Mercy Wambua v Bold Decisive Digital Lab Equity Afia

Complaint upheld; compensation ordered. ODPC, 6 January 2024.

Record ID

ke-odpc-2024-0005

Case reference

ODPC COMPLAINT NO. 1973

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Mercy Wambua

Date decided

6 January 2024

Respondent type

private

Sector

banking

Violations

unauthorised image/photo use, lack of consent, commercial use of personal data, unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request, unlawful processing, failure to implement security measures

Provisions cited

s.25 DPA 2019, s.26 DPA 2019, s.27(a) DPA 2019, s.28(2) DPA 2019, s.28(1) DPA 2019, s.30 DPA 2019, s.30(a) DPA 2019, s.30(2) DPA 2019, s.32 DPA 2019, s.33 DPA 2019, s.37 DPA 2019, s.41(4) DPA 2019, s.41(2) DPA 2019, s.41(1) DPA 2019, s.56 DPA 2019

Outcome

complaint upheld; compensation ordered

Compensation

KES 1,900,000 (≈ USD 14,390 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 f6a434c4169b867f…

Record verified

30 July 2026

The facts

The complainant found a pamphlet bearing Equity Afia's logo carrying a picture of her and her two children that she had previously posted on her own social media page. The ODPC found that Bold Decisive Digital Lab, the first respondent, had used the images for commercial gain without the complainants' knowledge or consent, while the allegations against Equity Afia, the second respondent, were not made out.

Orders and outcome

The first respondent was found liable and ordered to compensate the complainants Kshs. 1,900,000 in total: KES 500,000 to the first complainant and KES 700,000 to each of the two minors. The complaint against the second respondent was dismissed. Dated 6 January 2024.

BANKING · CONSENT · DATA-BREACH · DATA-SECURITY · DISCLOSURE · DISMISSED · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.