Tulia Amboseli Safari Camp Ltd v 1. Daniel Odhiambo Opiyo & 2 others

repurposed the website content to promote its bush breakfast and hospitality services. 3. The Respondents noted that their images continued to be displayed on the Appellant’s website from 2018 to 2023 for commercial promotion without their consent. Upon discovering the continued use of their images in 2023, they issued a demand letter on 24th November 2023 seeking removal and compensation. A reminder followed on 15th January 2024 and the images were eventually removed in March 2024. The Complaint 4. The 1st and 2nd Respondents lodged a complaint before the Office of the Data Protection Commissioner (ODPC) on 14th September 2024 alleging that the Appellant had used their images without their authority and published them on its website to market bush breakfast hospitality services. 5. They contended that that the photographs identified them and constituted personal data which portrayed them as working for the Appellant, which was not true and that the use of their images was for commercial advertising without their consent. The Appellant’s Response 6. The Appellant’s case was that the photographs were originally taken by AAAL and uploaded to AAAL’s website which the Appellant inherited upon the acquisition of AAAL in 2018. HCCA E027 OF 2025 - JUDGEMENT 2

page 2 of 17

7. The Appellant averred that the images were not used for commercial purposes, were removed upon receipt of demand letters and that the matter ought to have been resolved through ADR. 8. After investigations, the Data Commissioner determined that the Appellant had unlawfully processed the Respondents’ personal data for commercial purposes and awarded Kshs. 500,000 to each Respondent. The Appeal 9. Aggrieved by the Data Commissioner’s decision, the Appellant filed the instant appeal which is premised on the following principal complaints: a) That the Data Commissioner erred in finding that the Appellant unlawfully processed the Respondents’ personal data for commercial purposes; b) That the award of Kshs. 1,000,000 as compensation lacked justification or basis; c) That the Commissioner failed to accord the parties an opportunity to be heard or to present the fullness of their case before making the determination; and d) That the Commissioner failed to properly consider the evidence and wrongly concluded that the Appellant used the Respondents’ images for financial gain. HCCA E027 OF 2025 - JUDGEMENT 3

page 3 of 17

10. The Appellant seeks that the determination be set aside and the complaint dismissed. 11. The appeal was canvassed by way of written submissions which I have considered. The Appellant’s Submissions 12. The Appellant argued that the image was lawfully published by AAAL with the Respondents’ consent and thus formed part of legacy website content inherited through a corporate acquisition. It was submitted that the website remained dormant and the image was not intentionally exploited for commercial gain. 13. The Appellant maintained that the Commissioner wrongly extended the definition of “commercial purposes” to cover passive hosting of inherited material and contended that the Commissioner unfairly imposed on it the burden of proving historical consent given to AAAL. The 1st and 2nd Respondents’ Submissions 14. The 1st and 2nd Respondents submitted that the Appellant bore the statutory burden, under the Data Protection Act, to demonstrate lawful processing and valid consent, particularly after repurposing their images for distinct commercial objectives, and that it failed to discharge this obligation despite being given adequate opportunity. They contended that the procedure before the Data Commissioner complied fully with Article 47 of the Constitution and the Fair Administrative Actions Act, as the Appellant was duly notified of the complaint, HCCA E027 OF 2025 - JUDGEMENT 4

page 4 of 17

represented by counsel, participated in ADR, and was afforded sufficient time to respond. According to the Respondents, the absence of an oral hearing did not amount to procedural unfairness since written procedures satisfied the requirements of natural justice. 15. On compensation, the Respondents argued that the award reflects the seriousness and prolonged nature of the unlawful processing and serves both restorative and deterrent purposes, noting that the quantum is conservative compared to awards in similar cases. They therefore urged the Court to uphold, in its entirety, the determination by the Data Protection Commissioner in Complaint No. 1398 of 2024. The 3rd Respondent’s Case 16. On procedural fairness and the right to be heard, the 3rd Respondent outlined the chronology of events leading to the determination as follows: i) The complaint by the 1st and 2nd Respondents was acknowledged in September 2024 in accordance with Regulation 4(4) of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. ii) The Appellant was notified of the complaint and accorded timelines to respond pursuant to Regulation 11(1). iii) A formal Notification of Complaint dated 7th October 2024 was issued, giving the Appellant an opportunity to HCCA E027 OF 2025 - JUDGEMENT 5

page 5 of 17

respond and/or resolve the matter through alternative dispute resolution (ADR). iv) The Appellant responded and elected to pursue mediation under Section 9(1)(c) of the Act and Regulation 15 of the Enforcement Regulations. v) Upon failure of ADR, the Commissioner proceeded to determine the complaint under Regulation 15(8). 17. The 3rd Respondent submitted that investigations were conducted pursuant to Section 57 of the Data Protection Act and Regulation 13 of the Enforcement Regulations. It further contended that the Appellant was informed of its right of appeal following the determination. 18. Accordingly, the 3rd Respondent maintained that the process complied with the constitutional requirements of fair administrative action under Article 47 of the Constitution and the Fair Administrative Action Act, and that the Appellant was afforded adequate opportunity to respond. 19. On lawfulness of the determination, the 3rd Respondent submited that its jurisdiction is derived from the Data Protection Act and the attendant regulations. It argued that the finding of unlawful processing was justified on the following grounds: i) The Appellant does not dispute that the 1st and 2nd Respondents’ photographs remained displayed on its website after acquisition of Airborne African Antics Limited (AAAL). HCCA E027 OF 2025 - JUDGEMENT 6

page 6 of 17

ii) Continued display of the images constituted processing within the meaning of the Act. iii) The principles of data minimization and purpose limitation under Section 25(c) and (d) of the Act require personal data to be processed only for explicit and legitimate purposes and not retained longer than necessary. iv) Any prior consent given to AAAL in the context of an employer–employee relationship did not automatically transfer to the Appellant or extend to a new purpose without express confirmation. v) Under Section 32(1) of the Act, the burden of proof lies with the data controller to demonstrate valid consent for a specified purpose. 20. The 3rd Respondent contended that the Appellant failed to discharge the burden of proof and did not produce evidence of valid consent authorizing continued commercial use of the images. 21. It was further submitted that the defences of estoppel, waiver, or delay are inapplicable to claims involving enforcement of constitutional rights, including the right to privacy under Article 31 of the Constitution. 22. On the award of compensation, the 3rd Respondent maintained that the award of Kshs. 500,000 to each of the 1st and 2nd Respondents falls within the discretionary powers conferred under Section 65 of the Act and HCCA E027 OF 2025 - JUDGEMENT 7

page 7 of 17

Regulations 14(2) and 14(3)(e) that the of the Enforcement Regulations. 23. It was argued award conforms to the requirements of Article 47(2) of the Constitution and Section 4(2) of the Fair Administrative Action Act. The 3rd Respondent further submitted that the award serves both restorative and deterrent purposes, particularly in vindicating the Respondents’ right to privacy. 24. The 3rd Respondent contended that the determination was detailed, reasoned, and based on the complaint, responses, and investigations conducted in accordance with the Act. Issues for Determination 25. I have carefully considered the record of appeal and the parties’ submissions. I find that the main issues arising for determination are: a) Whether the Appellant unlawfully processed the 1st and 2nd Respondents’ personal data. b) Whether the Appellant was denied the right to be heard. c) Whether the award of Kshs. 500,000 to each Respondent was justified and proportionate. Analysis and Determination 26. On whether the Appellant unlawfully processed the 1st and 2nd Respondents’ personal data, I note that it was not disputed that the images of the 1st and 2nd Respondents HCCA E027 OF 2025 - JUDGEMENT 8

page 8 of 17

remained displayed on the Appellant’s website from 2018 until March 2024. The central question is whether that continued display constituted unlawful processing under the Data Protection Act (the Act). 27. Section 2 of the Act defines “processing” as: “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available…” 28. I find that the continued hosting and public display of the Respondents’ images on the Appellant’s website clearly amounted to “storage” and “making available” and therefore constituted processing within the meaning of the Act. 29. Section 25 of the Act sets out the principles of data protection. It provides in part that a data controller shall ensure that personal data is: “(a) processed in accordance with the right to privacy of the data subject; (b) processed lawfully, fairly and in a transparent manner; (c) collected for explicit, specified and HCCA E027 OF 2025 - JUDGEMENT 9

page 9 of 17

legitimate purposes and not further processed in a manner incompatible with those purposes; (d) adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed; (e) kept in a form which identifies the data subjects for no longer than is necessary…” 30. Further, Section 30(1) provides: “A data controller or data processor shall not process personal data unless the data subject consents to the processing for one or more specified purposes.” 31. Section 32(1) places the burden squarely on the data controller: “Where processing is based on consent, the data controller or data processor shall bear the burden of demonstrating that consent was given by the data subject.” 32. In the present case, the Appellant did not produce any evidence to show that the Respondents had given consent for the continued use of their images after cessation of employment, nor for the repurposing of those images to market bush breakfast hospitality services. I find that even assuming consent had been granted to AAAL during the subsistence of employment, such consent would have HCCA E027 OF 2025 - JUDGEMENT 10

page 10 of 17

been limited to a particular purpose within a specific employment context. 33. The principle of purpose limitation under Section 25(c) is clear that data collected for one purpose cannot be repurposed for another incompatible purpose without fresh consent. It is my finding that the acquisition of AAAL as a going concern did not automatically transfer data subject consent for new and distinct commercial objectives. 34. The right implicated is grounded in Article 31 of the Constitution which provides that: “Every person has the right to privacy, which includes the right not to have— (a) their person, home or property searched; (b) their possessions seized; (c) information relating to their family or private affairs unnecessarily required or revealed; or (d) the privacy of their communications infringed.” 35. In Communications Commission of Kenya & 5 others vs. Royal Media Services Limited & 5 others [2014] eKLR, the Supreme Court underscored the centrality of constitutional rights and the obligation of all bodies exercising statutory power to give effect to constitutional principles. The Court stated: HCCA E027 OF 2025 - JUDGEMENT 11

page 11 of 17

“The Constitution is the supreme law of the land and binds all persons and all State organs at both levels of government.” 36. The record shows that the 1st and 2nd Respondents’ images remained accessible on the Appellant’s website after acquisition. As the entity controlling the website, the Appellant determined the purpose and means of processing that data and therefore qualified as a data controller. 37. Section 37(1) of the Data Protection Act prohibits commercial use of personal data without express consent. Regulation 14 defines commercial purposes as use of personal data to advance economic or commercial interests. 38. The question turns on whether the continued display of the image on the Appellant’s website amounted to commercial use. While the image was not freshly uploaded, it appeared on a platform promoting the Appellant’s business. However, the evidence indicates that the image was part of inherited content and was removed promptly upon complaint. There was no evidence of targeted marketing, specific commercial exploitation, or proof of financial gain arising from the image. 39. The Court must therefore assess whether passive continuation of legacy content, without deliberate republication or targeted commercial exploitation, meets the threshold of “commercial use” under Section 37. HCCA E027 OF 2025 - JUDGEMENT 12

page 12 of 17

40. It is my finding that the continued commercial display of identifiable images without consent falls within the mischief the Data Protection Act seeks to cure, which is, unauthorized use of personal data inconsistent with the right to privacy. 41. I therefore find that the Data Commissioner correctly concluded that the Appellant unlawfully processed the Respondents’ personal data. 42. On the right to be heard, Article 47(1) of the Constitution provides that: “Every person has the right to administrative action that is expeditious, efficient, lawful, reasonable and procedurally fair.” 43. Section 4(3) of the Fair Administrative Action Act provides that where an administrative action is likely to adversely affect rights, the administrator shall give the affected person: “(a) prior and adequate notice of the nature and reasons for the proposed administrative action; (b) an opportunity to be heard and to make representations in that regard…” 44. A perusal of the record reveals that the Appellant was notified of the complaint, it filed responses, elected to pursue ADR and upon failure of mediation, the matter HCCA E027 OF 2025 - JUDGEMENT 13

page 13 of 17

proceeded to determination. The Appellant was thereafter informed of its right of appeal. 45. In Judicial Service Commission vs. Mbalu Mutava & another [2015] eKLR, the Court of Appeal held that the right to be heard is not necessarily an oral hearing in all cases. What is required is that the person concerned should be given a reasonable opportunity to present his case. 46. Similarly, in Suchan Investment Limited vs. Ministry of National Heritage & Culture & 3 others [2016] eKLR, the Supreme Court stated that procedural fairness is not a one-size-fits-all concept and that what fairness requires depends on the circumstances of each case. 47. In the present case, I note that the Appellant fully participated in the written process and mediation. I find that the absence of an oral hearing did not, in the circumstances, amount to a denial of the right to be heard. I therefore find that the Appellant was accorded procedural fairness consistent with Article 47 and the Fair Administrative Action Act. 48. On the issue of whether the award of Kshs. 500,000 for each Respondent was justified, section 65(1)(b) of the Data Protection Act empowers the Commissioner to: “award compensation to a data subject for any damage suffered as a result of a contravention of this Act.” HCCA E027 OF 2025 - JUDGEMENT 14

page 14 of 17

49. Compensation under data protection law serves both restorative and deterrent functions. In this case, it is noteworthy that the unlawful processing in this case persisted for approximately five years after acquisition. The images were displayed on a commercial website, thereby associating the Respondents with an enterprise which they no longer worked for. 50. The Appellant however argued that no evidence of economic loss, reputational harm, or emotional distress was tendered and that the award of Kshs. 500,000 was therefore excessive and arbitrary. 51. It is trite that the award of damages is a discretionary exercise that must be based on principle and evidence. In the absence of demonstrated harm, compensation must be moderate and proportionate. 52. The Commissioner’s determination did not set out a clear basis for arriving at Kshs. 500,000 per Respondent. There was no analysis of the duration of publication, actual harm, or aggravating factors. 53. In comparable jurisprudence, courts have awarded significantly lower sums for similar infractions. 54. In Moses Audi & another vs. Standard Group PLC [2022] eKLR (Siaya HC, Petition E008 of 2021), the High Court awarded Kshs. 80,000 to each petitioner for the unauthorised use of their images. The Court emphasized that damages for violation of the right to privacy and image must be reasonable and proportionate to the circumstances of the case. The judgment did not HCCA E027 OF 2025 - JUDGEMENT 15

page 15 of 17

identify extensive economic loss or aggravated injury, the court underscored that in the absence of demonstrated harm, awards remain moderate. 55. Similarly, in Shiverenje Simani vs. Star Newspaper & another [2021] eKLR (Nairobi HC, Petition E161 of 2021), the Court awarded Kshs. 250,000 for violation of the petitioner’s right to privacy and publicity arising from the unauthorised publication of his image. The award reflected the Court’s assessment of proportional compensation without proof of specific pecuniary loss. 56. More recently, in Mwonga & 4 others vs. Ogega & another [2024] KEHC 16469 (KLR), the High Court awarded Kshs. 280,000 to each petitioner. The Court undertook a proportionality assessment based on the nature of the publication and absence of demonstrated aggravated harm. 57. These authorities illustrate that in comparable imagemisuse and privacy violations, courts have generally awarded between Kshs. 80,000 and Kshs. 280,000, reinforcing the principle that damages must be moderate, reasoned, and grounded in the evidence on record. 58. Taking a cue from the reasoning in the above cited cases and having regard to the inflationary trends that have lowered the value of the Kenyan Shilling I find that an award of Kshs. 300,000 for each Respondent will be a more appropriate compensation. 59. Consequently, the appeal succeeds, albeit partially, only in respect to quantum. The award of Kshs. 500,000 to HCCA E027 OF 2025 - JUDGEMENT 16

page 16 of 17

each Respondent is hereby set aside and substituted with an award of Kshs. 300,000. Each party shall bear his/its own costs of the appeal. It is so ordered. DATED, SIGNED AND DELIVERED AT NAIROBI THIS 26TH DAY OF FEBRUARY, 2026. HON. W. A. OKWANY JUDGE 26/02/2026 FOR APPELLANT ……………. FOR THE RESPONDENT ………… COURT ASSISTANT Ubah HCCA E027 OF 2025 - JUDGEMENT 17

page 17 of 17