A commentary on Dennis Gitonga Ndururi VS. Twiga Foods Limited – ODPC Complaint No. 289 of 2024

INTRODUCTION: THE EVOLUTION OF EMPLOYEE DATA HANDLING

In today’s digital age, the handling of employee data has evolved from simple record-keeping to intricate data analytics and even commercialization. Employers now leverage employee data, including images, for various purposes such as marketing, research, and enhancing corporate visibility. However, this practice introduces significant legal and ethical challenges, particularly regarding the consent and rights of employees over their personal data. The recent case of Dennis Gitonga Ndururi vs. Twiga Foods Limited highlights these critical issues, offering a cautionary tale for employers everywhere.

BACKGROUND OF THE CASE: UNAUTHORIZED USE OF EMPLOYEE’S IMAGE

The controversy began with the unauthorized use of Dennis Gitonga Ndururi’s image in a 2017 joint research study conducted by Twiga Foods and IBM. The study, aimed at developing a financial platform prototype, captured Ndururi’s image, which was later uploaded to IBM’s public Flickr account. The image spread widely, appearing in various online articles and social media platforms. Ndururi contends that Twiga Foods commercially benefited from the global dissemination of his image, all without his explicit consent.

COMPLAINANT’S ALLEGATIONS: EXPLOITATION AND IMAGE RIGHTS

Ndururi argued that his image was exploited for commercial gain, resulting in a loss of image rights and potential job opportunities. He asserted that the widespread availability of his image exposed him to identity theft risks and wrongfully portrayed him as a brand ambassador for Twiga Foods. These allegations underscore the ethical and legal implications of using employee images without their knowledge or approval.

RESPONDENT’S DEFENSE: CLAIMS OF INFORMED CONSENT

Twiga Foods disputed the allegations, claiming that Ndururi had been informed and had consented to the use of his image for the research study. They asserted that they were unaware of Ndururi’s concerns until notified by the Office of the Data Protection Commissioner (ODPC) in 2023 and took steps to remove the image from IBM’s platforms once alerted. Twiga Foods maintained that the image was used solely for research and not for commercial advertising.

ODPC’S DETERMINATION: COMPLAINANT MUST FIRST ISSUE DEMAND FOR ERASURE

The Office of the Data Protection Commissioner (ODPC) reviewed the complaint, which involved personal data processing violations dating back to 2018, before the enactment of the Data Protection Act, 2019. The ODPC found that the Respondent was not bound by the Act during the relevant period.

Upon notification of the complaint by ODPC, Twiga Foods promptly removed the contested images from its platforms and informed third parties to erase the Complainant’s image. ODPC also noted that Ndururi had failed to exercise his rights under the Data Protection Act before lodging the complaint. Consequently, the ODPC concluded that the complaint lacked merit, as no violations of the Complainant’s rights under the applicable law were found, and thus dismissed the complaint.

KEY TAKEAWAYS: ENSURING CONSENT AND TRANSPARENCY

1. Consent: Always obtain explicit, documented consent from employees before using their data or images beyond the original purpose.
2. Purpose Limitation: Use data only for its initial purpose. Additional consent is needed for any other use.
3. Transparency: Clearly inform employees about how their data will be used to build trust and ensure compliance.
4. Right to Erasure: Respect employees’ rights to request data deletion if used without consent or beyond agreed purposes.
5. Protection: Implement safeguards to prevent unauthorized access or misuse of personal data.
6. Compliance: Adhere to data protection laws to avoid legal issues and maintain ethical standards.

CONCLUSION:

The case of Dennis Gitonga Ndururi vs. Twiga Foods Limited sets a significant precedent for managing employee data and image rights in Kenya. It emphasizes the need for robust data protection practices and respecting individual rights in the digital age. Employers must recognize their power and responsibility in handling employee data, ensuring ethical considerations and legal compliance are prioritized. This case highlights the importance of obtaining explicit, documented consent for any use of employee data beyond the original intent and underscores the necessity for clear, transparent communication with employees.

The ODPC’s determination also reinforces the need for employees to be aware of their rights and the proper channels for addressing grievances. Employers should be proactive in addressing potential concerns to prevent legal disputes.

In summary, this case is a wake-up call for employers to implement strong data protection practices, ensure transparency, and manage employee data and image rights proactively to build a trustworthy and compliant workplace.