A couple of years back, I engaged a graphic designer to help me with updating my firm profile. He told me that instead of using stock images, which were somewhat impersonal, it would be better for us to use actual pictures of me and my staff going about our normal work in the office.

Fast-forward to 2021, there’s so much more to consider with the Data Protection Act now in full force and effect.

Case in Point

The case is Mutuku Ndambuki Matingi v Rafiki Microfinance Bank Limited [2021] eKLR. The Petitioner (Mr. Matingi) borrowed some money from the Bank to purchase a motorcycle (piki piki) for his boda boda business. The Bank used his picture for its promotion dubbed “GET A BODA” which was aimed at encouraging the purchase of motorcycles. The Judge made a number of important findings:-

  1. The right to privacy consists of the right to live one’s life with minimum interference;
  2. The right to the protection of one’s image presupposes the individual’s right to control the use of that image, including the right to refuse publication thereof;
  3. Publication or use of the images of an individual without their consent violates that person’s right to privacy;
  4. By publishing the Petitioner’s image being advanced a financial facility, the Bank violated the Petitioner’s right to dignity.

The Petitioner was, in the end, awarded Kshs 2,000,000.00 as damages for the violation of his right to dignity and privacy.

The question is, what can employers learn from this case?

Key provisions of the Data Protection Act, 2019

The Kenya Data Protection Act came into force on 25th November 2019. A Data Commissioner has now been appointed, paving the way for full compliance and enforcement of the Act.

“Personal data” is any information relating to a person – this would include a person’s photograph.

Two key principles of data collection which are outlined in the Act are:-

  • That a person’s personal data should be processed in accordance with the right to privacy of the data subject (in this case, the employee); and
  • That personal data should be collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes.

According to Section 26 of the Act,data subjects (employees) have the right to:-

  • Be informed of the use to which their personal data is to be put; and
  • Object to the processing of all or part of their personal data.

According to Section 30 of the Act, consent of the data subject (employee) is required prior to processing the data.

What do the above provisions mean?

An employer should secure the written consent of an employee prior to using the employee’s image for any purpose. The consent must be explicit as to the purposes for which the employer intends to use the photograph.

Penalty for non-compliance

Failure to comply with the provisions of the Data Protection Act exposes the employer, on conviction, to a fine not exceeding five million shillings or, in the case of an undertaking (business), up to 1% of its annual turnover of the preceding financial year, whichever is lower, or to imprisonment for a term not exceeding two years, or to both (Section 62).

An employee whose image is used without their consent may also demand to be paid or even file a suit seeking damages for breach of their right to privacy.

Other considerations

A former employee may not wish to have their image used by their former employer.


Employers should either seek explicit consent for use of an employee’s image or opt to use the photos of non-employees (stock images) in their marketing materials.

***THE END***

About Anne Babu

Anne is an Advocate of the High Court of Kenya and the Founding Partner of Anne Babu & Co. She has practised employment law for over 12 years and her employment law practice has been recognized by the prestigious Chambers & Partners. Anne cares about employers and their labour issues.


The information on this website is for general guidance on your rights and responsibilities and is not legal advice. If you need more details on your rights or legal advice about what action to take, please contact a lawyer.

We try to ensure that the information on this website is accurate. However, we will not accept liability for any loss, damage or inconvenience arising as a consequence of any use of or the inability to use any information on this website.

We assume no responsibility for the contents of linked websites. The inclusion of any link should not be taken as an endorsement of any kind by us of the linked website or any association with its operators. Further, we have no control over the availability of the linked pages.

error: Content is protected !!