Former Moja Expressway employee awarded Sh500,000 in data privacy case

The Office of the Data Protection Commissioner has issued a decision in favour of Cyrus Mwaniki Ndung'u, awarding him Sh500,000 from Moja Expressway, the operator of the Nairobi Expressway.

The case centred on the unauthorized use of Ndung'u's image in a promotional video for the expressway's electronic toll collection (ETC) system.

Ndung'u, previously employed by Moja Expressway as a toll attendant within their sales team, resigned in November 2022.

However, the company continued to utilize a video featuring  Ndung'u explaining the ETC system on their social media platforms.

Ndung'u contested this practice, arguing it violated his data privacy rights.

He asserted that the continued use of his image implied his ongoing employment with the company and constituted unauthorized use of his image for commercial purposes.

Moja Expressway defended their actions, stating they had obtained Ndung'u's consent while he was employed.

The company maintained that explaining the ETC system fell within his job duties and that he willingly participated in the video creation.

They further claimed he had received a consent form but never returned it, despite providing verbal agreement.

Data Protection Commissioner Immaculate Kassait ruled in favour of Ndung'u.

While acknowledging Moja Expressway might have obtained initial consent during his employment, they failed to acquire further authorization for publishing the video after his resignation.

Kassait emphasized the importance of documented consent, particularly when dealing with a former employee's personal information.

“In this regard, this office finds that the respondent did not seek consent from the complainant to further process his personal data after he resigned from employment,” Kassait stated.

Commissioner Kassait cited Section 25(c) of the Data Protection Act, which mandates that data controllers and processors ensure personal data is collected for specific, legitimate purposes and not further processed in a way incompatible with those purposes.

"The principles of personal data under Section 25 (c) of the Act provide that every data controller or data processor shall ensure that personal data is collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes," Kassait said.

This case underscores the critical role of data privacy regulations in safeguarding individuals' personal information. It serves as a reminder to Kenyan companies of their legal obligation to obtain informed consent before using an individual's image for commercial purposes.

The ruling also highlights the importance of adhering to data retention policies and ensuring authorization remains current for any continued use of personal data.