media platform policies which govern issues such as terrorism, incitement or obscenity. It such instances of violation, it is the platform owners that censor or otherwise impose sanctions.

48. Turning to the matter at hand, while the respondent would have been excused for merely reposting the appellant’s online post, the accompanying caption which it terms as admiration of the work of art of transforming the appellant’s natural hair, points to a marketing gimmick. Why do I say so? The appellant’s caption to her post was laced with a spiritual message. The respondent on its part focused on the appellant’s hair, a central feature of the respondent’s commercial endeavours. Moreover, the respondent conceded that the appellant’s stylist had used the respondent’s products. Further and as already noted, the post attracted enquiries on the respondent’s products which were promptly replied to by the respondent. This can be deduced from the comments on several account holders on Instagram and on Facebook requesting for pricing. It is this particular aspect of the online engagement by the respondent with the appellant’s post that I find, needed the appellant’s consent. This, I find, violated section 32 of the Act, the respondent having failed to establish consent to the processing of the appellant’s personal data for a specified purpose.

49. With due respect to the respondent’s justification, I find that no notification or consent was sought from the appellant to process the data on its Instagram and Facebook accounts. Secondly, the repost by the respondent having not been tagged ab initio went beyond the appellant’s own volition captured in the caption accompanying the post. Evidently, the respondent had every intention of commercially exploring the online post something it achieved going by some of the inquiries arising from the post. This inevitably converted the appellant into advertising the respondent’s products

50. Section 37 of the Act categorically states that a person shall not use personal data for commercial purposes unless the person has sought and obtained consent from the data subject, or is authorized under any written law. This consent is not constructive but apparent.

51. In Joel Mutuma Kirimi & another vs. National Hospital Insurance Fund (NHIF) [2020] eKLR, the court held as follows where no consent was found to have been granted:“Having established that the consent was not given it is apparent that the plaintiffs’ right to privacy and human dignity were infringed by the defendant. When the defendant took the plaintiffs picture out of the 1st plaintiff’s private account and used it for promotional purposes without their consent and using it for a purpose that they never intended to be part of.”

52. Ultimately, I find that the respondent breached the appellant’s data protection rights as set out in my above analysis as set out in the Data Protection Act and Article 31 of the Constriction. I am also satisfied to hold that the respondent’s use of the appellant’s photograph amounted to a commercial use purpose. At the risk of belaboring further, if the respondent was simply admiring the appellant’s photograph, there were other ways of demonstrating that rather than taking a screenshot and proceeding to post the photo as if to appear that the appellant and the respondent were in some sort of marketing partnership. In the South African case of Wells vs. Atoll Media (Pty) Ltd and another (11961/2006) [2009] ZAWCHC 173; [2010] 4 All SA 548 (WCC), the Court stated the following on protection of this right:“In Grutter v Lombard and another 2007 (4) SA 89 (SCA), at para 8 Nugent JA, in a most carefully researched judgment, noted that it was generally accepted academic opinion that features of a personal identity are capable and indeed deserving of legal protection. In the context of this case, therefore, the appropriation of a person's image or likeness for the commercial benefit or advantage of another may well call for legal intervention in order to protect the individual concerned. That may not apply to the kinds of photographs or television images of crowd scenes which contain images of individuals therein. However, when the photograph is employed, as in this case, for the benefit of a magazine sold to make profit, it constitutes an unjustifiable invasion of the personal rights of the individual, including the person's dignity and privacy. In this dispute, no care was exercised in respecting these core rights.”

53. I further find that the appellant’s case met the criteria set out in the case of N W R & another v Green Sports Africa Ltd & 4 others [2017] eKLR as follows:“In my view, from the above leading decision on the subject, the key elements of a Claim for unlawful use of Name or image which a Petitioner ought to establish to hold someone liable for unlawful use of name or likeness can be summarized into three, which I find have been proved in the present case. These are:i.Use of a Protected Attribute: The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff's name or likeness, but the law protects certain other personal attributes as well. In my view, the images used belong to the minors and their images are protected by the law.ii.For an Exploitative Purpose: The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone's name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the plaintiff's identity and a matter of legitimate public interest. In my view, the first Respondent has not demonstrated that the use of the images was purely for public interest and not for commercial interest or benefit on their behalf. The second Respondent is on record stating that it sponsors such activities. Whether or not the first Respondent benefits from such sponsorship is an issue that was not adequately addressed nor can it be ruled out.iii.No Consent: The plaintiff must establish that he or she did not give permission for the offending use. From the material before me, there is absolutely nothing to demonstrate that the first Respondent sought and obtained the consent of the parents. By voluntarily posing for the photos, the children cannot be said to have consented for the simple reason that they lacked the requisite capacity to grant the consent on account of being minors.”

54. In this case, the respondent used the appellant’s photograph which is a protective attribute. This was done when the respondent posted the appellant’s photograph on its Instagram and Facebook accounts @sistarkenya and Sistar Kenya respectively. Secondly, the respondent used the photograph for commercial purposes. This could be seen from the generated comments where persons were requesting for pricing and details regarding the respondent’s products. Thirdly, no consent had been obtained from the appellant for the use of her private data. Finally, the respondent furthermore did not demonstrate that its actions fell within the exemptions set out in part VII of the Data Protection Act.

55. The respondent invited this court to consider the marketing social media campaign #sww9seekenya promotion. The same attracted entrants by submitting their photographs of Kenya’s diversity including its people and culture. The campaign ran for two weeks whose winner would be accolated with a C9 Techno phone/camera. It was this campaign, and not the appellant’s photograph, that amassed increase of clientele and business growth. I find that these submissions were only introduced at this appellate stage as the primary pleadings and record of the trial is devoid of these facts. Submissions are not pleadings and cannot introduce new facts. At this stage of the matter, this court cannot take that evidence as to justify its actions. For this reason, this court will disregard those submissions.

Whether the respondent was afforded a fair hearing in line with section 57 of the Data Protection Act? 56. In its grounds of appeal, the respondent stated that it was not afforded a fair hearing because it was not served with the appellant’s pleadings by the office of the Data Protection Commissioner when notifying it of the hearing. It cited that the said office was in breach of section 57 of the Data Protection Act as no investigations were conducted. In addition, they submitted that the appellant was only entitled to the right of erasure of her data and which right had already been exercised by the respondent.

57. Section 57 (1) of the Act provides as follows:“The Data Commissioner may, for the purpose of the investigation of a complaint, order any person to:(a)attend at a specified time and place for the purpose of being examined orally in relation to the complaint;(b)produce such book, document, record or article as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other enactment from disclosing; or;(c)furnish a statement in writing made under oath or on affirmation setting out all information which may be required under the notice.”

58. Further, Regulation 11 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 provides:“Upon admission of a complaint, the Data Commissioner shall notify the respondent of the complaint lodged against him, in Form DPC 3 set out in the Schedule and shall require the respondent to within twenty-one days:(a)make representations and provide any relevant material or evidence in support of its representations;(b)review the complaint with a view of summarily resolving the complaint to the satisfaction of the complainant; or(c)provide a response with the required information.”

59. In this case, vide a letter dated 27th November 2023, the office of the Data Protection Commissioner set out its mandate as to conduct investigations on its own initiative, or on the basis of a complaint and require any person to provide explanations, information and assistance in person and in writing. Having received the complaint from the appellant, the office notified the respondent of the same and attached the complaint to the letter. The respondent was thus required to respond within 14 days.

60. The respondent comprehensively submitted its response addressing several issues raised by the appellant. If the respondent was not served, what was the basis of its response? I find that allegation false in the circumstances. Nothing would have been easier than for the respondent to express this concern either before presenting its response.

61. Insofar as investigations are concerned as set out in section 57, which procedure is further delineated in regulation 13 and 14 of the (Complaints Handling Procedure and Enforcement) Regulations, I find that they are not couched in mandatory terms and that there is no one cut fit size or procedure of how the investigations should be undertaken. The office of the Data Protection Commissioner has wide discretionary powers on how to exercise that power. Be that as it may, I find that the very nature of hearing the complaint by way of inviting the respondent to submit its response was an investigation to the complaint, and the response and documents adduced thereto guided the Data Protection Commissioner in making a determination.

62. I therefore find that the respondent has failed to demonstrate how this process was an affront to its right to a fair hearing. Accordingly, I find that the hearing process was fair and complied with the processes set out under the Data Protection Act, the attendant Regulations and Constitution.

Whether the award of general damages was appropriate and reasonable? 63. The respondent argued that principally, the appellant ought not to have been awarded general damages as compensation for breach. This is because the same was not pleaded in the complaint. Consequently, there was no justification for award of the same. On the other hand, the appellant submitted that the award on general damages was inordinately low and unjustified. In her view, she ought to have been awarded a sum of Kshs. 5,000,000. 00.

64. Section 65 of the Data Protection Act provides:1. A person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor.2. Subject to subsection (1):(a)a data controller involved in processing of personal data is liable for any damage caused by the processing; and(b)a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor:(i)has not complied with an obligation under the Act specifically directed at data processors; or(ii)as acted outside, or contrary to, the data controller's lawful instructions.3. A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage.4. In this section, "damage" includes financial loss and damage not involving financial loss, including distress.

65. Under Regulation 14 (2) (d) of the regulations thereunder, the Data Protection Commissioner is required to set in writing the remedy which the complainant is entitled to. Under regulation 14 (3) (e), compensation is one of those remedies.

66. Based on the above provisions of the law, I find that it was justifiable and within the Data Commissioner’s jurisdiction to grant an award as compensation for damages. Thus, the question is whether the amount of Kshs.500,000. 00 awarded was inordinately low or excessively high in the circumstance.

67. The appellant submitted that the award was manifestly and inordinately low and was not based on any jurisprudential principles. The respondent alleged that the amount awarded as general damages was excessively high and that the appellant was not deserving of that remedy and that her remedy lay in the right of erasure. The parties herein argued extensively on this issue and cited several decisions of the court.

68. In Wanjiru vs. Machakos University [2022] KEHC 10599 (KLR), the court awarded Kshs. 700,000. 00 general damages where the petitioner discovered a picture/photograph depicting her (hereinafter referred to as “the photograph”) being used by the respondent in advertising and marketing of the computer packages courses it offers. On conducting a further online search, she discovered that public commercial posts and advertisements were made by the Respondent using her photographs. They were also on its website advertising the list of computer packages courses being offered at Kshs. 7,000. 00.

69. In this case, I find that the right to compensation was appropriate taking into account the authority cited and the circumstances surrounding, I find that the award of Kshs 500,000. 00 in compensation for damages awarded to the appellant as sufficient. At any rate assessment of damage is an exercise of discretion resulting to a finding of fact which can only be interfered with when it can be proven that the same was arrived at injudiciously. None of the parties have persuaded me to interfere with the same. Needless to add, it is my recommendation that in assessing damages, the Commissioner should always give a basis for the compensation amount arrived at. This will not only assuage the grievances by the litigants but it will assist the Court in reviewing the same if called upon by the parties on appeal as is the case at the moment.

70. The upshot of the above is that, I find that both the appellant’s appeal and the respondent’s cross appeal fails. In the circumstances, the following are my orders:1. Civil Appeal No. E164 of 2024 fails to the extent that the award of general damages of Kshs. 500,000. 00 by the Data Commissioner is hereby upheld; Each party bears its own costs of this appeal;2. Civil Appeal No. E178 of 2024 lacks merit and it is hereby dismissed with each party bearing its own costs.It is so ordered.

RHODA RUTTOJUDGEDELIVERED, DATED AND SIGNED THIS 13TH DAY OF JANUARY 2025For Appellant:For Respondent:Court Assistant: