St Joseph Health Care v Mbuthia (Civil Appeal E1061 of 2024) [2026] KEHC 4643 (KLR) (Civ) (9 April 2026) (Judgment)

REPUBLIC OF KENYA IN THE HIGH COURT OF KENYA AT NAIROBI CIVIL APPEAL DIVISION CIVIL APPEAL NO. E1061 OF 2024 ST JOSEPH HEALTH CARE ……………........................APPELLANT VERSUS ELIJAH KARIUKI MBUTHIA................................ RESPONDENT JUDGMENT 1. On 12th August 2024 the Office of the Data Protection Commissioner at Nairobi (Hon. Immaculate Kassait, MBS) delivered a judgment in favour of the Respondent. 2. Being dissatisfied with the whole of the Determination ,the appellant filed a Memorandum of Appeal dated 10.9.24 raising the following grounds: 3. The Honourable Data Commissioner erred in law and in fact by misconstruing the provisions of section 37 (I) of the Data Protection Act 2019 and consequently finding that the Appellant had not obtained the Respondent's express consent. 4. The Honourable Data Commissioner erred in law and in fact by finding that the Appellant used the Respondent's image for commercial gain without proof of the alleged commercial gain and consequently awarding the Respondent KShs. 500,000.00 as compensation. CIVIL APPEAL NO. E1061 OF 2024 JDT 1 | P a g e 5. The Honourable Data Commissioner erred in law and in fact by finding the Respondent's images were used for commercial purposes and consequently wrongfully invoked the provisions of Regulation 14 (1) of the Data Protection (General) Regulations 2021. 6. The Honourable Data Commissioner erred in law and in fact by failing to consider the fact that the Appellant is a non-profit institution and serves the public interest and therefore does not seek any commercial gain from the medical services it offers to the public. 7. The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant which demonstrated that the Respondent expressly consented to the use of his photos 8. The Honourable Data Commissioner erred in law and in fact by disregarding the evidence of the Appellant's employees which demonstrated that consent for the use of the Appellant's employees had been sought and was freely given by the employees including the Respondent. 9. The Honourable Data Commissioner erred in law and in fact by failing to appreciate that the Respondent had been terminated from employment on the grounds of gross misconduct by the Appellant prior to lodging the complaint and consequently failing to find the complaint was a profiteering attempt by a former employee of the Appellant. 10. The Honourable Data Commissioner erred in law and in fact by failing to find that the statutory mandate for employee grievances falls under the Employment Act 2007. CIVIL APPEAL NO. E1061 OF 2024 JDT 2 | P a g e 11. The Honourable Data Commissioner erred in law and in fact by awarding the Respondent the sum of KShs. 500,000.00 as compensation even after finding that there was no violation of the Respondent's rights under the Data Protection Act 2019. 12. According to the appellant on the 15 May 2024 the Respondent lodged a complaint with the office of the data commissioner alleging that his image has been used without his consent. 13. Subsequently on 10 June 2024, the appellant filed a response to the complaint with the argument that the respondent’s image was used with his consent. 14. On 12 August 2024 the office of the data commissioner arrived at the determination which the appellant seeks to overturn. It is its case that there is no requirement under The Data Protection Act that calls for the consent to be reduced into writing. 15. It is the appellant’s case that the respondent consented to the use of his image and that the same was used for awareness creation purposes and not for Commercial gain. 16. It argues that the respondent did not tender any evidence to prove that the image was being used for commercial purposes. 17. It is its case that the complaint was a reaction to the termination of the Respondent's employment. 18. The Applicant seeks the following orders: 1) The Appeal is allowed set aside in Respondent's CIVIL APPEAL NO. E1061 OF 2024 JDT 3 | P a g e 2) The Determination of Hon. Immaculate Kassait delivered on 12th August 2024 be its entirety and be substituted with a judgment that the Appellant obtained the express consent to use the Respondent's image for the Appellant's publication. The Appellant’s submissions. 19. The Appellant advances the argument The Appellant sought and obtained the Respondent's express consent prior to use the use of the Respondent's images. 20. It submits that The Respondent's images were not used for commercial gain and that the consistency of the evidence pointed out that there was motive for malice on the part of the Respondent after he was summarily dismissed by the Appellant. 21. It submits that there was no basis on which the compensation of Kshs.500,000.00 was awarded by the Data Commissioner noting that she found that there was no violation of the Respondent's rights under the Data Protection Act 2019. 22. The Appellant filed and served a Supplementary Record of Appeal dated 19th February 2025.It submits that from the evidence adduced before the Office of the Data Protection Commissioner, it is evident that the Appellant used the images of its employees in a number of publications of the Appellant and the Data Commissioner erred in law and in fact when she found that there was need for the Appellant to obtain the consent of the Respondent despite the contents of the Appellants letter to dated 10th June 2024 demonstrating that the CIVIL APPEAL NO. E1061 OF 2024 JDT 4 | P a g e Appellant sought and obtain Consent of its employees including the Respondent at the time. 23. It submits that the Court has a role to re-evaluate the evidence tendered before the Data Commissioner and form its own independent finding on the issues arising as guided by Section 78 (2) of the Civil Procedure Act Cap 21 which provides as follows; Subject as aforesaid, the appellate court shall have the same powers and shall perform as nearly as may be the same duties as are conferred and imposed by this Act on courts of original jurisdiction in respect of suits instituted therein. 24. Reliance is also placed in the case of Abok James Odera T/A Odera & Associates v John Patrick Muchira T/A Muchira & Co. Advocates (2013) eKLR where the Court of Appeal held as follows; “This being a first appeal we are reminded of our primary role as a first appellate court, namely to re-evaluate, re-assess and re- analyse the extracts on the record and then determine whether the conclusions reached by the learned trial Judge are to stand or not and give reasons either way." (Emphasis mine) 25. Under section 2 of the Data Protection Act 2019, consent is defined as follows; "Consent" means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a CIVIL APPEAL NO. E1061 OF 2024 JDT 5 | P a g e statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject. 26. The Data Commissioner therefore erred in law and in fact when she held that consent obtained orally must be reduced into writing or recorded electronically with an obtainable script. 27. Reliance is placed in the case of Jessicar Clarise Wanjiru v Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR where the Learned Judge enumerated the three tests that must be proved by a person claiming the exploitation of their image or likeliness as follows; "...the key elements of a Claim for unlawful use of Name or image which a petitioner must establish to succeed in a case of this nature are:- a. Use of a Protected Attribute: The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff's name or likeness, but the law protects certain other personal attributes as well. b. For an Exploitative Purpose: The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone's name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the CIVIL APPEAL NO. E1061 OF 2024 JDT 6 | P a g e plaintiff's identity and a matter of legitimate public interest. c. No Consent: The plaintiff must establish that he or she did not give permission for the offending use. (Emphasis mine) 28. The Leaned Judge cited the South African decision in the case of O'Keeffe v Argus Printing and Publishing Co Ltd and Another (1954) (3) SA 244 (C) where the Court outlined the considerations to be taken into account when determining such matters as follows; The unauthorized publication or a person's photograph and name for advertising is in my view capable of constituting an aggression upon that person's dignity. It is not necessary for me in the present case to hold, and I do not hold, that this is always. Much must depend upon the circumstances of each particular case, the nature the photograph, the personality of the plaintiff, his station in life, his previous habits with reference to publicity and the like. ... 29. The Appellant satisfied the burden of proof of showing that the consent was obtained to use the images of the Appellant's employee as seen in the minutes of the meeting held on 1gth January 2021. 30. It invites the court to be guided by the holding of the Court in the case of Jessicar Clarrise Supra where the Court pronounced at paragraph 33. CIVIL APPEAL NO. E1061 OF 2024 JDT 7 | P a g e 31. This third test has not been established to the satisfaction of the court. The petitioner alleges she did not give consent at all while the Respondent states that he contracted a designer to do the work and that the designer informed him that he had used the image of his girlfriend. It is important to note that petitioner did not rebut these allegations nor did she find it fit to file a supplementary affidavit to shed light on this issue or even deny the allegations or cast doubts. Instead, she opted to leave it to the court to weigh the two accounts. In my view, she had a duty to discharge the burden of prove and prove to the court beyond doubt that she did not grant consent nor did she authorize the to the court beyond doubt that she did not grant consent nor did she authorize the designer to use her image (Emphasis mine) 32. In the instant suit the appellant submits that the Respondent had consented to the use of his image on the Appellants publications by clear affirmative action when he was an employee of the Appellant. The Respondent was part of a meeting where the issue of the use of the images was discussed. It was not until the Respondent was summarily dismissed that he raised the issue that his consent was not obtained. 33. It submits that this is a mischievous tactic to get back to the Appellant for the justifiable summary dismissal his contract. Notable, the Respondent has never filed a suit before a Court of law to challenge the summary dismissal. 34. The Appellant submits that it provided evidence from a number of its employees that show that the complaint by the Respondent was an CIVIL APPEAL NO. E1061 OF 2024 JDT 8 | P a g e afterthought. However, the Data Commissioner erred in law and in fact when she held that the Respondent did not furnish the Office of the Data Protection Commissioner with evidence regarding the employment status of the witnesses who were readily available to prove the Appellants case. 35. It submits that under Section B (1) (f) of the Data Protection Act 2019, the Office of the Data Protection Commissioner is mandated to receive and investigate any complaint by any person on infringements of the rights under this Act. 36. In the execution of the functions of the said office, section 57 (1) (a) of the Data Protection Act 2019 the said office is empowered to order any person to "attend at a specified time and place for the purpose of being examined orally in relation to the complaint." 37. The Appellant submits that the Data Commissioner wrongly opted to use the documents only approach as provided under section 57 (1) (b) of the Data Protection Act 2019 but without giving a reason for selecting that option. 38. It submits that in the circumstances of this matter, it was necessary for the parties to be given an opportunity to submit orally as this would have enabled the Office of the Data Protection Commissioner test the veracity of the conflicting evidence relating to the allegations in the complaint by the Respondent. CIVIL APPEAL NO. E1061 OF 2024 JDT 9 | P a g e 39. It submits that the Appellant herein was readily available to provide the Office of the Data Protection Commissioner with any information regarding the complaint filed against the Appellant herein. 40. At no point did the Office of the Data Protection Commissioner request for the any additionally evidence, specifically in relation to the employment status of the witnesses who appended their signatures to the statements submitted by the Appellant. 41. It submits that the Appellant obtained explicit and express consent to use the Respondents image in its publications. 42. When it comes to the issue whether the Appellant used the Respondent's images for the purposes it submits that they were used it submits that the Data Commissioner erred in law and in fact by finding that the Respondent's images were used for commercial purposes and/or gain. 43. In paragraphs 34 (i) and 42 the impugned Determination dated 12th August 2024, the Data Commissioner erred when she formulated the issue. It is our submission that the issue of whether the image had been used for commercial purposes was not proved. 44. The Appellant used the images of the Respondent in a number of publications as a way of sensitizing the public, creating awareness and highlighting the services that were being offered by the Appellant which is a non-profit making institution. There was no commercial gain that was derived by the Appellant in the use of the Respondent. CIVIL APPEAL NO. E1061 OF 2024 JDT 10 | P a g e 45. It places reliance on the South African case of Wells v Atoll Media (Pty) Ltd and Another (11961/2006) [2009] ZACHC 173; [2010] 4 All SA 548 (WCC) as cited with approval in the case of Maina v Talent Quest Africa (Petition E336 of 2023) [2024] KEHC where Mugambi, J held as follows with respect to the question of commercial exploitation; "In the context of this case, therefore, the appropriation of a person's image or likeness for the commercial benefit or advantage of another may well call for legal intervention in order to protect the individual concerned. That may not apply to the kinds of photographs or television images of crowd scenes which contain images of individuals therein. However, when the photograph is employed, as in this case, for the benefit of a magazine sold to make profit, it constitutes an unjustifiable invasion of the personal rights of the individual, including the person's dignity and privacy. In this dispute, no care was exercised in respecting these core rights." 46. It submits that the Respondent herein did not provide any evidence of financial/commercial gain that was enjoyed by the Appellant as a result of the use of his images. The Appellant provides medical services to the community and public at large in the public interest. 47. It submits that the Appellant never made any profit as a result of the use of the Respondents images. Be that as it may, they re-emphasize that the Respondent had given consent to the use of his images to market and sensitize the public on the medical services offered by the Appellant before he was legally terminated from employment. CIVIL APPEAL NO. E1061 OF 2024 JDT 11 | P a g e 48. It submits that the Data Commissioner wrongfully invoked the provisions of section 37 of the Data Protection Act 2019 and regulation 14 of the Data Protection (General) Regulations 2021. 49. On the issue of the Data Commissioner erred in law and in fact when they awarded the Respondent compensation in the sum of Kshs.500,000.00 after making a finding that there was no violation of the Respondent's rights under the Act. 50. The Appellant has demonstrated that the Respondent had prior to his lawful termination from employment given express consent to the use of his image for advertising and marketing the Appellant's medical services to the public not for commercial gain, but in accordance with public interest. 51. It submits the Respondent failed to demonstrate with cogent evidence that he had suffered any loss/damage as a result of the publications. It is trite law under Section 107 (1) of the Evidence Act Cap 80 that he who alleges must prove. They therefore urge this Honourable Court to find that the Data Commissioner erred in law and in fact when she awarded the compensation of Kshs.500,000.00 to the Respondent. 52. Reliance is placed in the case of Jessicar Clarrise Wanjiru (Supra) where the Court held thus; "41. On the quantum of damages, award of damages entails exercise of judicial discretion which should be exercised judicially and that means that it must be exercised upon reason and principle and not upon caprice or personal opinion. CIVIL APPEAL NO. E1061 OF 2024 JDT 12 | P a g e 42. From the material presented in this case, the evident lack of clarity as to whether or not there was consent and considering the swiftness with which the bill boards were removed, I find that there is no material before me to demonstrate that the petitioner suffered any loss. 43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costa. 43. Accordingly, I am compelled to conclude that the petitioner has not proved her case to the required standard. Consequently, I dismiss this petition with no order as to costs. (Emphasis mine) 53. The Appellant submits that the Memorandum dated 10th September 2024 has merit. The Respondent's case; 54. The Respondent was an employee of the Appellant. He complained to the Appellant that it was using his image in its publications called dream magazine and calendar without his consent. 55. He raised the issue with Appellant’s chairman of Board Management Mr. Kahiga. He also complained about his image being used by the Appellant during the 2022 General elections on signage which created a false image that he was vying for the MCA seat Kahawa Wendani ward. 56. On one occasion, he stumbled upon one publication lying on the streets which caused him mental anguish. He particularized that he CIVIL APPEAL NO. E1061 OF 2024 JDT 13 | P a g e fell out with the administrators of the Appellant for the unauthorized use of his image which he wanted to be pulled down. 57. It is the respondent's case that his image was used by the Appellant, and without his consent as a result of which he lodged a complaint with the office of the commission of data protection seeking compensation. 58. The appellant was not given an opportunity to respond to the issue whether the consent was obtained before the use of the respondent’s images in magazines, social media posts amongst other places. 59. Ultimately, the Appellant was found liable and it was condemned to pay compensation of the sum of 500,000 to the respondent. That has precipitated the filing of the appeal. 60. He submits that the Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise. 61. Reliance is placed in in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity. CIVIL APPEAL NO. E1061 OF 2024 JDT 14 | P a g e 62. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at paragraph 44, Rutto J held; “in collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined. Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.” 63. In this appeal, the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image. The consent required is a conscious approval on how the data was to be used. 64. Despite collecting his image, the Appellant used it against his wishes which he objected to. They submit that the Appellant bulldozed the CIVIL APPEAL NO. E1061 OF 2024 JDT 15 | P a g e Respondent and used its position as his employer to publish his image without his consent. 65. On quantum of general damages, he argues that the amount awarded was not excessive. 66. He placed reliance in the case of the Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that: ‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours). The Respondent’s submissions; 67. He submits that the Data Commissioner undertook investigations as per her finding at paragraphs 30 and 31. She held “During investigations, it was found that written, signed and executed witness statements from the employees and former employees who participated in the project uniformly indicated that, although consent was sought verbally, the Respondent explicitly obtained consent from all parties before publishing their photos. 68. Additionally, it was revealed that among the eight witnesses received, seven explicitly stated that the Respondent sought consent for use of CIVIL APPEAL NO. E1061 OF 2024 JDT 16 | P a g e their images and likeness for advertisement, marketing, and promotion of the Health Center. 69. Only one witness indicated that consent was sought solely for creating awareness. 70. However, based on the evidence provided, the Respondent did not furnish the Office with evidence as to whether the written, signed and executed witness statements were from actual employees and or/former employees of the Respondent who participated in the project alongside the Complainant as alleged. 71. He submits that the Appellant misapprehended the Data Commissioners finding on liability. 72. The commissioner was not satisfied with the evidence adduced by the Appellant that the said persons making the witness statement were indeed employees and or former employees of the Appellant and their employment status. 73. This is buttressed by the fact that the Office of the Data Commissioner had investigatory powers and the said statements were not subjected to scrutiny by cross examination from the Respondent. 74. Further, the said statements were not availed to the Respondent for a response, rather were only availed to the Data Commissioner’s office as can be seen from the correspondences at pages 32-33 and 34-35 of the record. CIVIL APPEAL NO. E1061 OF 2024 JDT 17 | P a g e 75. The Office of the Data Commissioner had the discretion to determine the authenticity of the evidence provided by the parties which ought not to be disregarded by this Honourable Court. 76. The Data Protection Act, 2019 does not peg liability of a data violator on the purpose of the use of data. 77. The Data Commissioner did not peg the liability on the use of the Respondent’s image without his consent on the purpose of the use, commercial purpose or otherwise. 78. In Attorney General v Bala [2023] KECA 117 (KLR), the Court of Appeal, Okwengu, Omondi and Mativo JJAs held at paragraph 16 “… an appeal lay only as against a decree or as against an order passed under rules from which an appeal was expressly allowed by order 43, rule 1 of the Civil Procedure Rules. The first sentence in the two paragraphs the appellant cited were mere findings by the High Court. The last sentences were his views. No appeal could lie against a mere finding for the simple reason that the Civil Procedure Rules did not provide for any such appeal. ..An appeal does not lie against mere 'findings' recorded by a court unless the findings amount to a 'decree' or 'order'.” 79. Reliance is also placed in Joel Mutuma Kirimi & Another v National Hospital Insurance Fund (NHIF) (2020) eKLR, where the Defendant had used the Plaintiffs images to promote its activities. It argued that it was not involved in commercial affairs since it was a social insurance scheme meant to expand the Government of Kenya’s mandate to universal and affordable health CIVIL APPEAL NO. E1061 OF 2024 JDT 18 | P a g e care. Ong’injo J awarded each of the Plaintiffs Kshs. 5,000,000.00 for infringement of their right to privacy and human dignity. 80. In Catherine Njeri Wanjiru v Machakos University (2022) KEHC 10599 eKLR, the Respondent had published the Petitioner’s image during public graduation and used it on its publications without her consent. It claimed that the image was not for commercial gain since it’s a public university. The court held that the use of the Petitioner’s image without her knowledge or consent was an intrusion of her right to privacy, right to dignity and right to property was infringed. It awarded her Kshs, 700,000.00. 81. The Data Protection Act, 2019 was enacted to inter alia, give effect to Article 31(c) and (d) of the Constitution. It establishes the Office of the Data Protection Commissioner, make provision for the regulation of the processing of personal data and provide for the rights of data subjects and obligations of data controllers and processors. 82. He submits that a data subject has the right to be informed of the use to which his personal data is to be put to and to object to the processing of al or part of their subject data. 83. In this appeal, the data subject/Respondent complained that he was not informed that his image was to be used in the Appellant’s publications. 84. He demonstrated that despite that, his image was used in the Dream Magazine run by the data processor/Appellant, wall calendars and CIVIL APPEAL NO. E1061 OF 2024 JDT 19 | P a g e sign posts. He protested the use of his image during his employment by the Appellant which rubbed feathers with the Appellant which stated that it had rights to use his image as his employer. 85. In Muthoni v Solpia Kenya Limited t/a Sista Kenya (2025) KEHC 34 (KLR) at paragraph 44, Rutto J held; “In collecting the data, the said data controller or data processor shall do so for a purpose that is lawful, specific and explicitly defined. Before collection of personal data, section 27 of the Act explicitly provides that a data controller or data processor shall inform the data subject that it is collecting the data within the parameters set out in section 26 of the Act and includes, the purpose for so collecting, who it will be transferred to, furnish its contacts to the data subject, whether any other entity would receive the data, a description of the technical and organization security measures in place, the data being collected pursuant to any law, whether such collection is voluntary or mandatory and the consequences where the data subject failing to provide the data. Under section 30 of the Act, critically, a data processor or data controller is not allowed to process data unless consent has been obtained from the data subject. A contravention of the provision is tantamount to the commission of an offence.” 86. He submits that the Data Protection Commissioner properly established that the Appellant had the burden of proving that it obtained the Respondent’s consent to use process his image. CIVIL APPEAL NO. E1061 OF 2024 JDT 20 | P a g e 87. The consent required is a conscious approval on how the data was to be used. 88. Despite collecting his image, the Appellant used it against his wishes which he objected to. 89. He submits that the Appellant bulldozed the Respondent and used its position as his employer to publish his image without his consent. 90. On quantum, this Honourable Court should be very reluctant in disturbing the decision of the trial court on quantum. 91. The governing principle was dutifully restated by Mrima J in Eunice Auma Onyango v Salin Akinyi Oluoch [2015] eKLR, citing the Court of Appeal in Kemfro Africa Limited T/A Meru Express Services, Gathogo Kanini Vs. A.M.M Lubia & Another (1982-88) 1 KAR 777 thus: - ‘the principles to be observed by an appellate court in deciding whether it is justified in disturbing the quantum of damages awarded by a trial Judge were held by the former Court of Appeal of Eastern Africa to be that it must be satisfied that either the Judge, in assessing the damages took into account an irrelevant factor, or left out of account a relevant one, or that; short of this, the amount is so inordinately low or so inordinately high that it must be a wholly erroneous estimate of the damage.’ 92. The Court of Appeal in Gicheru V Morton and Another (2005) 2 KLR 333 set out the parameters under which an appellate court will interfere with an award in general damages when it held that: CIVIL APPEAL NO. E1061 OF 2024 JDT 21 | P a g e ‘An appellate court will not disturb an award for general damages unless it is so inordinately high or low as to represent an entirely erroneous estimate. It must be shown that the Judge proceeded on wrong principles, or that he misapprehended the evidence in some material respect and so arrived at a figure which was either inordinately high or low...’ (Emphasis ours). 93. In Muthoni v Solpia Kenya Limited t/a Sista Kenya, supra, the Respondent had appropriated the Appellant’s image from her Instagram’s account to advertise and market its products on Facebook. She had been awarded Kshs. 500,000.00 by the Data Commissioner. 94. Her appeal on quantum was dismissed and the award of Kshs. 500,000.00 was upheld. 95. In Catherine Njeri Wanjiru case, supra, the Respondent’s publication of Petitioner’s image during public graduation and on its publications without her knowledge or consent was held to be an intrusion of her right to privacy, right to dignity and right to property we infringed. It awarded her Kshs, 700,000.00. 96. He submits that the Honourable Tribunal did not err in awarding the Respondent compensation of Kshs. 500,000.00 for unauthorized use of his image. Analysis and determination; The following are the issues for determination; 1) Whether the appeal has merit. CIVIL APPEAL NO. E1061 OF 2024 JDT 22 | P a g e 2) Who shall bear the costs . Whether the appeal has merit; 97. In Selle & Another vs. Associated Motor Boat Co Ltd & Others [1968] EA the court therein held that the appellate court was not bound by the findings of fact of the trial court but that in re- considering and re-evaluating the evidence so as to draw its own conclusions, it always had to bear in mind that it neither saw nor heard the witnesses and thus make due allowance in that respect. 98. This principle was enunciated thus: “...this court is not bound necessarily to accept the findings of fact by the court below. An appeal to this court ... is by way of retrial and the principles upon which this court acts in such an appeal are well settled. Briefly put they are that this court must reconsider the evidence, evaluate it itself and draw its own conclusions though it should always bear in mind that it has neither seen nor heard the witnesses and should make due allowance in this respect...” 99. This court shall reconsider the evidence and evaluate it in arriving at its own conclusion. 100. It is important for the court to revisit what privacy means. The Court in Jessicar Clarise Wanjiru vs Davinci Aesthetics & Reconstruction Centre & 2 others [2017] eKLR described the right to privacy as follows: CIVIL APPEAL NO. E1061 OF 2024 JDT 23 | P a g e “Privacy’, ‘dignity’, ‘identity’ and ‘reputation’ are facets of personality. All of us have a right to privacy and this right, together with the broader, inherent right to dignity, contributes to our humanity. It is the personality rights of dignity and privacy that underscore individuality and set both the limits of humanity and of human interaction. But, the reasons for protecting privacy are wider than just protecting the dignity of the individual.” 101. There is no dispute that the Respondent has a right to Privacy. The dispute is whether it was violated by the appellant precipitating the lodging of a complaint with the office of the Data Commissioner seeking redress which culminated in the impugned decision. 102. According to the appellant, the data commissioner fell into error in finding that the respondent to did not consent to the use of his image. 103. The appellant argued that the respondent consented to the use of his image in line with the minutes of the meeting that the appellant convened. 104. In evaluating whether the response consented to the use of his image the court has looked at the minutes alongside Section 2 of the Data Protection Act which provides that a consent must be an express, unequivocal, free, specific, and informed indication the wishes of a data subject, signifying agreement to processing of his or her personal data. 105. The Guidance Note clarifies each element of consent. For consent to be “free,” the data subject must not feel compelled to consent, and CIVIL APPEAL NO. E1061 OF 2024 JDT 24 | P a g e must not be subject to negative consequences if they do not consent— they must not be subject to inappropriate pressure or influence that prevents them from exercising their free will. Consent will not be considered “free” if the data subject may not withdraw their consent without detriment. 106. Section 32 of the Data Protection Act expressly states that a data subject has the right to withdraw consent at any time, even though the withdrawal of this consent does not invalidate any processing of personal data that occurred prior to withdrawal. 107. Consent is “informed” if it is based on an understanding of the data processing activities and their implications for the rights of the data subject. 108. Data controllers and data processors have an obligation to ensure that accurate and full information is availed to the data subject regarding the nature of the personal data to be processed, the purpose for processing it, consequences for not consenting to such processing, and the rights of the data subject. Moreover, this information must be provided clearly, simply and in plain language and the request for consent needs to be prominent, concise, and kept separate from other terms and conditions. 109. The minutes that the appellant seeks to rely on cannot amount to the respondent’s Consent for the use of his image. There is no clause that showed him how to exit from the space or the relationship. The minutes cannot amount to an informed consent. Very many things CIVIL APPEAL NO. E1061 OF 2024 JDT 25 | P a g e arose in the meeting as demonstrated in the minutes clouding any possibility of a free consent. 110. It is this court’s finding and I so hold that the appellant did not take time to furnish the respondent with accurate and full information regarding the nature of the personal data to be processed, the purpose for processing it, consequences for not consenting to such processing, how to withdraw the consent and the rights of the data subject. 111. This court underscores the need for employers to always remember that they are in a position of authority over the employees and that they must at all times ensure that the said authority is not used as a platform that leads employees to accept to surrender their image and data on vague terms or for the fear of reprisals. 112. The fact that a data subject does not rise up to challenge the limits for the use of their data or image cannot come to the aid of an employer who fails to protect, promote and fulfil the provision of Section 2 of the Data Protection Act which creates the duty to at all times ensure that a consent of an employee who is a data subject is express, unequivocal, free, specific, and informed indication of the wishes of a data subject, signifying agreement to processing of his or her personal data. 113. For a consent to be “specific,” data controllers and processors must, at the minimum, provide information on the identity of the data controller/processor and of any third party who will be relying on the consent, specific information on the purposes for which consent is sought, “granular consent options” for each separate type of CIVIL APPEAL NO. E1061 OF 2024 JDT 26 | P a g e processing unless those activities are clearly interdependent, and information on how to withdraw consent. The appellant did not fulfil this. 114. Section 32 (2) of the Data Protection Act provides that; unless otherwise provided under this Act, a data subject shall have the right to withdraw consent at any time. 115. Furthermore, the data subject must understand how their image will be used, for what purpose, by whom, and for how long. 116. The appellant did not take time to ensure that the foregoing was complied with or done. This left the respondent helpless, exposed and in a vulnerable state which he had no control over. Article 31 of the Constitution seeks to insulate all from such exposure by placing the duty to protect on the shoulders of every data processor like the appellant under Article 3 and 20 of the Constitution. 117. The right to withdraw consent at any time is very imperative even when the consent is obtained in writing. Pursuant to the Act, consent must be “express, … by a statement or clear affirmative action.” This means that the data subject must have taken a deliberate action to consent to the processing of their personal data. “Consent by default,” for instance—i.e., a situation where the data subject is presumed to consent to the processing of their personal data unless they opt out— would be invalid. That seems to have been the case in the instant appeal. 118. Looked at differently, Section 32 (1) of the Data Protection Act stipulates that a data controller or data processor shall bear the CIVIL APPEAL NO. E1061 OF 2024 JDT 27 | P a g e burden of proof establishing that a data subject's consented to the processing of their personal data for a specified purpose. This resonates with Article 24 of the Constitution. The Appellant did not tender any evidence to prove that the consent was valid. 119. On to another limb, it is the appellant’s case that the Respondent's image was not used for commercial purposes. 120. In advancing this argument it is the appellant’s case that it is not a for profit making outfit and that the Respondent's image was not used for commercial purposes. 121. Article 31(c) of the Constitution provides that every person has the right to privacy, which includes the right not to have information relating to their family or private affairs unnecessarily required or revealed. This accords with the values and principles as espoused in the Data Protection Act which was enacted among other things to make provision for the regulation of the processing of personal data to provide for the rights of data subjects and obligations of data controllers and processors. 122. Article 12 of the Universal Declaration of Human Rights and Article 17 of the international Covenant on Civil and Political Rights provide that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honor and reputation. 123. The Illegal commercial use of data involves utilizing a person’s personal information—such as images, for financial gain or to CIVIL APPEAL NO. E1061 OF 2024 JDT 28 | P a g e advance business interests without complying with legal data protection regulations. 124. The case of N W R & another v Green Sports Africa Ltd & 4 others [2017] eKLR as follows: “In my view, from the above leading decision on the subject, the key elements of a Claim for unlawful use of Name or image which a Petitioner ought to establish to hold someone liable for unlawful use of name or likeness can be summarized into three, which I and have been proved in the present case. These are: Use of a Protected Attribute: The plaintiff must show that the defendant used an aspect of his or her identity that is protected by the law. This ordinarily means a plaintiff's name or likeness, but the law protects certain other personal attributes as well. In my view, the images used belong to the minors and their images are protected by the law. For an Exploitative Purpose: The plaintiff must show that the defendant used his name, likeness, or other personal attributes for commercial or other exploitative purposes. Use of someone's name or likeness for news reporting and other expressive purposes is not exploitative, so long as there is a reasonable relationship between the use of the plaintiff's identity and a matter of legitimate public interest. In my view, the First Respondent has not demonstrated that the use of the images was purely for public interest and not for commercial interest or be it on their behalf. The second Respondent is on record stating that CIVIL APPEAL NO. E1061 OF 2024 JDT 29 | P a g e it sponsors such activities. Whether or not the 1st Respondent benefits from such sponsorship is an issue that was not adequately addressed nor can it be ruled out. No Consent: The plaintiff must establish that he or she did not give permission for the pending use. From the material before me, there is absolutely nothing to demonstrate that the 1st Respondent sought and obtained the consent of the parents. By voluntarily posing for the photos, the children cannot be said to have consented for the simple reason that they lacked the requisite capacity to grant the consent on account of being minors.” 125. In evaluating the evidence, the court has keenly looked at the appellant's brochure which carries the Respondent's image alongside the minutes dated 19.1.25. 126. The court has noted that the appellant at Minute 1 reads – “Customer Care; the new price list was rolled out and the clients are receptive about it.” From the plain reading of Minute 1 the court concludes that the Appellant’s activities have a commercial dimension and a structure that necessitated the new price listing and that the respondent’s image was used by the appellant for commercial gain without his consent. 127. The court will now address its mind to the form of hearing that the data commissioner adopted. Section 57 of The Data Protection Act provides that; CIVIL APPEAL NO. E1061 OF 2024 JDT 30 | P a g e 57 (1) The Data Commissioner may, for the purpose of the investigation of a complaint, order any person to— (a) attend at a specified time and place for the purpose of being examined orally in relation to the complaint; (b)produce such book, document, record or article as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other enactment from disclosing; or (c) furnish a statement in writing made under oath or on affirmation setting out all information which may be required under the notice. 128. Regulation 11 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 provides: “Upon admission of a complaint, the Data Commissioner shall notify the respondent of the complaint lodged against him, in Form DPC 3 set out in the Schedule and shall require the respondent to within twenty-one days: (a) make representations and provide any relevant material or evidence in support of its representations; (b) review the complaint with a view of summarily resolving the complaint to the satisfaction of the complainant; or (c) provide a response with the required information.” CIVIL APPEAL NO. E1061 OF 2024 JDT 31 | P a g e 129. The commissioner has discretion when it comes to the form of hearing that it will adopt which discretion must be exercised judiciously and within the threshold of Article 47 of the Constitution. 130. In the instant appeal, the court notes that the applicant was furnished with the complaint. It responded and advanced its case after which the data Commissioner arrived at the impugned decision. The Appellant embraced the jurisdiction of the Commissioner as donated by the Act. 131. This court finds that the form of hearing that was adopted by the office of the data commissioner was legal and procedurally fair and in compliance with Articles 47 and 50 of the Constitution and Regulation 11 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations 2021 and Section 8 of The Fair Administrative Action Act. 132. The appellant also challenges the amount awarded to the respondent as general damages. 133. Section 65 (1) provides that a person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor. (2)Subject to subsection (1)— (a)a data controller involved in processing of personal data is liable for any damage caused by the processing; and CIVIL APPEAL NO. E1061 OF 2024 JDT 32 | P a g e (b)a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor— (i)has not complied with an obligation under the Act specifically directed at data processors; or (ii)has acted outside, or contrary to, the data controller's lawful instructions. (3)A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage. (4) In this section, "damage" includes financial loss and damage not involving financial loss, including distress. 134. In the instant appeal, the court found that the appellant contravened Sections 2 and 32 of the Data Protection Act. 135. Under Regulation 14 (2) (d) of the regulations thereunder, the Data Protection Commissioner is required to set in writing the remedy which the complainant is entitled to. Under regulation 14 (3) (e), compensation is one of those remedies. 136. It is this court's finding and I hold that the damages awarded were reasonable and within the Data Commissioner’s jurisdiction. 137. In arriving at this conclusion, this court is guided by the case of Wanjiru vs. Machakos University [2022] KEHC 10599 (KLR), where the court awarded Kshs. 700,000.00 general damages CIVIL APPEAL NO. E1061 OF 2024 JDT 33 | P a g e where the petitioner discovered a picture/photograph depicting her (hereinafter referred to as “the photograph”) being used by the respondent in advertising and marketing of the computer packages courses it others. On conducting a further online search, she discovered that public commercial posts and advertisements were made by the Respondent using her photographs. They were also on its website advertising the list of computer packages courses being offered at Kshs. 7,000.00. 138. On the issue of costs, the court is guided by the case of Republic vs Rosemary Wairimu Munene, Ex-Parte Applicant vs Ihururu Dairy Farmers Cooperative Society Ltd Judicial Review Application no 6 of 2014 where the court held as follows: - “The issue of costs is the discretion of the court as provided under the above section. The basic rule on attribution of costs is that costs follow the event.......It is well recognized that the principle costs follow the event is not to be used to penalize the losing party; rather it is for compensating the successful party for the trouble taken in prosecuting or defending the case.” 139. The appellant shall shoulder the costs of this appeal. Disposition: 140. The appeal lacks merit. Order: 141. The appeal is dismissed with costs. CIVIL APPEAL NO. E1061 OF 2024 JDT 34 | P a g e Dated, signed and delivered at Nairobi this 9th day of April, 2026. ………………………………… J. CHIGITI (SC) JUDGE CIVIL APPEAL NO. E1061 OF 2024 JDT 35 | P a g e